Privacy policy

This privacy policy describes how Brunnerne, CVR: 46668766, (hereinafter referred to as "we", "us" or "our") collects, uses and protects the personal information you (hereinafter referred to as "user", "you" or "your") provide us when you visit our website, services or other hosted and managed applications (hereinafter referred to as "services").

Data controller and contact information

Brunnerne is the sole data controller. Certain trusted individuals assist in the operation of the services as data processors and only act on instructions from the data controller. These individuals have access to personal data solely for the purpose of providing technical and operational support.

Brunnerne is a volunteer association, with the Danish CVR number 46668766, and is registered with the Danish Business Authority. Contact information for Brunnerne, can be found at https://brunnerne.dk

Our CTF competition is run by Brunnerne as a non-commercial project. Regardless of status, we are committed to processing your personal data in accordance with the GDPR.

Information we collect

We only collect and process the personal information necessary to provide our services to you and to fulfill our statutory obligations.

The information we collect and process may include the following:

• IP address
• Data sent as part of normal operations
• Data you submit in connection with creating a user or other use of the system, such as e-mail and username

Individual services may also collect:

• Data generated by using the system, which may be related to users associated with you

The purpose of the processing

We collect and process this data in order to issue services. All data collected is used exclusively in connection with the operation of the site, to be able to provide services to the extent of what you expect from services and to maintain the security of the service. This includes for the purpose of obtaining the competition prizes for those it relates to.

For example, your IP address will be stored in connection with page visits and generation of logs thereof. This is, among other things, to ensure that brute force attacks can be averted.

We do not collect and process data that is not in the eye of operating a secure and functional site or contacting winners for prizes.

Cookies and Tracking Mechanisms

We only use technically necessary cookies on our website to ensure its basic functionality.

These cookies are essential for the website to function properly, for example by remembering your preferences when navigating the site. We do not use tracking cookies, such as those provided by third-party providers such as Google Analytics.

Legal basis for processing

We only process your personal information when we have a legal basis for doing so. This basis may include:

• Your consent
• Fulfillment of our contractual obligations to you
• Fulfillment of our legal obligations
• Pursuit of our legitimate interests, which do not exceed your interests and fundamental rights and freedoms

Third parties

We will not share your personal information with third parties without your express consent, unless necessary to fulfill our legal obligations and to provide functional and secure services.

We may disclose your personal information to our trusted service providers who help us deliver our services to you, but only when necessary to provide the services. These service providers may only process your personal information in accordance with our instructions and in a secure and confidential manner.

In addition to the third-party service providers listed below, certain trusted individuals personally known to the data controller assist with the operation of the services. These individuals are bound by confidentiality and only access personal data as necessary to perform their support tasks.

A data processing agreement has been obtained with Hetzner, which is the primary server operator for services. This agreement with Hetzner can be obtained upon request.

Third parties:

• Hetzner Online GmbH
• Cloudflare Inc
• Brevo

Third parties have access to data solely in connection with the operation of services, including, among other things; server operation, network operation, caching, and email handling. Data available to these third parties is solely to be able to operate systems, and not in connection with the sale of data.

If you win a prize, we will contact you for consent before forwarding your information to the third parties involved in the fulfillment of the prize awards:

• Campfire Security ApS
• Albrechtsen Transport ApS
• General Logistics Systems Denmark A/S (GLS)

Prize-fulfillment third parties will get access to name, e-mail, phone number, t-shirt sizes and address if applicable for the fulfillment of the prize awards. Some of this information will only be gathered after your consent to receive the prize.

For the purpose of ranking teams in the competition, the scoreboard — containing only team names and scores, without usernames or other personal information — will be uploaded to CTFTime.org. Team names are not considered personal data under the GDPR, provided they do not contain information that can identify an individual. Participants are therefore not permitted to include personal data (such as full names, email addresses, or other identifiable information) in their team names. Any team name found to contain personal data may be altered or removed at our discretion before publication. As no personal data is shared in this process, CTFTime.org is not considered a third-party processor for the purposes of this privacy policy.

Storage of personal information

We will only store your personal information for as long as necessary to fulfill the purpose for which it was collected, unless the law requires us to store the information for a longer period of time. We will store your personal information securely and take appropriate technical and organizational measures to protect against unauthorized access, loss, misuse or alteration of your personal information.

For example, on services with user login and registration, user information will be stored as long as the user exists on the system. You can contact the data controller at any time to request that the data be removed from the services.

At the latest, all data will be deleted after 6 months.

The data subject's rights

Under the Data Protection Regulation, you have certain rights regarding your personal data. If you wish to exercise your rights, please contact us so that we can assist you with this. Below is an overview of your rights:

• Right to see information (right of access): You have the right to access the information we process about you, as well as a number of additional information.
• Right to rectification (correction): You have the right to have incorrect information about you corrected.
• Right to erasure: In special cases, you have the right to have information about you deleted before the time of our normal general deletion.
• Right to restriction of processing: In certain cases, you have the right to have the processing of your personal data restricted.
• Right to object: In certain cases, you have the right to object to our otherwise lawful processing of your personal data, including objection to processing for direct marketing.

Changes to the privacy policy

We reserve the right to change this privacy policy at any time.

Any changes will take effect from the time the amended privacy policy is posted on our website and sent to the registered users of the services.