Skip to content

Privacy policy

Last updated: 31 July 2026

This policy describes how Itashu AB ("we", "us", "our") collects, uses and protects your personal data when you visit itashu.co (the "Website") or use our services.

We process personal data in accordance with the General Data Protection Regulation (GDPR) and applicable Swedish data protection law.

1. Data controller

The controller responsible for your personal data is Itashu AB, registered in Sweden. You can reach us at jaro.rais@itashu.co.

2. What data we collect

Information you provide:

  • name, email address and company name when you submit the contact form,
  • messages and project descriptions you share with us,
  • email address and the language you subscribed in, for the newsletter,
  • name, email and meeting time when you book a slot through the calendar,
  • billing and payment details when you engage our services.

Information collected automatically:

  • cookies and similar technologies (see the Cookie policy),
  • basic analytics data: pages visited, time spent, referral source,
  • device information: browser type, operating system, screen resolution,
  • IP address (anonymised where possible).

Analytics and behavioural data are collected only if you consent in the cookie banner. Without consent, measurement runs without cookies and without identifiers that could recognise you across visits.

3. How we use your data

We process your personal data for the following purposes:

  • Contact form enquiries: to reply and discuss a possible engagement (legal basis: legitimate interest).
  • Consultation booking: to confirm and prepare the meeting (legal basis: steps prior to entering a contract).
  • Service delivery: to deliver the agreed scope, manage the project and invoice (legal basis: contract performance).
  • Newsletter: to send you the content you asked for. You confirm the subscription by clicking a link in an email we send you; without that click you never reach the list (legal basis: consent, withdrawable with one click in every email).
  • Website analytics: to understand how the Website is used and improve it (legal basis: consent).
  • Communication: to keep you informed about ongoing projects (legal basis: contract performance).

4. Who we share data with

We do not sell your personal data. We share it with these processors:

  • Vercel Inc.: hosting, content delivery and page speed measurement for the Website (cookieless).
  • Google Ireland Ltd. (Google Analytics 4): traffic statistics, with consent only.
  • Hotjar Ltd.: anonymised on-page behaviour analysis, with consent only.
  • Resend Inc.: delivery of contact form emails.
  • MailerLite (UAB MailerLite): newsletter subscription management, including confirmation and unsubscribe.
  • Cal.com Inc.: consultation booking.
  • Cloudflare Inc.: checking that a form was submitted by a person and not a bot.
  • Accounting services: to the extent required by Swedish law.

All processors are bound by data processing agreements and GDPR requirements.

5. How long we keep data

We retain personal data only as long as necessary:

  • contact form data: we store the message in no system of ours, it reaches us as an email. We keep it in the inbox for 12 months after the last communication, unless an engagement begins,
  • project data: for the duration of the engagement plus 7 years (Swedish bookkeeping requirements),
  • newsletter: until you unsubscribe,
  • analytics data: 14 months. That is the longest retention Google Analytics offers on a free property.

6. Your rights

Under GDPR you have the right to:

  • Access: request a copy of your personal data.
  • Rectification: have inaccurate data corrected.
  • Erasure: request deletion ("right to be forgotten").
  • Restriction: restrict processing of your data.
  • Portability: receive your data in a structured, machine-readable format.
  • Objection: object to processing based on legitimate interest.
  • Withdraw consent: withdraw consent at any time where processing is based on it.

To exercise any of these rights, write to jaro.rais@itashu.co. We will respond within 30 days.

7. Security

We use appropriate technical and organisational measures: encrypted connections (HTTPS), secure hosting and access controls. No method of transmission over the internet is 100% secure, however.

8. International transfers

Your data may be processed by providers established outside the EU and EEA: Vercel, Google, Cloudflare, Resend and Cal.com are US companies. MailerLite is established in Lithuania and Hotjar in Malta. Transfers outside the EEA are protected by Standard Contractual Clauses or an adequacy decision, as required by GDPR.

9. Children

Our Website and services are not directed at individuals under 16. We do not knowingly collect personal data from children.

10. Changes to this policy

We may update this policy from time to time. Changes will be posted on this page with an updated date.

11. Complaints

If you believe we have not handled your data correctly, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at imy.se.

12. Contact

For privacy-related questions: jaro.rais@itashu.co

The Slovak and English versions of this document are equally valid and change together, in the same commit. For questions, write to jaro.rais@itashu.co.