← Get Me Afloat

Get Me Afloat · Privacy

Privacy policy

Last updated 9 November 2026

What we collect when you visit getmeafloat.com, join the sea of names, sponsor or bid: why, for how long, who else sees it, and what you can ask us to do with it.

01Who is responsible

BRED Applications is the data controller for getmeafloat.com and everything sold on it:

BRED Applications
Doritshave 24, 6040 Egtved, Denmark
CVR 45915905
contact@bredapplications.com

Write to us about anything on this page. We're a small business: the person who answers your email is the one who handles your data.

02What we collect, and why

Sponsors and bidders

What
Your company's name, a contact email, website, logo, invoice address and VAT number, and the orders, bids and payments you make with us.
Why
To approve your brand, handle your order or bids, deliver and invoice the sponsorship, and show it as our terms describe.
Legal basis
The contract with your business (GDPR art. 6(1)(b)), and the Danish Bookkeeping Act for our accounts (art. 6(1)(c)). For you as the person we deal with at a company: our legitimate interest in dealing with it (art. 6(1)(f)).
How long
Invoices and other accounting records: 5 years from the end of the financial year they belong to. Bids that didn't win: until 12 months after bidding has ended on every space. Everything else: until the sponsorship has ended and any claims are settled.

Signing in to bid

What
Your email address, and your sign-in in your browser.
Why
So only you can bid for your company. We email you a sign-in link; there's no password.
Legal basis
The contract (art. 6(1)(b)).
How long
Until you ask us to delete it, and at most 12 months after bidding has ended on every space.

Payments

What
Card details, the name and billing address on the payment, and the VAT number you give at checkout.
Why
To take payment, and to make the invoice with the right VAT.
Legal basis
The contract and our duty to keep accounts (art. 6(1)(b) and (c)).
How long
Card details are handled and kept by Stripe, never by us. Invoices: 5 years, as above.

Your Instagram @

What
The @ of an Instagram account that commented SEA under one of our reels.
Why
To show it in the sea of names on our website (section 3).
Legal basis
Your consent, given by commenting SEA (art. 6(1)(a)). You can withdraw it at any time.
How long
Until you ask us to take it out, or the project ends.

Emails to us

What
What you write, and your email address.
Why
To answer you.
Legal basis
Our legitimate interest in answering (art. 6(1)(f)), or the contract if it's about an order.
How long
As long as the matter needs, unless it belongs to an order's records.

Visits to the site

What
Your IP address and the technical details of each request your browser makes.
Why
To deliver the site, keep it secure and stop abuse, such as a flood of requests.
Legal basis
Our legitimate interest in a working, secure site (art. 6(1)(f)).
How long
Our abuse limits forget an IP address after a day. Our providers keep their logs for a short time.

Do you have to give us this? To sponsor or bid, yes: without your company's details and an email we can't make the contract or the invoice. Joining the sea of names is up to you.

03The sea of names

Commenting SEA under one of our reels on Instagram is how you ask to join the sea. We read the comments on our own reels and add the @ of each account that commented SEA to the sea of names on our website, where anyone can see it. We keep only the @ and when it was added.

To leave the sea, email us or send us a message on Instagram, and we'll take your @ out.

04Cookies and your browser

We don't use cookies for tracking, analytics or advertising, so there's no cookie banner. The site keeps two things in your browser's local storage, both only when you need them:

  • your sign-in as a bidder, until you sign out;
  • a bid you've started while you sign in, so it's still there when you come back from the sign-in link. It's deleted when you come back, and ignored after 2 hours.

Both are strictly necessary for what you've asked for, so they don't need consent, and neither is sent to anyone but us. Stripe's checkout pages set their own cookies, to prevent fraud.

05Who else sees it

We use a few providers. They handle data for us under data processing agreements, and only for what we use them for:

  • Supabase: our database, sign-in, file storage and server functions, on servers in Frankfurt, Germany.
  • Stripe: payments, invoices and the VAT on them. For card payments, Stripe Payments Europe, Ltd. in Ireland is also a controller in its own right, for example to prevent fraud and meet its legal duties: see stripe.com/privacy.
  • Our web host and our email provider: they deliver the site and our emails, such as your sign-in link.

Others see something too:

  • Instagram (Meta) handles your comments, and anything you do when you follow our links there, under Meta's own privacy policy.
  • Authorities, such as the Danish Tax Agency, when the law requires it, and an accountant or auditor if we use one.

The site's fonts and code libraries are served from our own site, so no font or code service sees your visit. We never sell personal data, and we don't use it for advertising.

06Outside the EU

Our data is stored in the EU. Some of our providers are American or have American subcontractors (Supabase and Stripe among them), so data can be reached from the US. Such transfers rely on the EU–US Data Privacy Framework where the company is certified under it, and otherwise on the EU's standard contractual clauses.

07Your rights

You can ask us to:

  • tell you what we hold about you, and give you a copy;
  • correct it;
  • delete it, unless we have to keep it, as with our accounts;
  • restrict how we use it, or stop using it where we rely on our legitimate interest;
  • hand it to you in a machine-readable format, to take elsewhere;
  • take your @ out of the sea of names. Withdrawing consent doesn't affect what we did before.

Write to contact@bredapplications.com. We answer within a month, and may ask you to confirm who you are.

Apart from the bidding rules in our terms, under which the highest bid wins when its time runs out, nothing about you is decided automatically, and we don't profile you. A person approves every brand.

If you think we handle your data wrongly, you can complain to Datatilsynet, the Danish Data Protection Agency: Carl Jacobsens Vej 35, 2500 Valby, Denmark · dt@datatilsynet.dk · datatilsynet.dk.

08Security

  • Our data is stored in the EU, and travels encrypted (HTTPS).
  • Only we can see sponsors' and bidders' details, behind a sign-in with two-factor authentication.
  • Card details never reach our servers.
  • If a breach ever puts your data at risk, we tell you and Datatilsynet as the law requires.

09Changes to this policy

When we change how we handle data, we update this page and the date at the top. If a change matters for data we already hold about you, we'll tell you by email.