Privacy Policy

Last updated: 17 September 2026

This policy explains what personal data we collect when you visit mathiasholmgren.com ("the Site"), why we collect it, who we share it with, and the rights you have over it. It is written to meet the EU General Data Protection Regulation (GDPR) and Swedish data protection law.

1. Who we are

The controller responsible for your personal data is:

• Leading Joy AB (org. nr. 559132-2333)
• Danderydsgatan 27, 114 26 Stockholm, Sweden
• Email: mathias@mathiasholmgren.com

We have not appointed a Data Protection Officer, as we are not required to. You can raise any privacy question at the email above.

2. The data we collect and why

Newsletter subscription

If you subscribe to our newsletter, we collect the email address you enter in the sign-up form.

• Purpose: to send you the newsletter and related updates you asked for.
• Legal basis: your consent (GDPR Art. 6(1)(a)). You give it by submitting the form. You can withdraw it at any time using the unsubscribe link in every email, or by emailing us.
• Processor: the form and mailing list are handled by MailerLite (see section 4).

Contacting us

If you email us or use a contact link, we process your email address, your message, and anything else you choose to include.

• Purpose: to read and respond to you.
• Legal basis: our legitimate interest in answering enquiries and, where relevant, taking steps at your request before entering a contract (GDPR Art. 6(1)(b) and (f)).

Analytics and personalization

With your consent, we use website optimization and personalization tools that record how visitors use the Site (such as pages viewed and interactions) to test and improve content.

• Purpose: to understand and improve how the Site performs.
• Legal basis: your consent (GDPR Art. 6(1)(a)), given through the cookie banner. Withdraw it any time via the banner or your browser.
• Detail: see the Cookie Policy.

Embedded video

Some pages embed YouTube videos. When you click to play one, YouTube (Google) may set cookies and receive your IP address and viewing data. Video thumbnails may load from Google when the page loads.

• Legal basis: your consent for any non-essential cookies these embeds set (GDPR Art. 6(1)(a)). See the Cookie Policy.

Hosting, security, and server logs

Our host and CDN automatically process technical data (such as IP address, browser type, and request timestamps) to serve the Site and protect it against abuse.

• Purpose: to deliver the Site securely and reliably.
• Legal basis: our legitimate interest in the security and operation of the Site (GDPR Art. 6(1)(f)).

3. Legal bases at a glance

• Newsletter — email. Legal basis: consent.
• Answering enquiries — email, message. Legal basis: legitimate interest / pre-contract.
• Analytics & personalization — usage data, identifiers. Legal basis: consent.
• Embedded video — IP, viewing data. Legal basis: consent.
• Hosting & security — IP, technical logs. Legal basis: legitimate interest.

4. Who we share your data with

We do not sell your data. We share it only with the service providers ("processors") that run the Site and our newsletter, each bound by a data processing agreement:

• MailerLite — newsletter list management and delivery. Subscriber data is stored on servers in the EU (Germany). MailerLite's privacy policy: https://www.mailerlite.com/legal/privacy-policy
  
  • We use MailerLite to manage our email marketing subscriber list and to send emails to our subscribers. MailerLite is a third-party provider, which may collect and process your data using industry standard technologies to help us monitor and improve our newsletter.
• Webflow — website hosting and, if enabled, website optimization/personalization (Webflow Optimize, formerly Intellimize).
• Cloudflare — content delivery and security.
• Google (YouTube) — embedded video, when you play it.

We may also disclose data where the law requires it.

5. International transfers

Newsletter data is stored in the EU. Some providers above are US-based or use sub-processors outside the EEA. Where data leaves the EEA, it is protected by an approved transfer mechanism: the EU–U.S. Data Privacy Framework where the provider is certified, and the European Commission's Standard Contractual Clauses otherwise. You can ask us for details of the safeguards that apply.

6. How long we keep it

• Newsletter: until you unsubscribe or withdraw consent, after which we remove you from the active list promptly and delete your records within 30 days.
• Enquiry emails: up to 24 months after our last exchange, unless an ongoing relationship requires otherwise.
• Server and security logs: retained by our hosting and CDN providers according to their own retention periods.

7. Your rights

Under the GDPR you have the right to:

• access the data we hold about you;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to processing;
• data portability;
• withdraw consent at any time, without affecting processing already carried out.

To exercise any of these, email mathias@mathiasholmgren.com. We respond within one month.

If you believe we have handled your data unlawfully, you can complain to the Swedish supervisory authority, Integritetsskyddsmyndigheten (IMY) — https://www.imy.se — or to the authority in your EU country of residence.

8. Security

We rely on providers that apply industry-standard technical and organizational measures, including encryption in transit. MailerLite is certified to ISO/IEC 27001. No method of transmission over the internet is completely secure, so we cannot guarantee absolute security.

9. Children

The Site is aimed at professionals and is not directed at children. We do not knowingly collect data from anyone under 16.

10. Changes

We may update this policy. The "Last updated" date shows the current version. Material changes to how we use your data will be made clear on this page.

11. Contact

Questions about this policy or your data: mathias@mathiasholmgren.com.