Privacy Policy

Effective date: To be set on publication.
Last updated: 2026-08-09

This Privacy Policy explains how Mystwood Studios AB (“Mystwood Studios”, “we”, “us”, “our”) collects, uses, stores, and protects personal data when you visit mystwoodstudios.com or interact with the forms and services on it. We are based in the European Union and follow the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and Swedish data-protection law.

If anything in this policy is unclear, email us at info@mystwoodstudios.com.

1. Who is the controller

Mystwood Studios AB is the data controller for personal data processed via this website.

• Company: Mystwood Studios AB
• Registered office: Solna, Sweden
• Organisation number: 559526-7674 (see Imprint for full disclosure)
• Email: info@mystwoodstudios.com

We have not appointed a Data Protection Officer because our processing is limited in scope and does not meet the GDPR Article 37 thresholds. If those thresholds change, we will appoint one and update this policy.

2. What data we collect

We collect personal data only when you choose to give it to us through one of three forms on the site, plus a small amount of consent-state data needed to comply with cookie law.

2.1 Newsletter signup

When you subscribe to our newsletter, your signup is handled in two short steps:

1. A brief stop on our website. Your signup is first captured by the form system on our site as a temporary record. This record is automatically deleted within 7 days and never includes your IP address (we strip it before anything is saved).
2. Hand-off to MailerLite. Your details are then passed to MailerLite, our email-marketing provider, which holds the actual subscription list and sends you a confirmation email (double opt-in). Your subscription only becomes active after you click the confirmation link.

What the signup contains:

Field	Source	Why we need it
Email address	You provide it	To send you the confirmation message and, once confirmed, the newsletter
First name (optional)	You provide it	To address you by name in emails; you can subscribe without it
Signup context	Set by the form	Which part of the site you signed up from, so we can tailor content
Page URL and browser type	Recorded by the form system	Basic technical context of the submission (kept with the temporary record)

If the hand-off to MailerLite fails (for example, a temporary network problem), your email address and the signup time are held in a small internal buffer in our site database — capped at the most recent 500 entries, with no IP address — until we manually complete or discard the signup. This buffer exists only so a failed signup is not silently lost.

We do not require your name to subscribe. The subscription list is held by MailerLite, acting as our data processor (see Section 8).

2.2 Contact form

When you send us a message through the contact form on /contact, we collect:

• Name
• Email address
• Subject (optional)
• Message

Your message is emailed to us at info@mystwoodstudios.com and is also stored in our website’s form database so it is not lost. The stored copy never includes your IP address (we strip it), though it does record the page URL and your browser type as technical context. Contact messages are not shared with our email-marketing provider.

2.3 Careers application

When you apply for a role through /careers, we collect:

• Name
• Email address
• Role applied for (optional)
• CV / Résumé (file upload)
• Cover note (optional)

Applications are emailed to our recruiting inbox and are also stored internally in our website’s form database, including the uploaded CV file, which is kept on our server with the application. The stored copy never includes your IP address, though it does record the page URL and your browser type as technical context. Applications are strictly internal: they are never shared with our email-marketing provider or any other outside party.

2.4 Technical and consent data

The following technical data is collected automatically when you load the site:

• Cookie-consent state — stored in your browser’s localStorage and in a first-party cookie named mw_cookie_consent. We store this so we know whether to load (or not load) any optional features that need cookies. See our Cookie Policy for details.
• Server access logs — our hosting provider records your IP address, the page requested, your browser User-Agent, and the response status for each request. These logs are retained on a rolling 14-day window and are used only to operate the site and investigate abuse. These logs are separate from the forms above — form submissions themselves never store your IP (Section 2.1–2.3).

We do not currently run third-party analytics, advertising trackers, social-media pixels, A/B-testing tools, heat-maps, or session-replay tools on the site. If we add any of these in the future, we will update this policy and re-prompt for cookie consent.

3. Why we process your data and on what lawful basis

Purpose	Lawful basis (GDPR Article 6)
Send you the newsletter you signed up for	Consent — Article 6(1)(a). Confirmed via the double-opt-in email.
Reply to your contact-form message	Legitimate interests — Article 6(1)(f). Our interest in answering questions about our work, balanced against your reasonable expectation that a contact form will be answered.
Process your job application	Steps prior to entering a contract — Article 6(1)(b), and our legitimate interest in finding qualified candidates.
Maintain cookie-consent state	Compliance with a legal obligation — Article 6(1)(c), specifically the ePrivacy Directive and Sweden’s Lagen om elektronisk kommunikation.
Keep server logs	Legitimate interests — Article 6(1)(f), to keep the site available and to defend against abuse.

We do not engage in any automated decision-making or profiling that produces legal or similarly significant effects on you.

