Privacy Policy

1. Controller

2. What this policy covers

This Privacy Policy applies to:

• our websites https://mighty-way.com and https://mighty-way.com/de,
• our landing, funnel and booking pages on the subdomains go.mighty-way.com and align.mighty-way.com,
• our payment pages on pay.mighty-way.com,
• the lead forms we run inside advertisements on Facebook and Instagram,
• and communication with us by email, telephone or video call in connection with any of the above.

Some of these pages run on third-party platforms. Where that is the case, the platform and what it processes are described in the relevant section below.

3. Purposes and legal bases

We process personal data to operate this website and ensure IT security (Art. 6(1)(f) GDPR), to respond to enquiries (Art. 6(1)(b) and (f) GDPR), to prepare and perform contracts (Art. 6(1)(b) GDPR), to comply with legal obligations such as tax and accounting rules (Art. 6(1)(c) GDPR), and — where you have given it — on the basis of your consent for optional functions such as non-essential cookies, analytics, advertising measurement and our newsletter (Art. 6(1)(a) GDPR, in conjunction with Art. 5(3) of Directive 2002/58/EC, implemented in Cyprus by section 99(5) of Law 112(I)/2004 and, for users in Germany, § 25(1) TDDDG).

Consent can be withdrawn at any time with effect for the future.

4. Hosting, delivery and server logs

This website is built with the GoDaddy Airo website builder and hosted by GoDaddy (GoDaddy.com, LLC and its European affiliates) in Europe.

Delivery of the website is routed through Cloudflare, Inc. as a content delivery and security provider. Cloudflare operates edge servers worldwide and sets the strictly necessary cookie __cf_bm to filter automated traffic. This means requests may be processed outside the EU; the transfer is covered by the provider's standard contractual clauses.

When you visit the site, server log files are created containing your IP address, the time of the request, the browser and operating system used, the referring page and the URL requested. We process these to operate the site and to defend against attacks (Art. 6(1)(f) GDPR). They are retained for a maximum of 30 days and are not merged with other data.

All transfers between your browser and our website are TLS-encrypted.

5. Cookies and similar technologies

We use cookies and comparable technologies such as browser local storage. Strictly necessary cookies are used on the basis of our legitimate interest in a secure, functioning website (Art. 6(1)(f) GDPR). All other cookies — analytics and marketing — are used only with your consent (Art. 6(1)(a) GDPR in conjunction with Art. 5(3) of Directive 2002/58/EC, section 99(5) of Cyprus Law 112(I)/2004 and, for users in Germany, § 25(1) TDDDG).

A full list of every cookie we set, its provider, storage period and purpose is in our Cookie Policy.

How consent works here. When you first visit, a banner asks you to accept or decline analytics and marketing cookies. Your choice, the time you made it and the policy version are stored in your browser's local storage under the key c2_analytics_consent. No analytics or marketing script loads before you consent. You can change or withdraw your choice at any time using the "Manage cookie settings" button on our Cookie Policy page. Withdrawal does not affect processing carried out beforehand.

You can also configure your browser to refuse cookies or to notify you before one is set. Some functions of this website may then be limited.

6. Website analytics

With your consent we use the analytics function of our website platform provider, GoDaddy, which sets the cookies _scc_session, _tccl_visit and _tccl_visitor and loads a script from img1.wsimg.com. It records how many people visit the site, which pages they read and where they arrived from. We use this only in aggregate to understand which content works. Legal basis: your consent (Art. 6(1)(a) GDPR; Art. 5(3) Directive 2002/58/EC as implemented in Cyprus). You can withdraw it at any time via "Manage cookie settings".

7. Advertising and the Meta pixel

With your consent, this website uses the visitor action pixel of Meta. The provider is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

The pixel lets us see whether a visit followed one of our advertisements on Facebook or Instagram, measure how effective those advertisements are, and show advertisements to people who have already visited this website. Meta stores and processes the information in a way that can be linked to a Facebook or Instagram profile and may use it for its own advertising purposes in accordance with Meta's Data Policy: https://www.facebook.com/about/privacy/

Joint controllership. To the extent that personal data is collected on our website by the pixel and transmitted to Meta, we and Meta Platforms Ireland Limited are joint controllers under Art. 26 GDPR. The joint responsibility is limited to the collection of the data and its transmission to Meta. The wording of the arrangement is available at: https://www.facebook.com/legal/controller_addendum

International transfer. Data is transferred to the United States. Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework (adequacy decision of 10 July 2023): https://www.dataprivacyframework.gov/participant/4452 — Where the Framework does not apply, transfers are based on the European Commission's Standard Contractual Clauses: https://www.facebook.com/legal/EU_data_transfer_addendum

Legal basis: your consent (Art. 6(1)(a) GDPR; Art. 5(3) Directive 2002/58/EC as implemented in Cyprus). You may withdraw it at any time via "Manage cookie settings" on our Cookie Policy page. You can also switch off the "Custom Audiences" remarketing function in your Meta ad settings: https://www.facebook.com/ads/preferences/

Automatic Advanced Matching. We have enabled Meta's automatic advanced matching function. Where you enter information into a form on a page carrying the pixel — for example your name, email address or telephone number — the pixel reads those entries, converts them into an irreversible hash value in your browser, and transmits the hash to Meta. Meta uses it to determine whether the hashed value matches an existing Facebook or Instagram account, in order to attribute the event to that account. We do not receive the underlying data from Meta through this function, and no plain-text contact details are transmitted by the pixel. This processing takes place only if you have consented to marketing cookies (Art. 6(1)(a) GDPR), and you can stop it at any time by withdrawing your consent via "Manage cookie settings".

