1. Controller
Karl Berg Design ApS, c/o Karl Berg Pedersen, Dronningensgade 22A, 2. tv, 5000 Odense C, Denmark. CVR 40215263, VAT DK40215263. Email: info@karlbergdesign.com. The company has not appointed a data protection officer, as it is not required to; privacy requests go to the same email address.
2. Game pitch form
The form on Developer Pitch and the home page. Every field it contains, and the basis for each:
| Field | Required? | Why | Lawful basis |
|---|---|---|---|
| Studio name | Required | Identify who is pitching | Art. 6(1)(b) |
| Contact person | Required | Know who to address | Art. 6(1)(b) |
| Required | Reply to the pitch | Art. 6(1)(b) | |
| Game title, genre, target platforms | Required | Assess the game | Art. 6(1)(b) |
| Your pitch (message) | Required | Assess the game | Art. 6(1)(b) |
| Estimated budget band | Optional | Assess the project more fully | Art. 6(1)(f) |
| Deck, trailer or build link | Optional | Assess the project more fully | Art. 6(1)(f) |
| “Keep my details for future calls” tick-box | Optional | Invite you to future publishing calls | Art. 6(1)(a) consent |
Article 6(1)(b) covers processing necessary for steps you ask us to take before a possible contract — reviewing your pitch and replying. Article 6(1)(f) covers the optional fields: our legitimate interest is assessing a project with more context. Leaving them blank changes nothing about how the pitch is read, and you may object at any time under Article 21. Article 6(1)(a) applies only if you tick the optional future-calls box; you may withdraw that consent at any time by email, without affecting processing before withdrawal.
We also record the date and time of submission and which version of the privacy notice was shown. Pitch materials behind a link you provide stay where you host them; we do not copy them into our systems unless a publishing conversation follows.
3. Contact form and email
| Field | Required? | Why | Lawful basis |
|---|---|---|---|
| Name | Required | Address the reply | Art. 6(1)(f); Art. 6(1)(b) if about entering an agreement |
| Required | Send the reply | as above | |
| Subject, message | Required | Understand and answer the enquiry | as above |
We answer enquiries addressed to us, from businesses and individuals alike, on the basis of our legitimate interest in replying to messages we receive (Article 6(1)(f)); where the enquiry concerns entering an agreement with us, Article 6(1)(b) applies. The same applies to emails sent directly to info@karlbergdesign.com.
4. Server logs and security
When you load a page, the web server records the IP address, date and time, requested address, response code, browser user-agent and referring page. These logs are used only to keep the site secure and working (Article 6(1)(f)) and are deleted after 14 days. The forms use a short-lived security cookie against cross-site request forgery, and a one-way hash of the IP address to limit repeated submissions; the hash cannot be turned back into the address and is deleted within 48 hours.
5. Cookies and advertising measurement
Strictly necessary storage needs no consent. Microsoft Advertising measurement (Universal Event Tracking) runs only if you accept it in the cookie banner, signalled through Microsoft Consent Mode; if you reject, no request is made to Microsoft. Microsoft processes that data as an independent controller under its own privacy statement. Full list: Cookie Policy.
6. Who receives the data
- Namecheap, Inc. — hosts the web server and database in the United States (processor).
- Namecheap, Inc. (Private Email) — hosts the info@karlbergdesign.com mailbox (processor); emails may be stored outside the EEA under the same Standard Contractual Clauses.
- Microsoft — only if you accept advertising measurement (independent controller).
- Public authorities, where Danish or EU law requires it.
Personal data is not sold. Apart from the Microsoft measurement described above, which happens only if you accept it, personal data is not disclosed to third parties for their own purposes. We deliberately do not use a content delivery network, third-party analytics, a CRM, a chat widget or externally hosted fonts.
7. Transfers outside the European Economic Area
Our server is located in the United States, so form submissions and server logs are transferred outside the EEA. There is no EU adequacy decision covering this transfer: the EU–U.S. Data Privacy Framework applies only to organisations certified under it, and we do not rely on it. The transfer is made under the European Commission’s Standard Contractual Clauses (Article 46(2)(c) GDPR) incorporated in our hosting provider’s data processing terms. In practice this means US authorities may in some circumstances be able to request access to data held by a US provider. You can avoid the transfer entirely by writing to us by post at the address above. A copy of the safeguards can be requested by email.
8. How long we keep data
- Pitches: 12 months from submission; 36 months if you ticked the future-calls box.
- Contact messages: 12 months from submission.
- Server logs: 14 days. Rate-limit hashes: 48 hours.
- If a publishing agreement follows, correspondence becomes part of the contract file and is kept as Danish bookkeeping law requires (five years from the end of the financial year).
Deletion runs automatically every day.
9. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), and to object to processing based on legitimate interests (Art. 21). Where processing rests on consent, you may withdraw it at any time. Write to info@karlbergdesign.com; we answer within one month (Art. 12(3)) and may ask you to confirm your identity.
You may complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark — www.datatilsynet.dk — or to the supervisory authority where you live or work.
10. Other points
Providing data is voluntary; without the required fields we cannot review a pitch or answer a message. No decisions are made about you by automated means, and no profiling takes place. The site is directed at businesses and adults and is not intended for children. When this policy changes, the date at the top changes with it.