Privacy Policy

1. Controller

2. What this policy covers

This Privacy Policy applies to:

• the website https://mighty-way.com and all its subdomains, including our landing, funnel, booking, client portal and payment pages,
• the lead forms we run inside advertisements on Facebook and Instagram,
• and communication with us by email, telephone or video call in connection with any of the above.

Some of these pages run on third-party platforms. Where that is the case, the platform and what it processes are described in the relevant section below.

3. Purposes and legal bases

We process personal data to operate this website and ensure IT security (Art. 6(1)(f) GDPR), to respond to enquiries (Art. 6(1)(b) and (f) GDPR), to prepare and perform contracts (Art. 6(1)(b) GDPR), to comply with legal obligations such as tax and accounting rules (Art. 6(1)(c) GDPR), and — where you have given it — on the basis of your consent, for optional functions such as non-essential cookies, analytics and advertising measurement (Art. 6(1)(a) GDPR, in conjunction with Art. 5(3) of Directive 2002/58/EC, implemented in Cyprus by section 99(5) of Law 112(I)/2004), and for our contact form and our newsletter (Art. 6(1)(a) GDPR).

Consent can be withdrawn at any time with effect for the future.

4. Hosting, delivery and server logs

This website consists of static files served by Cloudflare Pages, a service of Cloudflare, Inc. There is no separate hosting provider, no content management system and no server-side application.

Delivery of the website is routed through Cloudflare, Inc. as a content delivery and security provider. Cloudflare operates edge servers worldwide, so requests may be processed outside the EU; the transfer is covered by the provider's standard contractual clauses. Cloudflare's bot-protection cookie is not active on this website.

When you visit the site, server log files are created containing your IP address, the time of the request, the browser and operating system used, the referring page and the URL requested. We process these to operate the site and to defend against attacks (Art. 6(1)(f) GDPR). They are retained for a maximum of 30 days and are not merged with other data.

All transfers between your browser and our website are TLS-encrypted.

5. Cookies and similar technologies

Before you decide, we store nothing on your device and load no marketing script. Once you have decided, we keep your choice in a strictly necessary cookie, which is what allows us to honour it. Marketing cookies are used only with your consent (Art. 6(1)(a) GDPR in conjunction with Art. 5(3) of Directive 2002/58/EC and section 99(5) of Cyprus Law 112(I)/2004).

A full list of every cookie we set, its provider, storage period and purpose is in our Cookie Policy.

How consent works here. When you first visit, a banner asks you to accept or decline marketing cookies. Your choice, the time you made it and the policy version are stored in a strictly necessary cookie named c2_analytics_consent. It applies to mighty-way.com and all subdomains, including our landing, funnel, booking, client portal and payment pages, so that you are asked only once and a withdrawal takes effect everywhere. No marketing script loads before you consent. Our analytics is cookieless and stores nothing on your device, so it is not covered by this choice. You can change or withdraw your choice at any time using the "Change your choice" button on our Cookie Policy page. Withdrawal does not affect processing carried out beforehand, and when you withdraw we delete the cookie and storage entries your consent created. The cookie expires after twelve months, after which we ask again.

You can also configure your browser to refuse cookies or to notify you before one is set. Some functions of this website may then be limited.

6. Website analytics

We use Cloudflare Web Analytics to measure site traffic. The provider is Cloudflare, Inc. The tool operates entirely without cookies and without local storage. It does not build a profile of you and does not recognise you across visits; it records aggregate page views and performance measurements only. Because no information is stored on or read from your device, this does not require your consent. Legal basis: our legitimate interest in understanding which content works (Art. 6(1)(f) GDPR).

7. Advertising and the Meta pixel

With your consent, this website uses the visitor action pixel of Meta. The provider is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

The pixel lets us see whether a visit followed one of our advertisements on Facebook or Instagram, measure how effective those advertisements are, and show advertisements to people who have already visited this website. Meta stores and processes the information in a way that can be linked to a Facebook or Instagram profile and may use it for its own advertising purposes in accordance with Meta's Data Policy: https://www.facebook.com/about/privacy/

Which events we send. On mighty-way.com the pixel reports two things: that a page was viewed, and that you clicked one of our call-to-action buttons — recorded as "CTAClick" together with the button's label. We report no other interaction, and we do not report clicks as leads or purchases. Meta's automatic event detection is switched off, so nothing is collected beyond these two events.

