Privacy Policy · Leverage Earn

1. Who we are (Data Controller)

The data controller responsible for your personal data is:

NXXA Partners AB
Organisationsnummer / Org. nr.: 559406-7240
Registered office: Repslagaregatan 19, 602 25 Norrköping, Sweden
Website: leverageearn.com
Email: contact@leverageearn.com

Because we are established within the EU, no Article 27 GDPR representative is required.

2. What personal data we collect

We aim to collect the minimum personal data needed to operate the Site. Specifically:

Contact form / email enquiries: your name, email address, and the content of the message you send us. Collected only if you choose to write to us.
Server logs: our hosting provider (Cloudflare) automatically logs request metadata such as your IP address, user agent, the URL requested, response status, referrer, and timestamp. These logs are retained for the short period required for security and abuse prevention.
Strictly-necessary local storage: a single first-party flag (leverageearn_cookie_consent_v1) recording that you dismissed the cookie notice. See our Cookie Policy for the full table.

We do not currently run analytics, advertising trackers, pixels, social-media plugins, or third-party fingerprinting on the Site. We do not collect special categories of personal data (e.g. health, biometric, political opinions). The Site is not directed at children under 13, and we do not knowingly collect data from anyone under that age (or under 13 with parental consent, per Section 22 of the Swedish Data Protection Act).

3. Why we use your data and our lawful basis

Purpose	Lawful basis (Article 6 GDPR)
Responding to an enquiry you sent us	Pre-contractual steps at your request (Art. 6(1)(b)) and/or our legitimate interest in operating the Site (Art. 6(1)(f))
Investigating abuse, fraud or security incidents	Legitimate interests in protecting the Site and our users (Art. 6(1)(f))
Complying with a legal obligation we are subject to	Legal obligation (Art. 6(1)(c))
Setting non-essential cookies (none at present)	Your consent (Art. 6(1)(a)) — would be requested via a banner before any such cookie is set

4. How long we keep your data

Email enquiries: up to 24 months after our last exchange, after which they are deleted or anonymised.
Server logs: up to 30 days, except where required for an ongoing investigation.
Cookie consent flags: until you clear your browser storage, or for up to 12 months.
Where Swedish bookkeeping law (Bokföringslagen) requires retention of accounting records, we retain those records for seven (7) years from the end of the relevant financial year.

5. Who we share your data with

We do not sell your personal data. We share it only with the following categories of recipients, and only where necessary:

Hosting and infrastructure: Cloudflare, Inc. (CDN, edge hosting, DDoS protection). Cloudflare may process traffic metadata at edge locations worldwide.
Email provider: the email service we use to receive and send messages.
Authorities: where we are legally compelled to disclose, for example in response to a court order, a request from a Swedish supervisory authority, or applicable EU/Swedish law.

6. International transfers

Some service providers above are based outside the EU/EEA, including the United States. Where personal data is transferred outside the EU/EEA, we rely on appropriate safeguards under Chapter V GDPR — typically the European Commission's Standard Contractual Clauses, additional supplementary measures, or an adequacy decision (such as the EU-US Data Privacy Framework where the recipient is certified). You can request a copy of the safeguards in place by contacting us.

7. Your rights under the GDPR

Subject to the conditions in the GDPR, you have the right to:

Access your personal data (Art. 15).
Have inaccurate data rectified (Art. 16).
Have your data erased — the "right to be forgotten" (Art. 17).
Restrict processing (Art. 18).
Receive your data in a portable format (Art. 20).
Object to processing based on our legitimate interests (Art. 21).
Withdraw any consent you have given, at any time, without affecting prior lawful processing.
Lodge a complaint with a supervisory authority. The Swedish supervisory authority is Integritetsskyddsmyndigheten (IMY) — https://www.imy.se/. You may also lodge a complaint with the data protection authority in any other EU/EEA Member State where you reside or where the alleged infringement occurred.

To exercise any of these rights, email contact@leverageearn.com. We will respond within one month, as required by Article 12 GDPR (extendable by a further two months for complex requests, with notice to you).

8. Security

We use TLS encryption for all traffic to and from the Site, restrict administrative access, and rely on our hosting provider's edge security controls. No internet transmission is ever fully secure; we cannot guarantee absolute security, but we apply reasonable, industry-standard technical and organisational measures appropriate to the nature of the data we hold, per Article 32 GDPR.

9. Children

The Site is not directed at children. Under the Swedish Data Protection Act and Article 8 GDPR, children under 13 cannot consent to processing of their personal data without parental authority. If you believe a child has provided us with personal data, please contact us and we will delete it.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will change the "Effective date" at the top of the page when we do. Material changes will be highlighted on the Site for a reasonable period.

11. Contact

Privacy questions or rights requests: contact@leverageearn.com. Postal address: Repslagaregatan 19, 602 25 Norrköping, Sweden. This Policy is governed by the laws of Sweden without prejudice to your mandatory rights under EU law.