1. Who we are
This site (eywasolutions.net) is operated by Svitlana Lytvyniuk, trading as Eywa Solutions, a self-employed undertaking registered in Malta, VAT registration number 3291-8006 (Article 11 — small undertaking, exempt), with business address at Manor Heights, Triq Charles Sciberras, St. Julian's, STJ 1143, Malta.
We act as data controller for personal data collected through this website. For client engagements, the data-controller / data-processor relationship is documented separately in each engagement contract.
2. What we collect on this website
This site keeps a consent banner in front of anything beyond what's strictly necessary to run it. Nothing in the "with your permission" bullet below runs, and no cookie it would set is placed, until you actively choose to allow it — declining is exactly as easy as accepting, and you can change your mind at any time via the "Cookie preferences" link in the footer.
- Necessary — always on. The consent choice itself is remembered in a
cc_cookie, scoped to.eywasolutions.netso it also coversconcierge.andtours.without asking twice. No analytics or advertising runs from this category. - With your permission — analytics and marketing. If you accept the Analytics category, Google Analytics 4 loads and sets cookies such as
_gaand_ga_*to help us see anonymised traffic patterns. If you accept Marketing, the Meta Pixel loads and sets_fbpto help us measure ad performance and build retargeting audiences for Google and Meta ad campaigns. Both are fully off — script not loaded, cookie not set — until you say yes, and Google's Consent Mode keeps that "no" enforced even for background pings. - Three enquiry forms — the VR quote configurator on /vr (your name, email, and the configuration you built), the custom-work intake on /automation (name, email, and optionally company, budget range, timeline, and your message), and the concierge intake on /concierge (name, email, and optionally your property name and a message). All three forms embed Cloudflare Turnstile, a bot-verification widget that runs without setting cookies, to filter automated spam submissions. Submissions are stored in our systems so we can reply; the configurator also emails you the quote you asked for, followed by a short series of relevant follow-up emails — each carries a one-click unsubscribe.
- IP address, briefly — form submissions log the sending IP address to enforce a rate limit against spam and abuse. These records are kept for a maximum of 2 days, then automatically deleted; they are not used for any other purpose.
- Email — when you email us, you supply your email address and whatever content you choose to send.
- Booking a call — /book embeds Cal.com's scheduling calendar directly on this site rather than sending you to cal.com. Cal.com still processes the booking (name, email, and any notes you add) under their own privacy terms, and — only if you've accepted the Analytics/Marketing categories above — a successful booking is also recorded as a conversion in Google Analytics and the Meta Pixel.
We will update this section the first time we add any further tool that processes personal data on the marketing site.
3. Why we collect it
The only personal data we collect via this website is what you actively send us — an enquiry form, an email, or a booked discovery call. We use it to:
- Reply to your enquiry.
- Send the quote and follow-up emails an enquiry triggers (follow-ups always include a one-click unsubscribe).
- Prepare for the discovery call.
- Send a written follow-up after the call, if appropriate.
Lawful basis: Article 6(1)(b) GDPR (steps taken at the request of the data subject prior to entering into a contract) or Article 6(1)(f) GDPR (legitimate interest in responding to inbound enquiries), as applicable.
The analytics and marketing cookies described in section 2 are processed on a different basis entirely: Article 6(1)(a) GDPR (your explicit, granular consent, given or withheld per category through the cookie banner). We use them to understand which pages and services on this site are actually useful, and to measure whether Google/Meta ad spend converts into booked calls. Withdrawing consent at any time stops that processing going forward.
4. Who else processes your data
When you interact with the site or the services it links to, the following data processors may receive your data:
Each of these processors operates under its own privacy terms. We do not sell or share your data with marketing networks, ad networks, or any third party not listed here.
5. International transfers
Where a processor (e.g. Google Workspace, Airtable, Anthropic) involves transfer of personal data to a third country, we rely on the relevant adequacy decisions or standard contractual clauses published by the European Commission.
6. How long we keep it
Email correspondence and enquiry records are retained for 24 months following the last contact, for tax, accounting, and contract-history purposes. Records relating to a concluded engagement are retained for the period required by Maltese tax and accounting law. Booked call records on cal.com are subject to cal.com's retention terms. Your cookie consent choice is remembered for up to 6 months, after which the banner will ask again; Google Analytics and Meta Pixel cookies follow each provider's own default retention (typically up to 13 months for GA4, up to 90 days for the Meta Pixel's _fbp), and stop being set entirely the moment you withdraw consent.
7. Your rights
Under the GDPR, you have the right to:
- Access the personal data we hold about you.
- Correct inaccurate or incomplete data.
- Request erasure of your data ("right to be forgotten"), subject to legal retention obligations.
- Object to processing where the lawful basis is legitimate interest.
- Restrict processing while we resolve a dispute about accuracy or lawful basis.
- Receive your data in a portable, machine-readable format.
- Withdraw consent at any time where processing is based on consent.
To exercise any of these rights, email [email protected]. We respond within one calendar month, extendable by two further months for complex requests (we will tell you if that applies).
8. Supervisory authority
The supervisory authority for data protection in Malta is the Information and Data Protection Commissioner (IDPC). You have the right to lodge a complaint with the IDPC if you believe we have not handled your personal data correctly.
9. Updates
We update this policy when our data processing changes — for example, when we add a new processor. Version 1.3 · Last updated: 2026-08-22.
10. Contact
For any privacy-related question: [email protected].