Privacy Policy.

Last updated: May 2026

This Privacy Policy explains how Wahayla (operated by Anna Bjurstam, Stockholm, Sweden) collects, uses, and protects personal data when you use the wahayla.com website. It is written in plain English. If anything is unclear, please contact us using the details at the end of this document.

Wahayla is the data controller for all personal data collected through this website. We are subject to the General Data Protection Regulation (GDPR) and Swedish data protection law.

1. What data we collect

We collect only what is necessary, and only when you choose to provide it. We do not collect data automatically except for the basic technical information needed to serve you the website.

Contact form

• Name
• Email address
• Organisation (optional, if you choose to provide it)
• The content of your message

Session application form

• Name
• Email address
• What brings you here (free text, provided voluntarily)
• Location and how you found Wahayla (optional)

Insights subscription (if you choose to subscribe)

• Email address only

Website analytics

We use privacy-respecting analytics to understand how the site is used (for example, which pages are visited and where visitors come from). This data is aggregated and anonymous — it cannot identify you as an individual. We do not use Google Analytics. No tracking cookies are placed without your consent.

2. Why we collect it and our legal basis

We process your personal data for the following purposes, each with a clear legal basis under GDPR.

Contact form submissions: to respond to your enquiry. Legal basis: legitimate interest (responding to an inbound request).

Session applications: to review your application and contact you if appropriate. Legal basis: legitimate interest (processing an application you have submitted).

Insights subscription: to send you new insights and perspectives when published. Legal basis: consent (you opted in and can opt out at any time).

Analytics: to understand and improve the website. Legal basis: legitimate interest (improving our service). Data is anonymous and aggregated.

3. How long we keep your data

Contact and session application data: we keep this for as long as the conversation or relationship is active, and for a maximum of two years after the last contact. After that it is deleted.

Insights subscription: we keep your email address until you unsubscribe. Every email we send includes a clear unsubscribe link.

Analytics data: aggregated and anonymous — no personal data is retained.

4. Who we share it with

We do not sell your data. We do not share it with third parties for marketing purposes.

We use the following service providers, who process data on our behalf under data processing agreements:

• Email and contact form provider (Netlify) — to receive and manage form submissions
• Email newsletter provider — to manage the Insights subscription list
• Website hosting provider (Netlify) — to serve the website

All service providers are required to handle data in accordance with GDPR. Where providers are located outside the European Economic Area (EEA), we ensure appropriate safeguards are in place (such as Standard Contractual Clauses).

5. Cookies

We use cookies only for what is strictly necessary to make the website function. We do not use advertising or tracking cookies. If we use any optional cookies (for example, analytics), we will ask for your consent first via a cookie notice when you visit the site.

You can control and delete cookies through your browser settings at any time.

6. Your rights

Under GDPR, you have the following rights:

• Right of access: you can ask us what personal data we hold about you
• Right to rectification: you can ask us to correct inaccurate data
• Right to erasure: you can ask us to delete your data
• Right to restrict processing: you can ask us to limit how we use your data
• Right to data portability: you can ask us to provide your data in a portable format
• Right to object: you can object to our processing of your data where we rely on legitimate interest
• Right to withdraw consent: where processing is based on consent (e.g. newsletter subscription), you can withdraw it at any time

To exercise any of these rights, use the contact form at wahayla.com/contact. We will respond within 30 days. There is no charge for making a request.

7. How we protect your data

We take data security seriously. Personal data submitted through this website is transmitted over encrypted connections (HTTPS). We keep personal data for the minimum time necessary and apply access controls to limit who can see it.

No system is completely secure. If you have concerns about the security of your data, please contact us.

8. Children

This website is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has submitted data through this site, please contact us and we will delete it promptly.

9. Changes to this policy

We may update this Privacy Policy from time to time, for example if our services change or if legal requirements change. The date at the top of this page shows when it was last updated. We will notify newsletter subscribers of any material changes.

10. Contact and complaints

Data controller: Anna Bjurstam, Wahayla, Sweden

Contact: use the form at wahayla.com/contact

If you believe we have not handled your data correctly, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY):

imy.se  ·  imy@imy.se  ·  +46 8 657 61 00

We would always prefer to resolve any concern directly. Please contact us first and we will do our best to address it.