Visitor and Security Data

This website records technical information about visits and requests. Depending on the interaction, this may include IP addresses, pages visited, referrer information, request counts, timestamps, login attempts, and other technical information necessary to operate and protect the website.

These records are used to monitor website activity, investigate suspicious behaviour, troubleshoot technical problems, prevent abuse, and protect the website, its users, and its services. Visitor records may be reviewed during security investigations and may be used to restrict or ban access where justified.

The intended legal basis for necessary security processing is the controller's legitimate interest in maintaining the security, availability, and integrity of its systems, subject to an appropriate balancing assessment. Where processing is required by law, the applicable legal obligation is the legal basis.

Access to security records is restricted to authorised persons. Routine visitor and security logs are intended to be retained for up to 12 months, after which they are deleted or anonymised, unless a documented reason justifies a different retention period.

Geolocation and geoPlugin

This website uses geoPlugin to estimate a visitor's approximate geographical location from their IP address. The website may store the resulting latitude, longitude, city, and country fields. These values are based on IP geolocation and may not represent the visitor's actual physical location.

Geolocation information may be used for relevant operational purposes and, where applicable, to support tax and accounting compliance. It is not intended to provide precise GPS tracking of a visitor's device.

The IP address or other information required for a lookup may be transmitted to geoPlugin. The provider may process this information in accordance with its own privacy terms.

geoPlugin privacy information: https://www.geoplugin.com/privacy

AI-Assisted Security Analysis

This website uses an automated security process that may send request-count figures to OpenAI to help assess whether website activity appears suspicious. The purpose is to support abuse detection and protect the website against security threats.

Under the intended implementation, visitor IP addresses and visitor IDs are not included in the OpenAI analysis prompt. The submitted information is limited to request-count figures used for the security assessment.

The resulting security assessment is stored against the relevant visitor record on this website. It may be considered during security reviews and when deciding whether further protective measures, including access restrictions or bans, are appropriate. An automated assessment may be inaccurate and is not, by itself, proof of malicious activity.

The intended legal basis is the controller's legitimate interest in detecting abuse and maintaining system security, subject to an assessment of necessity and the rights of affected individuals. Where decisions based solely on automated processing have legal or similarly significant effects, additional GDPR requirements and safeguards may apply.

OpenAI processes submitted information under the terms and data-handling arrangements applicable to the API service used. The provider's retention settings and contractual terms may affect how prompts and outputs are handled.

OpenAI API data information: OpenAI API data controls

Security Incidents and Access Bans

Where a specific security incident occurs, relevant records may be retained for up to five years if the circumstances and a documented security, investigation, or legal-claims purpose justify that period. This is not an automatic retention period for every visitor or security event.

Where an IP address has been associated with a visitor ban, the minimum information necessary to enforce the ban may be retained for as long as the restriction remains necessary to protect the website and its services.

Banned visitor records are reviewed at least every 12 months to determine whether continued retention is justified. The IP address and associated information are deleted when they are no longer necessary, unless a separate lawful reason requires further retention.

Information associated with a ban is limited to what is reasonably necessary, such as the IP address, reason for the restriction, date of the restriction, and information needed to review the decision. Access is restricted to authorised persons.

Registered Users and Clients

If you register for an account or purchase services, this website may process account details, contact information, service-related data, and relevant technical and security records.

This information is used to create and maintain accounts, provide requested services, communicate with clients, administer purchases, and protect accounts against unauthorised access. Processing necessary to provide a requested service is generally based on contractual necessity. Processing required by law is based on the applicable legal obligation. Security processing may be based on legitimate interests where justified.

Account information is retained while necessary to administer the account and provide services, subject to applicable legal obligations and any justified retention requirements.

Postmark and SMTP Email

This website uses SMTP to send transactional and service-related emails. Postmark is the configured default email delivery provider, subject to confirmation of the active production configuration.

Depending on the email, information transmitted to the email provider may include sender and recipient email addresses, message subjects and contents, message headers, timestamps, delivery status, and technical metadata.