Joint controllership. To the extent that personal data is collected on our website by the pixel and transmitted to Meta, we and Meta Platforms Ireland Limited are joint controllers under Art. 26 GDPR. The joint responsibility is limited to the collection of the data and its transmission to Meta. The wording of the arrangement is available at: https://www.facebook.com/legal/controller_addendum

International transfer. Data is transferred to the United States. Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework (adequacy decision of 10 July 2023): https://www.dataprivacyframework.gov/participant/4452 — Where the Framework does not apply, transfers are based on the European Commission's Standard Contractual Clauses: https://www.facebook.com/legal/EU_data_transfer_addendum

Legal basis: your consent (Art. 6(1)(a) GDPR; Art. 5(3) Directive 2002/58/EC as implemented in Cyprus). You may withdraw it at any time via "Change your choice" on our Cookie Policy page. You can also switch off the "Custom Audiences" remarketing function in your Meta ad settings: https://www.facebook.com/ads/preferences/

Automatic Advanced Matching. On mighty-way.com this function is switched off, so the contact form on our Site Notice page is not read by the pixel. On our funnel and landing pages, where our other forms are, the function may be active. Where it is, entries such as your name, email address or telephone number are converted into an irreversible hash value in your browser and transmitted to Meta, which uses it to determine whether the hash matches an existing Facebook or Instagram account in order to attribute the event to that account. We do not receive the underlying data back from Meta through this function, and the pixel transmits no contact details in plain text. This processing takes place only if you have consented (Art. 6(1)(a) GDPR), and you can stop it at any time by withdrawing your consent via "Change your choice".

8. Meta lead forms (Instant Forms)

We run advertisements on Facebook and Instagram that include a Meta lead form. If you complete such a form, you enter your details — typically name, email address and phone number, together with your answers to our questions — inside the Facebook or Instagram app. Meta then transfers those details to our CRM system (see section 10).

For the collection of the data within the Meta platform we and Meta Platforms Ireland Limited are joint controllers under Art. 26 GDPR, on the basis of Meta's Lead Ads Terms. Once the data reaches our CRM, we are the sole controller.

Legal basis: your consent, given when you submit the form (Art. 6(1)(a) GDPR), and, where the form concerns a specific enquiry or offer, the preparation of a contract (Art. 6(1)(b) GDPR).

9. Contact form on this website

Our Site Notice page carries a contact form. The fields are name, email address, telephone number (optional) and your message. We use what you send only to answer your enquiry.

Legal basis. Your consent, given by ticking the box before you send (Art. 6(1)(a) GDPR) and, where your enquiry concerns a possible contract, steps taken at your request before entering into one (Art. 6(1)(b) GDPR). You may withdraw consent at any time with effect for the future by emailing info@mighty-way.com; withdrawal does not affect what was processed beforehand.

Processor. The form is operated by Web3Forms, a service of Web3Creative, which receives your submission, stores it and forwards it to us by email. Alongside the fields you complete, the service records technical metadata such as your IP address, the time of submission and the referring page, and passes your IP address and email address to its spam-filtering providers, CleanTalk Inc. and Automattic Inc. (Akismet). We have concluded a data processing agreement with Web3Creative under Art. 28 GDPR.

Transfer outside the EU. Web3Creative operates from India and uses infrastructure providers including Amazon Web Services, Cloudflare and Hetzner; the spam-filtering providers named above are in the United States. These transfers are based on the European Commission's Standard Contractual Clauses.

Retention. Submissions are held by the service for up to three years and then deleted automatically. In our own mailbox, enquiries that do not lead to a contract are deleted as set out in section 15.

The form sets no cookie, and nothing is stored on your device when you use it.

