Privacy Policy

This privacy policy explains how Michaela Malm ("we", "us", "our") collects and uses personal data when you use our website at michaela-malm.fresh-web.co.uk. We are committed to protecting your privacy and handling your data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Who we are

Michaela Malm is the data controller responsible for your personal data.

• Business name: Michaela Malm
• Contact email: kontakt@michaelamalm.se

If you have any questions about this policy or how we handle your data, please contact us at kontakt@michaelamalm.se.

What data we collect

We only collect personal data that you provide to us directly. This typically happens when you submit an enquiry via the contact form on this website. The information collected may include:

• Your name
• Your email address
• Your phone number (if you choose to provide it)
• The content of the message you send
• Your IP address and basic technical metadata, collected automatically for spam prevention and security

We do not use advertising or behavioural tracking tools on this website. We do not profile visitors or build marketing databases. We do count visits, using a cookieless measurement tool that produces aggregate figures only (see below). Some pages embed services from Google (interactive maps and web fonts) which may set their own cookies or receive technical data such as your IP address when their resources are loaded — see our Cookie Policy for the detail and how to block them.

Visitor measurement

We use Cloudflare Web Analytics to understand how the website is being used. It records that a page was viewed, which page it was, the approximate country the visit came from, and the website or search engine the visitor arrived from. It sets no cookies, writes nothing to your device, and does not follow you to other websites.

We never see an individual visitor in this data. It reaches us only as totals, so there is no way for us to connect a page view to you, and we do not attempt to. Your IP address is used to derive an approximate country and is not used to identify you.

Legal basis: our legitimate interest in understanding how our website is used so that we can improve it. Because no information is stored on or read from your device, this measurement does not require your consent under the Privacy and Electronic Communications Regulations. If you would rather not be counted, a privacy extension such as uBlock Origin or Privacy Badger will block it, and the site will work normally.

Why we collect it and our legal basis

We process the information you submit for the following purposes:

• To respond to your enquiry. Legal basis: our legitimate interest in responding to people who contact us, and where relevant, the performance of a contract or steps taken at your request prior to entering a contract.
• To keep records of correspondence. Legal basis: our legitimate interest in maintaining accurate business records.
• To prevent spam and abuse of the contact form. Legal basis: our legitimate interest in protecting the integrity of our website.

Who we share it with

We do not sell your personal data or share it with third parties for marketing purposes. We do use trusted service providers (processors) to operate the website and deliver your enquiry to us. Each is bound by a data processing agreement and processes data only on our instructions.

• FreshWeb — provides the website hosting and contact form infrastructure. FreshWeb is the operator of this site's build and deploy pipeline on our behalf. Contact: joe@freshweb.uk.
• Cloudflare, Inc. — provides content delivery, DDoS protection, and bot protection (via Cloudflare Turnstile, which runs a challenge when the contact form is submitted). Cloudflare may process your IP address and basic browser characteristics for the duration of a form submission. Cloudflare also provides the cookieless visitor measurement described above.
• Neon — provides the PostgreSQL database in which contact form submissions are stored so we can read and respond to them.
• Resend — delivers the notification email that alerts us to a new enquiry.
• Google LLC — supplies the interactive map service embedded on the contact page and the web fonts used across the site. Google receives your IP address and basic browser metadata when those resources load, and may set its own cookies (see our Cookie Policy). Google is an independent recipient rather than a processor acting on our instructions.

We will also disclose personal data where we are legally required to do so (for example, in response to a valid court order or to comply with a statutory obligation).

International transfers

Some of our processors operate infrastructure outside the UK. Where personal data is transferred outside the UK, we rely on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with any additional safeguards the processor has in place. We will provide details of these safeguards on request.

How long we keep it

We retain contact form submissions and related correspondence for up to 24 months after the last interaction with you, unless a longer retention period is required (for example, for tax, accounting, or dispute resolution purposes). After that we delete or anonymise the data.

Your rights

Under UK data protection law, you have the following rights in relation to your personal data:

• Right of access — to ask for a copy of the personal data we hold about you.
• Right to rectification — to have inaccurate data corrected.
• Right to erasure — to ask us to delete personal data where we no longer have a legal basis to keep it.
• Right to restrict processing — to ask us to pause the use of your data while a query is resolved.
• Right to data portability — to receive a copy of the data you provided, in a structured, commonly used format.
• Right to object — to object to processing carried out under our legitimate interests.

To exercise any of these rights, email us at kontakt@michaelamalm.se. We will respond within one month.

Automated decision-making

We do not carry out any automated decision-making or profiling that produces legal or similarly significant effects.

Complaints

If you are unhappy with how we have handled your personal data, please let us know first so we can try to resolve it. You also have the right to complain to the UK's data protection regulator:

• Information Commissioner's Office (ICO)
• Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
• Helpline: 0303 123 1113
• Website: ico.org.uk

Changes to this policy

We may update this privacy policy from time to time. The "Last updated" date at the top of this page will reflect the most recent revision. Material changes will be highlighted on the home page of the site for at least 30 days.