Privacy Policy

1. Who We Are

This Privacy Policy explains how Eva Hyllestad (“we”, “us” or “our”) collects, uses, stores and protects personal data when you visit our main website, evahyllestad.com, or our separate blog, echo.evahyllestad.com, contact us, subscribe to emails, request a free resource, purchase or access a digital product, or take part in a programme, membership, event, consultation, one-to-one coaching or group coaching service. The main website is a standalone, non-WordPress website. The separate Echo blog is the WordPress-based site where blog posts, blog comments and blog-specific plugins are used.

Data controller: Eva Hyllestad.
Postal address: Calle Río Sil 14, 03724 Teulada, Alicante, Spain.
Spanish NIF/NIE: Y2201618A.
Email: admin@evahyllestad.com.
Mobile: +34 623 403 324.

This Policy applies to personal data processed in connection with our website and activities, including work associated with The Soaring Alliance and the E.V.A. Method™. It should be read alongside any relevant cookie notice, sign-up form, purchase terms or platform-specific privacy notice.

2. Personal Data We May Collect

The information we collect depends on how you interact with us. It may include:

• Contact and identity details: name, email address, phone number, postal address and information you choose to provide.
• Sign-up information: details provided when subscribing to emails, requesting a free resource, joining a community or registering for an event.
• Customer and service information: order references, purchase history, bookings, attendance, preferences, customer-support messages and information needed to deliver a product or service.
• Communications and contributions: messages, questions, feedback, comments, testimonials or content you choose to send or share with us.
• Blog comments and spam prevention: this applies to the separate blog at echo.evahyllestad.com. If you comment on a blog post, the information entered in the comment form, along with technical information used to screen for spam or abuse, may be processed by WordPress and the blog’s relevant anti-spam/security tools. The main website does not operate blog comments.
• Technical and usage data: where available and permitted, IP address, browser and device information, pages visited, referral information, cookie identifiers and interactions with the website.
• Marketing preferences: your subscription status, consent choices and records of unsubscribe requests.

Please avoid sending sensitive personal information unless it is genuinely necessary for the matter you are contacting us about. We do not intentionally request special-category personal data for ordinary newsletter, digital product or coaching sign-ups.

3. How and Why We Use Personal Data

We use personal data only for specified purposes and where we have a lawful basis to do so. Depending on the circumstances, purposes may include:

• providing a free resource you request and managing your email subscription;
• processing orders and delivering digital products, memberships, bookings, coaching and other services;
• communicating about purchases, appointments, access, customer support, changes or service issues;
• sending newsletters and promotional information where permitted by law and, where required, with your consent;
• maintaining, securing and improving the website, services and user experience;
• understanding aggregate website and campaign performance, where analytics or similar tools are used lawfully;
• preventing misuse, handling disputes, enforcing agreements and protecting our rights;
• meeting tax, accounting, consumer-protection and other legal obligations.

We aim to collect only data that is adequate, relevant and necessary for these purposes. We do not sell your personal data.

4. Legal Bases for Processing

Under the GDPR and applicable Spanish data-protection law, the legal basis depends on the purpose. We may rely on:

• Contract: where processing is necessary to provide a product or service you request or to take steps before entering into a contract.
• Consent: where you have freely agreed to a specific use, such as certain marketing emails or non-essential cookies. You can withdraw consent at any time.
• Legal obligation: where we must keep records or provide information to comply with applicable law.
• Legitimate interests: where necessary for reasonable business purposes, such as securing our website, responding to enquiries, maintaining records or improving services, provided those interests do not override your rights.

Where we rely on consent, withdrawing it will not make processing carried out before withdrawal unlawful. Where information is required to fulfil a contract or legal obligation, not providing it may mean we cannot provide the relevant product or service.

5. Email Subscriptions and Free Resources

If you request a free resource, we use the details you provide to deliver it and send essential messages related to that request. We may send newsletters or promotional emails where you have given the consent required by law or another lawful basis applies. Where consent is required for marketing, it will be requested clearly and separately; requesting a free resource does not automatically mean you have agreed to unrelated marketing.