10. CRM, funnels and email marketing

Our landing pages, appointment booking, customer relationship management and email marketing run on the platform funnelspot.io, which is built on the LeadConnector / HighLevel platform operated by HighLevel Inc., United States. These pages are served from subdomains of mighty-way.com. The cookie choice you make on mighty-way.com applies on those subdomains as well: the same decision takes effect there, you are not asked again, and withdrawing it here withdraws it there.

When you complete a form, book an appointment or subscribe to our emails, the data you provide — name, email address, telephone number, your answers to our questions, and technical data such as IP address and time of submission — is stored in this system, together with a record of the emails we send you and whether you opened them.

Where a form is part of a test or questionnaire, your answers are evaluated automatically to generate a personalised result, which is shown to you and stored with your record.

Legal basis: performance or preparation of a contract (Art. 6(1)(b) GDPR) for enquiries and bookings, and your consent (Art. 6(1)(a) GDPR) for marketing emails, given by double opt-in. Every marketing email contains an unsubscribe link; unsubscribing takes effect immediately and costs nothing beyond your normal connection charges.

International transfer: this involves a transfer to the United States, based on the European Commission's Standard Contractual Clauses.

11. Payments

Payments are processed by Stripe. The provider for customers in the European Economic Area is Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. Payment pages are served from a subdomain of mighty-way.com.

When you pay, the data required for the transaction — name, email address, billing address, payment amount and payment method details — is transmitted to and processed by Stripe. We never see or store your full card details. Stripe acts as an independent controller for its own fraud prevention and regulatory obligations; Stripe's privacy policy is at https://stripe.com/privacy

Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and compliance with legal obligations (Art. 6(1)(c) GDPR).

12. Email communication

Our business email runs on Microsoft 365 (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland). Emails you send us, and our replies, are stored there.

Legal basis: responding to your enquiry and performing the contract (Art. 6(1)(b) and (f) GDPR). Please note that unencrypted email is not a secure channel; if you wish to send us sensitive information, ask us for an alternative route.

13. Online meetings

We hold advisory sessions via Zoom (Zoom Communications, Inc.) and Microsoft Teams (Microsoft Ireland Operations Limited). Depending on the session, this involves your name, email address, audio and video. Legal basis: performance of the contract and communication (Art. 6(1)(b) and (f) GDPR). We do not record sessions unless we tell you beforehand and you agree.

14. Social media

We maintain profiles on LinkedIn, Instagram and Facebook and link to them from this website. Following such a link takes you to the relevant platform, where that platform's own privacy policy applies and where your visit may be recorded. We do not embed any social media plugins or widgets on this website, so no data is transmitted to those platforms before you actively click.

For statistics about our Facebook and Instagram pages ("Page Insights"), we and Meta Platforms Ireland Limited are joint controllers under Art. 26 GDPR.

15. Retention

16. Automated decision-making

We do not use automated decision-making producing legal effects concerning you, within the meaning of Art. 22 GDPR. We do use the Meta pixel to build advertising audiences, which is a form of profiling for marketing purposes; it takes place only with your consent, has no legal or similarly significant effect on you, and you can object to it at any time by withdrawing consent.

17. Your rights

You have the right to obtain access to your personal data (Art. 15 GDPR), to have inaccurate data corrected (Art. 16), to have data erased (Art. 17), to have processing restricted (Art. 18), to receive your data in a structured, machine-readable format and have it transmitted to another controller (Art. 20), to object to processing based on our legitimate interests, including direct marketing (Art. 21), and to withdraw any consent at any time with effect for the future (Art. 7(3)).

To exercise any of these rights, write to info@mighty-way.com.

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR):

You may also complain to the supervisory authority in the country where you live or work, or where the alleged infringement took place.

18. Obligation to provide data

There is no statutory or contractual obligation to provide us with personal data. However, without certain information we cannot answer your enquiry, conclude a contract with you or deliver our services.

19. Changes to this policy

We update this Privacy Policy when our services, the technology we use or the legal position changes. The version in force is the one published here, with the effective date shown at the top.