Email delivery is used for account-related communications, purchases, service requests, security notifications, and other relevant website operations. The applicable legal basis depends on the purpose of the message.

Email information is retained according to operational needs, applicable legal obligations, and the provider's configuration and contractual terms.

Postmark privacy information: Postmark Privacy Policy

Google Analytics

Google Analytics may be used to understand how visitors use the website, including pages visited, referral sources, and interactions. Depending on the configuration, Google may receive online identifiers, cookie identifiers, device and browser information, referrer information, approximate location, and usage events.

Where consent is required, non-essential analytics storage and tracking are activated only after valid consent. Visitors must be able to withdraw their consent through the available consent mechanism.

Google privacy information: Google Privacy Policy

Google reCAPTCHA

Google reCAPTCHA may be used to distinguish legitimate interactions from automated abuse, spam, and other harmful activity. Depending on the version and configuration, it may process IP addresses, browser and device information, interaction signals, cookies, and other technical data needed to assess risk.

This processing is intended to protect website forms and services. The controller assesses the applicable legal basis and any consent requirements based on the actual implementation.

Google privacy information: Google Privacy Policy

Stripe Payments

Stripe is used to process online payments and related checkout operations. When you make a purchase, Stripe may receive payment details, billing information, contact details, transaction amounts, transaction identifiers, and technical information used for fraud prevention.

This information is processed to complete transactions, prevent fraud, handle payment disputes, and meet applicable financial and legal obligations. Stripe's role and the legal basis depend on the particular processing activity.

Payment and accounting records are retained according to applicable legal obligations and the relevant provider arrangements.

Stripe privacy information: Stripe Privacy Policy

This website may use cookies, local storage, session storage, and similar technologies. These technologies may be necessary for website functionality, account authentication, security, remembering preferences, or measuring website usage.

Strictly necessary technologies may be used where permitted to provide a service explicitly requested by the visitor or to transmit communications. Non-essential analytics and tracking technologies are activated only after the consent required by applicable law has been obtained.

Where consent is the legal basis, it can be withdrawn at any time through the website's consent settings. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

The precise names, providers, purposes, and lifetimes of cookies and local storage entries depend on the technologies enabled in production. The controller maintains, or will establish, an inventory of the actual storage entries and their purposes and durations.

Other personal data, including account information, geolocation fields, emails, analytics information, and AI-generated security assessments, is retained only for as long as necessary for its specific purpose and any applicable legal obligations.

These retention periods must be reflected in the website's actual database, logging, backup, and provider settings. Where a different period is necessary for a specific case, the reason must be documented.

Some third-party providers may process personal data outside the European Economic Area (EEA). Where personal data is transferred to a country without an applicable adequacy decision, the controller must ensure that a valid transfer mechanism and any required supplementary safeguards are in place.

The countries involved, applicable transfer mechanisms, and safeguards depend on the providers and production configuration. These arrangements must be verified against the relevant contracts and provider documentation.

Subject to the conditions and exceptions under applicable law, you may have the right to:

• Request access to your personal data.
• Request correction of inaccurate or incomplete data.
• Request deletion of your personal data.
• Request restriction of processing.
• Object to processing based on legitimate interests.
• Receive certain data in a structured, commonly used, machine-readable format and request its transfer where the right to data portability applies.
• Withdraw consent where processing is based on consent.
• Request information and safeguards concerning decisions based solely on automated processing where applicable.

These rights are not absolute and may be subject to legal conditions and exceptions. For example, some information may need to be retained to comply with legal obligations or to establish, exercise, or defend legal claims.

To exercise your rights, contact: kontakt@ll-wd.com . Please describe your request clearly. Additional information may be requested where reasonably necessary to verify your identity and protect your data against unauthorised disclosure.

Requests are handled within the time limits prescribed by the GDPR. In general, a response is due within one month, subject to permitted extensions and applicable notification requirements.

If you believe your personal data has been processed in violation of applicable data protection law, you may contact the website owner to raise your concern.

You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), particularly if you reside, work, or believe the infringement occurred in Sweden.

IMY website: https://www.imy.se/