GDPR Information — maca.se

Version: 3.0

Last updated: 2026-08-01

Applies to: maca.se (https://maca.se/)

1. Purpose of this document

Here we provide the information required by the GDPR when we collect personal data via the website — without you needing to request it separately.

This document fulfills the information obligation under GDPR Articles 13 and 14 when personal data is collected via the website.

2. Data controller

| | |

|—|—|

| Name | maca.se |

| Email | web@maca.se |

| Website | https://maca.se/ |

3. Processing activities

Web server and operation logs

Data: IP address, timestamp, URL, browser, referrer
Purpose: Operation, troubleshooting and security
Legal basis: Legitimate interest (GDPR Art. 6(1)(f))
Retention period: Web hosting — normally 30–90 days in access logs
Recipients: Web hosting provider/vendor
Transfers outside the EU/EEA: May occur depending on where the server is located

Comments

Data: Name, email, IP address, comment text
Purpose: Publish and moderate comments
Legal basis: Legitimate interest (GDPR Art. 6(1)(f))
Retention period: As long as the comment remains on the website
Recipients: Web hosting provider

Fluent Support

Source: Fluent Support
Data: Name, email, case title, messages, attachments, status, any customer ID and technical metadata (IP, browser)
Purpose: Handle customer support cases and store conversations in the support system
Legal basis: Legitimate interest (GDPR Art. 6(1)(f))
Retention period: As long as the case is active and thereafter according to plugin settings (normally up to 24 months)
Recipients: Website support staff
Transfers outside the EU/EEA: Stored in the WordPress database on your web hosting; may occur with email integrations
Vendor privacy policy: https://fluentsupport.com/privacy-policy/

maca DownList

Source: maca DownList
Data: Email and any name in email gate, download log (file, timestamp, IP address may be logged)
Purpose: Provide file downloads and track downloads according to the site owner’s settings
Legal basis: Legitimate interest (GDPR Art. 6(1)(f))
Retention period: Download log according to plugin settings; email gate session temporarily
Recipients: Website staff
Transfers outside the EU/EEA: Normally processed within the EU/EEA via your web hosting

Google Site Kit

Source: Site Kit by Google
Data: Website statistics and search data depending on activated Google services (Analytics, Search Console, etc.)
Purpose: Statistics, keyword analysis and website optimization
Legal basis: Consent (GDPR Art. 6(1)(a))
Retention period: According to the respective Google service — see Google’s documentation
Recipients: Google LLC
Transfers outside the EU/EEA: May involve transfer to the USA depending on the service
Vendor privacy policy: https://policies.google.com/privacy

WPForms

Source: WPForms Lite
Data: Form content according to configured fields
Purpose: Collect inquiries, bookings or registrations
Legal basis: Legitimate interest (GDPR Art. 6(1)(f))
Retention period: According to plugin settings and internal retention routine
Recipients: Website staff
Transfers outside the EU/EEA: May occur if WPForms cloud services are used
Vendor privacy policy: https://wpforms.com/privacy-policy/

Support pages and case handling

The website has support pages or a case portal where you can submit inquiries. Data you provide there (e.g. name, email, messages and attachments) is stored so that we can handle and follow up on your case.

Case data is normally stored in the website’s database (WordPress) or in a connected support tool until the case is closed and in accordance with our internal retention routine.

Identified support pages:

Support tools:

Fluent Support (Fluent Support)

You may request access to, rectification or deletion of data in your support cases by contacting us.

4. Purpose and legal basis

Each processing operation must have a valid legal basis under GDPR Article 6. Below we describe the bases we use on the website:

Legal bases

Legitimate interest (Art. 6(1)(f)) — for security, operation, troubleshooting, spam protection and responding to general inquiries, following a balancing test where your interests do not override ours.
Consent (Art. 6(1)(a)) — for optional cookies, newsletters and marketing when consent is required. You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

5. Source of data

We normally collect data directly from you (forms, orders, account, email) and automatically during visits (technical logs, cookies according to your consent). Data may also come from payment or delivery partners when you shop with us.

6. Retention period

We store personal data only as long as it is necessary for the purpose or as required by law. After that, the data is deleted or anonymized securely.

7. Recipients

Data may be shared with providers such as hosting, CDN, email, payment, analytics and support tools. These may process data only under contract (data processing agreement) and our instructions. A list of processing activities is shown in the activities above.

8. Transfers to third countries

Some providers may process personal data outside the EU/EEA, especially in the USA. This only happens when there is a valid transfer mechanism.

We primarily use the European Commission’s Standard Contractual Clauses (SCCs), supplementary technical and organizational measures, and providers’ binding corporate rules or adequacy decisions where applicable.

9. Your rights under the GDPR

You have the following rights under the GDPR when we process your personal data:

Your rights

Right of access (Art. 15) — obtain confirmation and a copy of your data
Rectification (Art. 16) — correct inaccurate or incomplete data
Erasure (Art. 17) — request deletion where there is a legal basis
Restriction (Art. 18) — request restricted processing in certain situations
Objection (Art. 21) — object to processing based on legitimate interest or direct marketing
Data portability (Art. 20) — receive data in a structured, machine-readable format when processing is based on contract or consent
Withdraw consent (Art. 7(3)) — when processing is based on consent
Complaint (Art. 77) — to a supervisory authority

To exercise your rights, contact us at web@maca.se.

We respond to requests concerning your rights without undue delay and no later than within one month (may be extended by a further two months in complex cases under Art. 12(3)).

Supervisory authority

You have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY), Box 8114, 104 20 Stockholm, phone 08-657 61 00, website imy.se — if you believe the processing infringes the GDPR.

10. Information obligation and automated decision-making

We generally do not use automated decision-making or profiling that has legal effects or similarly significantly affects you. If this changes, the policy will be updated.

AI systems and transparency

The website uses AI-based tools (e.g. chatbots or content generation). Data you send to these functions may be processed by an external AI provider. We inform you about the purpose, provider and your rights in the table above. Under the EU AI Act, certain AI systems must be transparent — if a system is classified as high-risk, we comply with the requirements for information and human oversight.

11. Cookies

Information about cookies and consent is available in our cookie policy. A full description of processing is available in the privacy policy.

GDPR information