8. Meta lead forms (Instant Forms)

We run advertisements on Facebook and Instagram that include a Meta lead form. If you complete such a form, you enter your details — typically name, email address and phone number, together with your answers to our questions — inside the Facebook or Instagram app. Meta then transfers those details to our CRM system (see section 9).

For the collection of the data within the Meta platform we and Meta Platforms Ireland Limited are joint controllers under Art. 26 GDPR, on the basis of Meta's Lead Ads Terms. Once the data reaches our CRM, we are the sole controller.

Legal basis: your consent, given when you submit the form (Art. 6(1)(a) GDPR), and, where the form concerns a specific enquiry or offer, the preparation of a contract (Art. 6(1)(b) GDPR).

9. CRM, funnels and email marketing

Our landing pages, appointment booking, customer relationship management and email marketing run on the platform funnelspot.io, which is built on the LeadConnector / HighLevel platform operated by HighLevel Inc., United States. Our funnel pages are served from the subdomains go.mighty-way.com and align.mighty-way.com.

When you complete a form, book an appointment or subscribe to our emails, the data you provide — name, email address, telephone number, your answers to our questions, and technical data such as IP address and time of submission — is stored in this system, together with a record of the emails we send you and whether you opened them.

Legal basis: performance or preparation of a contract (Art. 6(1)(b) GDPR) for enquiries and bookings, and your consent (Art. 6(1)(a) GDPR) for marketing emails, given by double opt-in. Every marketing email contains an unsubscribe link; unsubscribing takes effect immediately and costs nothing beyond your normal connection charges.

International transfer: this involves a transfer to the United States, based on the European Commission's Standard Contractual Clauses.

10. Payments

Payments are processed by Stripe. The provider for customers in the European Economic Area is Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. Payment pages are served from pay.mighty-way.com.

When you pay, the data required for the transaction — name, email address, billing address, payment amount and payment method details — is transmitted to and processed by Stripe. We never see or store your full card details. Stripe acts as an independent controller for its own fraud prevention and regulatory obligations; Stripe's privacy policy is at https://stripe.com/privacy

Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and compliance with legal obligations (Art. 6(1)(c) GDPR).

11. Email communication

Our business email runs on Microsoft 365 (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland). Emails you send us, and our replies, are stored there.

Legal basis: responding to your enquiry and performing the contract (Art. 6(1)(b) and (f) GDPR). Please note that unencrypted email is not a secure channel; if you wish to send us sensitive information, ask us for an alternative route.

12. Online meetings

We hold advisory sessions via Zoom (Zoom Communications, Inc.) and Microsoft Teams (Microsoft Ireland Operations Limited). Depending on the session, this involves your name, email address, audio and video. Legal basis: performance of the contract and communication (Art. 6(1)(b) and (f) GDPR). We do not record sessions unless we tell you beforehand and you agree.

13. Social media

We maintain profiles on LinkedIn, Instagram and Facebook and link to them from this website. Following such a link takes you to the relevant platform, where that platform's own privacy policy applies and where your visit may be recorded. We do not embed any social media plugins or widgets on this website, so no data is transmitted to those platforms before you actively click.

For statistics about our Facebook and Instagram pages ("Page Insights"), we and Meta Platforms Ireland Limited are joint controllers under Art. 26 GDPR.

14. Retention

15. Automated decision-making

We do not use automated decision-making producing legal effects concerning you, within the meaning of Art. 22 GDPR. We do use the Meta pixel to build advertising audiences, which is a form of profiling for marketing purposes; it takes place only with your consent, has no legal or similarly significant effect on you, and you can object to it at any time by withdrawing consent.

16. Your rights

You have the right to obtain access to your personal data (Art. 15 GDPR), to have inaccurate data corrected (Art. 16), to have data erased (Art. 17), to have processing restricted (Art. 18), to receive your data in a structured, machine-readable format and have it transmitted to another controller (Art. 20), to object to processing based on our legitimate interests, including direct marketing (Art. 21), and to withdraw any consent at any time with effect for the future (Art. 7(3)).

To exercise any of these rights, write to [email protected].

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR):

You may also complain to the supervisory authority in the country where you live or work, or where the alleged infringement took place.

17. Obligation to provide data

There is no statutory or contractual obligation to provide us with personal data. However, without certain information we cannot answer your enquiry, conclude a contract with you or deliver our services.

18. Changes to this policy

We update this Privacy Policy when our services, the technology we use or the legal position changes. The version in force is the one published here, with the effective date shown at the top.