You can unsubscribe from marketing emails at any time using the unsubscribe link or by emailing admin@evahyllestad.com. We may retain limited information on a suppression list so that we can respect your choice not to receive marketing. Unsubscribing from marketing will not necessarily stop essential transactional, security or service messages.

6. Payments and Third-Party Payment Providers

We do not collect or store your full payment card details or payment account credentials. When you pay for a product or service, payment is handled by the third-party provider presented at checkout, such as Stripe or PayPal. Your payment is subject to that provider’s own terms, privacy policy and security practices.

We may receive limited transaction information from the payment provider, such as your name, email address, transaction reference, amount, currency, payment status and information needed for accounting, refunds, customer support or fraud prevention. We do not receive full card details through our ordinary payment process. Please review the relevant provider’s privacy notice before completing payment.

7. Service Providers and Other Recipients

We may share relevant personal data with trusted service providers where necessary to operate our business and deliver services. Our currently identified providers and tools include:

• Website hosting and technical providers: the main website, evahyllestad.com, is a standalone, non-WordPress website. The separate blog, echo.evahyllestad.com, runs on WordPress and uses blog-specific plugins and features. Hosting providers may process technical data such as server logs and IP addresses to deliver and secure the websites.
• AWeber: to manage email subscriptions, sign-up forms, email delivery and related subscription records.
• Microsoft Outlook: for manual email correspondence and responding to enquiries.
• Calendly: if you follow our booking link and arrange a conversation, Calendly processes the information you enter under its own terms and privacy policy. We use a link to Calendly rather than an embedded booking calendar on our sites.
• Stripe and PayPal: to process payments, as described above.
• Website, analytics and security tools: the main website is not WordPress-based and does not use WordPress plugins such as Jetpack, WP Statistics or other blog plugins. Any analytics, tracking scripts, cookies or security functions on the main website depend on the code and services actually configured on that standalone site. The separate Echo blog uses WordPress plugins, including WP Statistics and blog-related spam-prevention and security tools. The information processed depends on the features enabled and their configuration on the blog.
• External content platforms: our sites link to Spotify and may contain embedded YouTube videos on some pages or blog posts. If you open an external link or load an embedded player, the relevant platform may receive technical information such as your IP address and browser/device details, and may use cookies or similar technologies according to its own settings and policies.
• Professional advisers: such as accountants or legal advisers, where necessary.

We may also disclose information where required by law, to respond to lawful requests from public authorities, to establish or defend legal claims, or to protect the rights, safety and security of us, our users or others. We do not sell personal data. Each provider's processing is subject to applicable law and the relevant terms, privacy information and contractual arrangements.

The specific providers and tools can change over time. We recommend reviewing this Policy periodically and checking the privacy information presented by the relevant platform when you use it.

8. Social Media, Podcasts and External Platforms

We may maintain a presence or publish content on platforms such as Facebook, Instagram, LinkedIn, Pinterest, Spotify and Substack. Our websites link to Spotify and other external platforms; following a link normally takes you to the relevant platform. Some blog posts or pages may also include embedded YouTube videos. If you follow a link, load an embedded player, follow, message, comment on, listen to, subscribe through or otherwise interact with these platforms, the platform may process your personal data under its own privacy policy and terms.

Depending on the platform and your settings, information such as your public profile, comments, reactions, messages, subscription details or engagement statistics may be visible to us. Please do not share information publicly that you would prefer to keep private. We are not responsible for the independent processing practices of these platforms. Where we receive information from a platform, we use it only for appropriate communication, community management, content delivery or business purposes and in accordance with applicable law.

9. Cookies, Analytics and Similar Technologies

The main website, evahyllestad.com, is a standalone, non-WordPress website. It does not use WordPress cookie-consent or blog plugins. Whether it uses cookies or similar technologies depends on any analytics, embedded content, external scripts or other code currently active on the site. These should be checked directly on the live website before this Policy is finalised. We do not claim that a cookie banner or consent-management plugin is installed on the main website.

The separate blog at echo.evahyllestad.com runs on WordPress and uses blog-specific plugins, including WP Statistics, and blog-related spam-prevention and security tools. Those plugins and their statistics features apply to the blog, not the main website. Technical information processed by blog plugins—for example, IP addresses, browser details, request information or activity relevant to security—depends on the particular plugin and its settings.

