Last updated: 30 June 2026
Insubornável (insubornavel.com) is an independent news aggregator. For data protection purposes, the data controller is the site operator, established in Iceland, under Icelandic data protection law — Lög um persónuvernd og vinnslu persónuupplýsinga nr. 90/2018 (Iceland's implementation of the EU General Data Protection Regulation, GDPR) — and the Icelandic Electronic Communications Act — Fjarskiptalög nr. 81/2019 — which implements the EU ePrivacy Directive (Directive 2002/58/EC).
Contact: newsroom@insubornavel.com
2.1 Geolocation for local weather
When you visit the weather page (/clima), your IP address is used server-side to identify your approximate city, using a local geolocation database (DB-IP City Lite, licensed CC BY 4.0, hosted on our servers in Iceland). The result (city name) is stored in a cookie in your browser for 12 months. On subsequent visits, the city name is read directly from the cookie — no IP lookup takes place. Your IP address is not transmitted to any third party for this purpose.
Legal basis: legitimate interest in personalising the service (Art. 6(1)(f) of Lög um persónuvernd nr. 90/2018 · GDPR Art. 6(1)(f)).
2.2 Session cookie
A session cookie (PHPSESSID) is created on your first visit to the site. It holds an anti-CSRF (Cross-Site Request Forgery) token that protects every form on the site against forged requests; once you log in or post a comment, the same cookie also identifies your authenticated session. This cookie is strictly necessary for the site to function, contains no personal data, is never used for tracking, and is deleted when you close your browser.
Legal basis: necessity for the performance of the service (Art. 6(1)(b) of Lög um persónuvernd nr. 90/2018 · GDPR Art. 6(1)(b)) and security obligation.
2.3 Theme preference
Your choice of light or dark theme is stored in localStorage — local browser storage — not in a cookie, and is never transmitted to the server. It does not identify you.
2.4 Accounts, comments and votes — IP address
When you create an account, post a comment, or vote on an article, your IP address is recorded alongside that action. Purpose: legal accountability (under a lawful Icelandic court order, the IP allows authorship of unlawful content to be attributed to its actual author) and abuse prevention (vote deduplication, spam control). IPs are retained for 12 months and then automatically erased.
The anonymous whistleblower channel is the exception: it records no IP address and no device identifier, ever. See the Editorial Statute, art. 4.2 and 5.4.
Legal basis: legitimate interest (Art. 6(1)(f) of Lög um persónuvernd nr. 90/2018 · GDPR Art. 6(1)(f)).
2.5 Third-party image proxy
Article images are resized and delivered through images.weserv.nl, an open-source image-processing service operated from the Netherlands. When your browser loads an article image, your IP address is received by weserv.nl's servers as part of the standard HTTP request. weserv.nl is a Dutch service subject to GDPR. This proxy serves two purposes: it prevents your IP address from being transmitted directly to each original news source's servers, and it converts images to the WebP format to reduce bandwidth. No personal data other than the IP address is transmitted to weserv.nl, and no profiling or tracking is carried out through this channel.
Legal basis: legitimate interest in efficient and privacy-preserving image delivery (Art. 6(1)(f) of Lög um persónuvernd nr. 90/2018 · GDPR Art. 6(1)(f)).
| Name | Type | Duration | Purpose | Third parties |
|---|---|---|---|---|
| PHPSESSID | Session · strictly necessary | Until browser is closed | CSRF protection (every visit) and login session | None |
| insub-weather-city | Functional | 12 months | Local weather forecast on /clima | None |
localStorage key insub-tema (theme preference) is not a cookie and is not listed above.
Transparency note: Article images are the only resource routed through a third party — images.weserv.nl (Netherlands), used solely to resize images. No advertising or profiling is involved. See section 2.5 for full details.
Under Lög um persónuvernd nr. 90/2018, you have the right to:
To exercise any of these rights, send a request to newsroom@insubornavel.com. Requests are handled manually by the site operator within 30 days. To protect your data, we may ask you to confirm your identity before acting on a request, in order to prevent fraudulent or abusive requests. No automated self-service portal is currently available.
Note: geolocation and theme data are stored only in your own browser (cookie and localStorage). To remove them, clear your browser cookies and site data — no action from us is required. In particular, to opt out of city-based weather personalisation, simply do not visit the weather page (/clima), or clear the insub-weather-city cookie.
If you consider that the processing of your personal data infringes applicable law, you may lodge a complaint with the Icelandic supervisory authority:
Persónuvernd (Icelandic Data Protection Authority)
www.personuvernd.is
Rauðarárstígur 10 · 105 Reykjavík · Iceland
Any material changes will be announced via a notice in the site footer at least 30 days in advance. The date of the last update is shown at the top of this page.