Let’s talk Get started

Legal

Privacy policy.

Last updated 26 October 2026

This policy explains how personal data is handled when you visit the Portico Play website at porticoplay.com or contact the studio. It is written to meet the EU General Data Protection Regulation (GDPR). It also covers how players are named on the leaderboards of Portico’s own events. It does not cover the Portico console or other businesses’ campaign pages, which have their own notices.

1. Who is responsible

Portico Play is a product and trading name of Luminbrane AB (org. no. 559523-4245, VAT SE559523424501), Stockholm, Sweden. Luminbrane AB is the data controller for personal data processed through this website. You can reach us at hello@porticoplay.com.

2. What this policy covers

The public website: its pages, the contact link and, if you agree to it, website analytics. The Portico console at console.porticoplay.com and the campaign pages at play.porticoplay.com process customer and participant data under separate agreements. Anyone who has taken part in a campaign should read the notice shown on that campaign; the business running it decides the offer, eligibility and fulfilment.

Portico also runs events of its own, such as Climb the ICE and the Portico Christmas Calendar. For those, Luminbrane AB is the controller, and section 4 explains how players are named on their leaderboards.

3. What we process, why, and on what basis

Delivering and protecting the website

The site is static HTML served by Cloudflare. Cloudflare processes technical request data, such as your IP address, browser type and the page requested, to deliver pages and defend against abuse. We do not receive or keep logs of individual visitors. Legal basis: our legitimate interest in operating a secure website, Article 6(1)(f) GDPR.

Website analytics, only with your consent

If you accept analytics in the cookie banner, we use Google Analytics 4 to understand which pages are read and how visitors arrive. It records pages viewed, the referring site, browser and device type, approximate location derived from your IP address (the address itself is not stored) and a pseudonymous identifier kept in the _ga cookies. We do not use advertising features or Google Signals, and we do not combine analytics with any information that identifies you. Analytics is delivered through Google Tag Manager, a container that loads measurement scripts and sets no cookies of its own. Until you accept, no Google script is loaded and no analytics cookie is set. Legal basis: your consent, Article 6(1)(a) GDPR, which you can withdraw at any time through Cookie settings in the footer. Retention: analytics event data is kept for no longer than 14 months.

Enquiries

The contact form sends your message by email to the studio mailbox through Resend, our email delivery provider; this website keeps no copy of it. Form enquiries are also passed to Portico’s own sales system so the studio can follow up, and are kept there no longer than needed. You can also email us directly. Either way we process what you send: typically your name, email address, company and the content of your message. We use it to answer you and to prepare any proposal or agreement you ask for. Legal basis: steps taken at your request prior to a contract, Article 6(1)(b) GDPR, and our legitimate interest in responding to business enquiries, Article 6(1)(f). We keep enquiry correspondence for as long as the conversation and any business relationship that follows require, and review it at least every two years. Please do not include customer records, identity documents or other sensitive information in an initial enquiry.

4. Names on the leaderboards of our own events

What other players see

In Portico’s own events, other players see you by your first name and the initial of your last name, for example “Marcus A.”. If two players would show the same name, the second is shown as “Marcus A. 2”. Your full surname, email address, job title and phone number are never shown to other players.

Why, and on what basis

The leaderboard is part of the competition you enter, so showing your name on it is needed to run that competition: Article 6(1)(b) GDPR. We also have a legitimate interest in a live competition between real people, Article 6(1)(f). Before you start or join a team, the sign-up tells you the exact name that will show.

Choosing a game name instead

You can object to showing your real name at any time. One tap at sign-up, or later in the event’s settings, switches you to a game name. The change applies at once on every leaderboard, and you can switch back. Emails already sent to your team before the switch cannot be recalled.

Showing your company

Showing your company next to your name, for example “Marcus A. · Portico”, is off unless you turn it on. It rests on your consent, Article 6(1)(a). We record each choice together with the wording you were shown. You can withdraw at any time in the settings, and your company stops showing at once.

Erasure

If you ask us to erase your data, your name is removed from the leaderboards, the final results, your team’s messages and any share images that showed it. On those you appear as “Former member”.

Moderation of names

Names are checked against a word filter when they are entered. Under the EU Digital Services Act, anyone can also report a player or team name that breaks the event’s rules, without signing in, and our moderators review the report. If we change or remove a name, the player gets a statement of the reasons, naming the rule, and can appeal once within six months. The appeal is decided by someone who did not make the first decision, and we tell the player the outcome. When a real name is changed this way, the player is switched to a game name for the rest of that season. We keep each decision, with the name as it was, as the record of the decision.

5. Who receives data

We do not sell personal data. It is shared only with service providers who process it on our instructions:

Data may also be disclosed where the law requires it or to protect our rights.

6. Transfers outside the EU/EEA

Cloudflare, Resend and Google may process data in the United States and other countries. Where that happens, transfers rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework and on Standard Contractual Clauses, with additional safeguards where needed.

7. Cookies and local storage

The cookie policy lists every cookie and storage item the site may use, how long each lasts and how to change your choice.

8. Your rights

Under the GDPR you have the right to:

To exercise any of these rights, email us at hello@porticoplay.com. We answer within one month. You also have the right to lodge a complaint with a supervisory authority. In Sweden that is the Swedish Authority for Privacy Protection, Integritetsskyddsmyndigheten (IMY), imy.se; you may instead contact the authority where you live or work.

9. Children

This is a business-to-business website. It is not directed at children and we do not knowingly collect data from anyone under 18.

10. Security

The site is served over HTTPS only, has no user accounts and stores no visitor data of its own; the contact form relays your message and keeps nothing. Our providers apply industry standard technical and organisational measures.

11. Changes to this policy

When we change how the website processes personal data we update this page and the date at the top. Material changes, such as adding a new processor, are announced here before they take effect.