Privacy Policy
Effective 16 October 2026
1. Controller
The controller of your personal data is Valitron AB: - Org. no. 559015-4729 - Vårlöksvägen 58, 446 36 Älvängen, Sweden - Privacy contact: hello@secondactasia.com (subject line "Privacy")
We process personal data in line with the EU General Data Protection Regulation (GDPR) and Swedish data protection law.
2. What we collect, why, and on what legal basis
| Activity | Data | Purpose | Legal basis (GDPR Art. 6) | Retention |
|---|---|---|---|---|
| Newsletter subscription | E-mail address, first name (optional), sign-up date and source, consent record, answers to optional sign-up questions | Sending the newsletter and welcome sequence; segmenting content (e.g. retiree vs. remote worker) | Consent (6(1)(a)); withdraw any time via the unsubscribe link | Until you unsubscribe, then deleted or suppressed within 30 days (a minimal suppression record is kept so we don't e-mail you again) |
| E-mail engagement | Opens, clicks, device/client type (tracking pixels and link tracking provided by our newsletter platform) | Measuring which content is useful; deliverability; Ad Network reporting | Consent given at sign-up; otherwise legitimate interest (6(1)(f)) | While subscribed, max 24 months |
| Website analytics | Pages visited, referrer, approximate country, device type | Understanding site use | If cookieless analytics: legitimate interest (6(1)(f)). If analytics cookies are used: consent via cookie banner (LEK 9 kap. 28 §) | Aggregated; raw data max 24 months |
| Purchases of digital products | Name, e-mail, country, order details. Payment card data is handled by the merchant of record, not by us | Delivering the product and updates; customer support; bookkeeping | Contract (6(1)(b)); legal obligation (6(1)(c)), Swedish Bookkeeping Act | Customer records for the update period plus 12 months; accounting records 7 years (Bokföringslagen) |
| Replies and enquiries | Your e-mail, name and the content of your message | Answering you; improving content (quoted only anonymised unless you agree) | Legitimate interest (6(1)(f)) | Up to 24 months after the last contact |
| Affiliate links | We do not receive your identity from affiliate partners; partners may set their own cookies when you click | Earning commission | Partners act as independent controllers (see their policies) | — |
Please don't send us sensitive data (e.g. health details or passport numbers). If you do, we will only use it to reply to you and will then delete it.
3. Who we share data with
We use service providers (processors) under data processing agreements: - beehiiv, Inc. (newsletter and e-mail delivery; USA) - Cloudflare (website hosting, DNS, security)
Lemon Squeezy (merchant of record for product sales; USA) processes payment and tax data as an independent controller under its own privacy policy.
We may also disclose data to our accountant and auditor, to authorities where legally required, or to a buyer of the business (with notice to you). We never sell your personal data.
4. International transfers
Some providers are located in, or access data from, the USA or other countries outside the EU/EEA. Where they do, transfers rely on an adequacy decision (e.g. the EU–US Data Privacy Framework, for certified companies) or the European Commission's Standard Contractual Clauses with supplementary measures. You can ask us for a copy of the relevant safeguards.
5. Your rights
Under the GDPR you have the right to: - access your data; - have it corrected or erased; - restrict processing; - data portability; - object to processing based on legitimate interest (including any profiling for content segmentation); - withdraw consent at any time, without affecting earlier processing.
To use these rights, e-mail hello@secondactasia.com. We respond within one month.
You also have the right to complain to the Swedish Authority for Privacy Protection: Integritetsskyddsmyndigheten (IMY), Box 8114, 104 20 Stockholm, www.imy.se. You can also complain to the authority in your own EU/EEA country.
6. Cookies
We use no tracking, advertising or analytics cookies on this website. Our hosting provider may set strictly necessary technical cookies for security and to keep the site running; these do not require consent. The newsletter sign-up form is hosted by beehiiv and is covered by beehiiv's own cookie policy.
7. Security
We use reputable providers, encryption in transit, two-factor authentication, and access limited to people who need it.
8. Children
The Service is not directed at children under 16. We do not knowingly collect their data.
9. Changes
We will post updates here with a new effective date, and tell subscribers about material changes.