1. Scope and publisher status
This policy describes the supplied static website at showmeadowpckbrd.surf. Showmeadowpckbrd Interiors AB, company number DEMO-SE-2026-014, and the registered address shown in the footer are illustrative demonstration details, not verified corporate credentials. No claim is made that a legally registered controller or operational mailbox has been established. A live operator must replace these details and identify its actual hosting and email arrangements before collecting personal information.
The browser behaviour described below is implemented in this website. Statements about possible server processing explain what a deployment may involve; they do not assert that a particular hosting provider or data processing contract exists.
2. Information collected and why
The site has no accounts, purchases, newsletter subscriptions or server-connected contact form. Contact fields are validated in your browser. Preparing an email creates an email link containing the details you entered; those details are not sent to a website backend or saved in localStorage. Your email application handles the draft, and delivery occurs only if you choose to send it.
If an operational publisher receives your email, it will receive your address, message and any information you voluntarily include. Such information should be used to answer the request and maintain necessary correspondence, ordinarily on a legitimate-interest basis or to take steps you request before a contract. Avoid sending sensitive personal data, payment details or private information about other people.
3. Device storage and external services
A localStorage record remembers your cookie choices. It contains category preferences, a policy version and a timestamp, not your name or email. No analytics, advertising pixels, external fonts or embedded maps are installed. See the cookie policy for the exact storage key and deletion instructions.
Homepage photographs are delivered from images.unsplash.com. Loading a photograph connects your browser to that external service and discloses your IP address, the requested image URL and ordinary browser request information needed for delivery. The image elements use referrerpolicy="no-referrer" so the referring page URL is not sent with those requests. Photographs load independently of the optional cookie-category choices; no Unsplash JavaScript is installed. For the provider’s stated practices, read the Unsplash privacy policy.
A hosting provider may process IP addresses, request times, browser information and requested URLs to deliver files and protect its infrastructure. Your chosen email provider processes drafts and sent messages under its own terms. Actual publisher-side processors, log practices and international transfers depend on deployment and must be disclosed by the live operator. The operator must also assess the legal basis and safeguards for external image delivery. Where required, transfers outside the European Economic Area need an appropriate legal safeguard, not merely a general privacy statement.
4. Retention and security
The browser preference record has no automatic expiry and remains until you change it, clear site data or a future policy version invalidates it. Form values are not intentionally persisted by the site, although your browser or email application may retain them independently. There is no site-managed message database. External image-service log retention is controlled by the provider and has not been verified for this demonstration; browser image caching depends on response headers and browser settings.
For a live mailbox, a proportionate default would be deletion of routine enquiries within twelve months after resolution, with longer retention only where a documented legal or dispute-related need applies. This is a proposed operational schedule, not a verified mailbox practice. Hosting log retention must likewise be confirmed by the actual provider. No online transmission or storage method can be guaranteed completely secure.
5. GDPR and California rights
Where the GDPR applies, you may request access, correction, erasure, restriction and applicable data portability, or object to processing based on legitimate interests. Consent can be withdrawn without affecting earlier lawful processing. Requests normally require a response within one month, subject to lawful extensions and proportionate identity checks. You may complain to Sweden’s privacy protection authority, IMY, or another competent supervisory authority.
Where the CCPA as amended applies to a live operator, eligible California residents may have rights to know, access, correct or delete personal information, opt out of sale or sharing, limit certain sensitive-information uses and exercise rights without unlawful discrimination. This implementation does not sell or share data for cross-context behavioural advertising and does not use sensitive information for profiling. There are no automated decisions producing legal or similarly significant effects.
6. Privacy contact and changes
The designated privacy and DPO-enquiry address is [email protected]; it is illustrative and does not imply that a Data Protection Officer has been appointed. A live operator must provide a working rights-request channel. Material changes should be reflected in this policy and, where necessary, accompanied by a renewed consent request before new optional processing begins.