Last updated: 1 October 2026

1. Who we are

This website is run by Åsa-Malin Sandström, based in Spain.

I am the data controller. That means I decide how and why your personal data is used.

If you have any questions about this policy or your data, contact me at: [email protected]

2. What personal data I collect

I may collect:

Your name

Your email address

Any information you choose to share with me (for example, in a form or a message)

Basic technical data, such as your IP address, browser type and device information, which is collected automatically when you visit the website

3. How I collect your data

Directly from you: when you fill in a form, sign up, or contact me

Automatically: when you visit and use the website

4. Why I use your data

I use your data to:

Answer your questions and messages

Give you access to what you signed up for

Run, maintain and improve the website

Meet my legal obligations

I only use your data when I have a legal reason to do so under the GDPR. This can be:

Your consent

A contract (or steps before a contract) with you

My legitimate interests, such as running my website safely

A legal obligation

5. The software I use: SOMBA.io

My website and customer records run on SOMBA.io, a software platform.

SOMBA.io acts as a data processor.

It processes your data only on my instructions.

It does not own your data and does not decide how it is used.

6. Hosting

SOMBA.io runs on HighLevel (GoHighLevel). The hosting provider is HighLevel Inc., based in the United States of America (USA).

This means your personal data may be stored on servers in the USA.

7. Data Processing Agreements

A Data Processing Agreement (DPA) is in place, as required by Article 28 of the GDPR. It sets out how your data must be handled and protected by the processors working for me.

8. International data transfers

Because HighLevel is based in the USA, your data may be transferred outside the European Economic Area (EEA).

These transfers are protected by Standard Contractual Clauses (SCCs), which are contracts approved by the European Commission to help keep your data safe outside the EEA.

9. How long I keep your data

I keep your personal data only for as long as I need it for the purposes listed above, or as long as the law requires.

When I no longer need it, I delete it or make it anonymous.

10. Your rights under the GDPR

You have the right to:

Access: ask for a copy of your data

Correct: ask me to fix wrong or incomplete data

Delete: ask me to erase your data

Restrict: ask me to limit how I use your data

Object: object to how I use your data

Data portability: ask to receive your data in a usable format

Withdraw consent: at any time, if I use your data based on consent

To use any of these rights, email me at [email protected].

You also have the right to complain to a data protection authority. In Spain, this is the Agencia Española de Protección de Datos (AEPD).

11. Data security

I take reasonable steps to protect your personal data from loss, misuse and unauthorised access.

No method of sending or storing data online is 100% secure, so I cannot guarantee complete security.

12. Changes to this policy

I may update this Privacy Policy from time to time. The newest version will always be on this page, with the date it was last updated.