4. How long we keep your data

Data	Retention
Newsletter signup record on our site	Deleted automatically within 7 days of submission.
Newsletter subscription (at MailerLite)	For as long as you remain subscribed. When you unsubscribe, MailerLite keeps a suppression record so we do not re-add you. Signups that are never confirmed do not become active subscriptions.
Failed-signup buffer (Section 2.1)	Held until we manually complete or discard the signup; capped at the most recent 500 entries (oldest are dropped).
Contact-form messages	The email copy is kept in our inbox for up to 24 months, then archived or deleted unless the thread is still active. The database copy is kept until we delete it — at the latest when you ask us to (Section 6).
Careers applications	The email copy is kept in our recruiting inbox for up to 12 months from the close of the relevant role. The database copy (including the uploaded CV) is kept internally until we delete it — at the latest when you ask us to (Section 6).
Cookie-consent record	12 months from the last consent action (after which the banner re-prompts you).
Server access logs	Rolling 14 days.

You can ask us to delete your data sooner — see Section 6.

5. Where your data lives

The website, its database, and our email are hosted in the European Union. Our newsletter subscription list is held by MailerLite, our email-marketing provider. MailerLite may process data outside the EEA; where it does, the transfer is covered by Standard Contractual Clauses approved by the European Commission, under the data-processing agreement incorporated into its terms of use.

If we add any further service that moves personal data outside the EEA, we will:

1. Update this policy to name the recipient and the country,
2. Identify the legal transfer mechanism (Standard Contractual Clauses, adequacy decision, etc.), and
3. Re-prompt for cookie consent where the transfer is consent-based.

6. Your rights

Under GDPR you have the following rights with respect to your personal data:

• Access — ask for a copy of the data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure (“right to be forgotten”) — ask us to delete your data.
• Restriction — ask us to stop processing your data while a dispute is resolved.
• Portability — ask us to send your data to you (or to another controller) in a structured, machine-readable format.
• Objection — object to processing based on our legitimate interests.
• Withdraw consent — for processing based on consent (the newsletter), you can withdraw consent at any time. The simplest way is the unsubscribe link in any newsletter we send. Withdrawal does not affect the lawfulness of processing before the withdrawal.

To exercise any of these rights, email info@mystwoodstudios.com. We will respond within one month (extendable by two further months for complex requests, per GDPR Article 12(3)). We may ask for reasonable proof of identity before disclosing or deleting data. Where data is held by MailerLite on our behalf, we will carry your request through to them.

If you are not satisfied with our response, you have the right to lodge a complaint with the Swedish supervisory authority, Integritetsskyddsmyndigheten (IMY) — imy.se — or with the supervisory authority in your EU country of residence.

7. Cookies and similar technologies

We use a small number of cookies and similar storage on this site. The full breakdown — what each cookie does, how long it lasts, and how to disable them — is in our separate Cookie Policy.

8. Recipients of your data

We share your personal data only with:

• Our hosting provider (acting as a processor under GDPR Article 28) — they store the database and serve the website.
• MailerLite (acting as a processor under GDPR Article 28) — they hold the newsletter subscription list and send the newsletter and its confirmation emails on our behalf, under a data-processing agreement incorporated into their terms of use. Only newsletter data goes to MailerLite — never contact messages or job applications.
• Our email provider (acting as a processor) — they relay the form-submission emails to our inbox.

We do not sell, rent, or trade personal data. We do not pass data to advertisers, data brokers, or analytics resellers.

If we are ever legally required to disclose data (for example, in response to a Swedish court order), we will do so only to the extent strictly required by law.

9. International transfers

As stated in Section 5, our website and database are hosted in the European Union, and our newsletter list is held by MailerLite. MailerLite and some of its sub-processors may process data outside the EEA; where that happens, the transfer is protected by Standard Contractual Clauses approved by the European Commission, as set out in MailerLite’s data-processing agreement.

10. Security

We protect your data with appropriate technical and organisational measures, including:

• TLS encryption for all data in transit (HTTPS),
• Database access limited to authorised maintainers,
• Form-submission throttling and server-side anti-spam checks to deter bot abuse,
• Stripping IP addresses from form submissions before storage (data minimisation),
• WordPress core and theme kept on supported, patched versions,
• Backup encryption at rest.

No system is perfectly secure. If we detect a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the IMY within 72 hours per GDPR Article 33, and notify you directly per Article 34 when required.

11. Children’s data

This site is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has submitted data through one of our forms, email us and we will delete it.

12. Changes to this policy

We may update this policy when the law changes, when we add or remove a feature that affects what data we collect, or when we add a new processor. Material changes will be announced at the top of this page and (where the change affects consent) via a banner re-prompt. The “Last updated” date at the top of this page reflects the most recent revision.

13. Contact

For any privacy question, request, or complaint:

• Email: info@mystwoodstudios.com
• Post: Mystwood Studios AB, c/o Bojan Micoski, Jungfrudansen 5, 171 50 Solna, Sweden

---

This document is pending lawyer review. Until reviewed, treat as reviewed-template language (Termly / iubenda-style), not legal advice.