Some pages on the main website or some blog posts may contain embedded YouTube videos. Loading an embedded player may allow YouTube or its associated providers to receive technical information and may result in cookies or similar technologies being used. External links to Calendly, Spotify, Zoom or social media services are different from embedded widgets: when you click a link, the destination platform's own privacy and cookie practices apply. We do not currently embed Calendly, Spotify or Zoom booking/media widgets on either website, based on the information available to us.

Where required by applicable law, non-essential cookies and similar technologies should not be set until the visitor has given valid consent. You can manage preferences through any cookie banner/settings tool available on the relevant site and through your browser. Blocking some cookies may affect website functionality. The exact cookies, purposes and retention periods depend on the tools and features actually enabled; we will keep the cookie notice and settings under review as the sites change.

10. International Transfers

Some service providers may process or store personal data outside the European Economic Area (EEA), including in countries that may have different data-protection laws. Where a transfer is subject to GDPR requirements, we will rely on an applicable legal transfer mechanism, such as an adequacy decision or appropriate safeguards, where required. You can contact us to request further information about relevant safeguards, subject to applicable law.

11. How Long We Keep Personal Data

We keep personal data only for as long as reasonably necessary for the purposes described in this Policy, taking into account the type of data, the nature of our relationship, the period for which a service or subscription remains active, legal requirements and the need to resolve disputes.

For example, email subscription details may be kept while you remain subscribed and for a limited period afterwards where needed to maintain suppression records or demonstrate compliance. Purchase and accounting records may need to be retained for statutory periods. Enquiry and service communications are generally retained for as long as needed to handle the matter and any related claims. Technical logs and analytics data are retained according to the relevant tool settings and operational needs.

When data is no longer needed, we will delete it or anonymise it where reasonably practicable, unless the law requires or permits further retention.

12. Data Security

We take reasonable technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration, disclosure or destruction. However, no website, email transmission or online storage system can be guaranteed to be completely secure. You should use secure devices and email accounts, keep any login credentials confidential, and contact us promptly if you believe your information or account has been compromised.

If a personal data breach occurs, we will assess and respond to it in accordance with applicable data-protection law, including making notifications to a supervisory authority and affected individuals where legally required.

13. Your Data Protection Rights

Subject to the conditions and exceptions in applicable law, you may have the right to request access to your personal data, correct inaccurate or incomplete data, request erasure, restrict processing, object to certain processing, receive data you provided in a portable format, and withdraw consent where processing is based on consent. You may also have the right not to be subject to certain decisions based solely on automated processing where the relevant legal conditions apply.

To exercise a right, email admin@evahyllestad.com and describe your request. We may need to verify your identity to protect your information. We will respond within the time limits required by law. Exercising these rights is generally free of charge, except where the law permits a reasonable fee or refusal for manifestly unfounded or excessive requests.

You also have the right to lodge a complaint with the Spanish data protection supervisory authority, the Agencia Española de Protección de Datos (AEPD), via www.aepd.es, or with another competent supervisory authority where applicable.

14. Children and Age Restrictions

Our products, services and email marketing are intended for adults. We do not knowingly seek to collect personal data from children through these services. If you believe a child has provided personal data to us, please contact us so we can assess the request and take appropriate action in accordance with applicable law.

15. Links to Other Websites

Our website or communications may contain links to websites, platforms or services operated by other organisations. Once you follow an external link, the other provider’s privacy policy and terms apply. We do not control and are not responsible for the privacy practices or content of third-party websites.

16. Automated Decisions

We do not intend to make decisions about you that produce legal effects or similarly significant effects based solely on automated processing, including profiling. If this changes, we will update this Policy and provide any information and safeguards required by law.

17. Changes to This Privacy Policy

We may update this Policy from time to time to reflect changes in our services, tools, practices or legal obligations. The current version will be published on this page with its update date. If a change is material, we will provide additional notice where required by law.

18. Contact Us

For questions about this Privacy Policy, your personal data or your data-protection rights, contact:

Eva Hyllestad
Calle Río Sil 14
03724 Teulada, Alicante
Spain
Spanish NIF/NIE: Y2201618A
Mobile: +34 623 403 324
Email: admin@evahyllestad.com