Privacy and cookie policy
Last updated 15 October 2026.
This privacy and cookie policy describes how personal data is processed when you visit waheedghairat.com or contact me, and how the website uses cookies and similar technologies. Processing is carried out in accordance with the EU General Data Protection Regulation (GDPR) and the Swedish Electronic Communications Act (2022:482).
1. Data controller
The data controller is Waheed Ghairat, Malmö, Sweden (“I” or “me”). Questions about the processing of your personal data can be sent to waheedghairat@gmail.com.
2. Processing, purposes and legal basis
The table shows which personal data is processed, why, on which legal basis and for how long it is kept.
| Purpose | Personal data | Legal basis | Retention |
|---|---|---|---|
| Responding to enquiries through the contact form or email, and taking steps before a possible engagement | Name, email address, message and selected topic | Legitimate interest (Art. 6(1)(f)) and steps taken at your request before entering into a contract (Art. 6(1)(b)) | Deleted no later than 12 months after the last contact |
| Visitor statistics without cookies (GoatCounter) | Page visited, referring website, browser, screen size and country. IP addresses are not stored. | Legitimate interest in understanding how the website is used (Art. 6(1)(f)) | Kept only as aggregated statistics that cannot be linked to an individual |
| Web analytics with cookies (Google Analytics 4) | Pages visited, interactions (for example a submitted form or a copied email address), approximate city-level location, device, browser and cookie ID | Consent (Art. 6(1)(a)) | 14 months |
| Limited web analytics without cookies before consent (Google Consent Mode) | Cookieless signals about page views and events, without identifiers that can recognise you between visits | Legitimate interest (Art. 6(1)(f)) | 14 months |
| Operation, delivery and security (Cloudflare) | IP address, time, requested address and technical browser information in server logs | Legitimate interest in a secure and functioning website (Art. 6(1)(f)) | A limited period in line with Cloudflare’s logging practices |
Data submitted through the contact form is not used for marketing and is never sold. No automated decision-making or profiling with legal effects takes place.
3. Recipients and data processors
I use the following providers to run the website. They process data on my behalf and according to my instructions.
- Cloudflare, Inc.: hosting, network and protection against attacks.
- Google Ireland Limited and Google LLC: web analytics (Google Analytics) and email (Gmail), where messages from the contact form are delivered.
- Web3Forms: receives the contact form and forwards it to my email.
- GoatCounter: visitor statistics without cookies.
Fonts and scripts are served from the website’s own server. No data is sent to, for example, Google Fonts or external content networks when the page loads.
4. Transfers to third countries
Google and Cloudflare may process personal data in the United States. Both companies are certified under the EU-US Data Privacy Framework, which the European Commission has found to ensure an adequate level of protection. Google signals and data sharing for Google’s own purposes are switched off in Google Analytics. If other providers process data outside the EU/EEA, this must take place with the safeguards required under Chapter V of the GDPR.
5. Cookies and similar technologies
A cookie is a small text file stored in your browser. The website uses storage that is strictly necessary for it to work, and analytics cookies that are only set if you have given your consent. Strictly necessary storage does not require consent under Chapter 9, Section 28 of the Swedish Electronic Communications Act.
| Name | Provider | Purpose | Category | Duration |
|---|---|---|---|---|
consent-analytics (local storage) | waheedghairat.com | Stores your choice in the cookie notice | Necessary | Until you clear your browser data |
_ga | Distinguishes visitors in the statistics | Analytics, requires consent | 2 years | |
_ga_DLCEWB6FH5 | Keeps a visit together in the statistics | Analytics, requires consent | 2 years | |
__cf_bm, cf_clearance | Cloudflare | Protection against automated traffic. Only set in exceptional cases, for example when bot traffic is suspected. | Necessary | Usually 30 minutes |
GoatCounter does not use cookies.
6. Changing or withdrawing your consent
You can change or withdraw your consent at any time via Cookie settings at the bottom of every page. If you withdraw your consent, analytics cookies are deleted from your browser. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn. You can also block or delete cookies in your browser settings.
7. Your rights
Under the GDPR you have the right to:
- access the personal data processed about you (Art. 15),
- have inaccurate data rectified (Art. 16),
- have your data erased (Art. 17),
- request restriction of processing (Art. 18),
- receive your data in a structured, machine-readable format (Art. 20),
- object to processing based on legitimate interest (Art. 21),
- withdraw any consent you have given at any time (Art. 7(3)).
Send your request to waheedghairat@gmail.com. I will respond without undue delay and within one month at the latest.
8. Complaints
If you believe that your personal data is processed in breach of the GDPR, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY), imy.se (opens in a new tab).
9. Changes to this policy
This policy may be updated, for example when services or legal requirements change. The current version is always available on this page, and the date of the latest change is shown at the top.