GDPR Information — maca.se

Version: 3.0

Last updated: 2026-08-15

Applies to: maca.se (https://maca.se/)

1. Purpose

This page provides the information required under GDPR Articles 13–14 when we collect personal data via the website.

This notice fulfills the information obligation under GDPR Articles 13 and 14 when personal data is collected via the website.

2. Data controller

| | |

|—|—|

| Name | maca.se |

| Email | web@maca.se |

| Website | https://maca.se/ |

3. Processing activities

Web server and operational logs

Data: IP address, timestamp, URL, browser, referrer
Purpose: Operation, troubleshooting, and security
Legal basis: Legitimate interest (GDPR Art. 6(1)(f))
Retention: Hosting provider — typically 30–90 days in access logs
Recipients: Hosting provider
Transfer outside EU/EEA: May occur depending on server location

Comments

Data: Name, email, IP address, comment text
Purpose: Publish and moderate comments
Legal basis: Legitimate interest (GDPR Art. 6(1)(f))
Retention: As long as the comment remains on the site
Recipients: Hosting provider

Fluent Support

Source: Fluent Support
Data: Name, email, case title, messages, attachments, status, any customer ID and technical metadata (IP, browser)
Purpose: Handle customer support cases and store conversations in the support system
Legal basis: Legitimate interest (GDPR Art. 6(1)(f))
Retention: As long as the case is active and thereafter according to plugin settings (normally up to 24 months)
Recipients: Website support staff
Transfer outside EU/EEA: Stored in the WordPress database at your web host; may occur with email integrations
Vendor privacy policy: https://fluentsupport.com/privacy-policy/

maca DownList

Source: maca DownList
Data: Email and, if applicable, name for email gate, download log (file, time, IP address may be logged)
Purpose: Provide file downloads and track downloads according to the site owner’s settings
Legal basis: Legitimate interest (GDPR Art. 6(1)(f))
Retention: Download log according to plugin settings; email gate session temporarily
Recipients: Website staff
Transfer outside EU/EEA: Normally processed within the EU/EEA via your web host

Google Site Kit

Source: Site Kit by Google
Data: Website statistics and search data depending on enabled Google services (Analytics, Search Console, etc.)
Purpose: Statistics, keyword analysis, and website optimization
Legal basis: Consent (GDPR Art. 6(1)(a))
Retention: According to the respective Google service — see Google’s documentation
Recipients: Google LLC
Transfer outside EU/EEA: May involve transfer to the USA depending on the service
Vendor privacy policy: https://policies.google.com/privacy

WPForms

Source: WPForms Lite
Data: Form content according to configured fields
Purpose: Collect inquiries, bookings, or registrations
Legal basis: Legitimate interest (GDPR Art. 6(1)(f))
Retention: According to plugin settings and internal deletion routine
Recipients: Website staff
Transfer outside EU/EEA: May occur if WPForms cloud services are used
Vendor privacy policy: https://wpforms.com/privacy-policy/

Support pages and ticket handling

This website provides support pages or a ticket portal where you can submit requests. Information you provide there (e.g. name, email, messages, and attachments) is stored so we can handle and follow up on your case.

Ticket data is typically stored in the site database (WordPress) or a connected support tool until the case is closed and per our internal retention routine.

Detected support pages:

Support tools:

Fluent Support (Fluent Support)

You may request access, correction, or deletion of data in your support tickets by contacting us.

4. Purposes and legal bases

Each processing activity must have a valid legal basis under GDPR Article 6:

Legal bases

Legitimate interest (Art. 6(1)(f)) — security, operations, spam protection, responding to inquiries, after balancing interests.
Consent (Art. 6(1)(a)) — optional cookies, newsletters, marketing where consent is required. You may withdraw at any time.

5. Sources

We collect data from you directly (forms, orders, accounts) and automatically (logs, cookies per your consent). Partners may provide data for orders.

6. Retention

We retain personal data only as long as needed for the purpose or as required by law, then delete or anonymize securely.

7. Recipients

Data may be shared with hosting, CDN, email, payment, analytics, and support providers under processor agreements.

8. Transfers outside the EU/EEA

Some providers may process data outside the EU/EEA. This occurs only with a valid transfer mechanism.

We rely on EU Standard Contractual Clauses, supplementary measures, and adequacy decisions where applicable.

9. Your rights

You have the following rights when we process your personal data:

Your rights

Right of access (Art. 15)
Rectification (Art. 16)
Erasure (Art. 17)
Restriction (Art. 18)
Objection (Art. 21)
Data portability (Art. 20)
Withdraw consent (Art. 7(3))
Lodge a complaint with a supervisory authority (Art. 77)

To exercise your rights, contact us at web@maca.se.

We respond without undue delay and within one month (extendable by two months for complex requests under Art. 12(3)).

Supervisory authority

You may lodge a complaint with your local data protection authority if you believe processing violates GDPR.

10. Automated decision-making

We generally do not use automated decision-making or profiling with legal or similarly significant effects.

AI systems and transparency

This website uses AI-based tools (e.g. chatbot or content generation). Data you submit to these features may be processed by an external AI provider. We describe the purpose, provider, and your rights in the table above. Under the EU AI Act, certain AI systems must be transparent — if a system is classified as high-risk, we follow requirements for information and human oversight.

11. Cookies

See our cookie policy and privacy policy.

GDPR Information