Last updated: September 24, 2026
This Privacy Policy explains how Nordic Forest Echoes processes personal data when you visit the website, contact us, manage privacy choices, or subscribe to the newsletter.
Nordic Forest Echoes is operated by P-A Jonasson in Sweden. P-A Jonasson is the data controller for the processing described in this policy.
Contact: [email protected]
Depending on how you use the website, the following information may be processed:
The website uses strictly necessary technologies for security, requested functions and remembering your privacy choice. Optional analytics is disabled until you actively allow it. There are no advertising or behavioural-profiling cookies. Cloudflare Turnstile protects the newsletter signup form against automated abuse; it is a security function, not optional analytics. See Cloudflare’s Turnstile Privacy Addendum for details about its signals and related privacy practices.
cc_cookie: a first-party, strictly necessary cookie that stores the categories you accepted or rejected, a consent identifier and timestamps. It normally expires after 182 days.CONCRETE: a strictly necessary session cookie that may be set when a Concrete CMS session is required, for example during protected form or account interactions. It normally expires when the browser session ends.You can review or change your choice at any time. Withdrawing analytics consent stops future analytics processing but does not affect processing that took place before withdrawal.
Nordic Forest Echoes uses Ahrefs Web Analytics on the public production website to understand aggregated website use. The analytics script is loaded only if you allow optional analytics. Ahrefs states that its default Web Analytics service is cookie-free, does not use persistent identifiers, and does not recognise visitors across different websites, devices or days.
The service processes page and referrer URLs, browser and device information, language, approximate country or city, page views, outbound-link clicks and form-submission events. Ahrefs receives the IP address as part of the request and uses it with user-agent information to calculate a daily salted identifier. Ahrefs states that the raw IP address and previous daily salts are not stored.
Nordic Forest Echoes does not use Ahrefs for advertising profiles and does not send custom analytics properties containing names, e-mail addresses or form contents.
When you subscribe to the newsletter, your e-mail address and optional name are sent server-side to a self-hosted Listmonk installation. Nordic Forest Echoes does not keep a separate subscriber copy in Concrete CMS, and Listmonk administration and API credentials are not exposed to the public browser.
The newsletter uses double opt-in. Your subscription becomes active only after you confirm your e-mail address using the link in the confirmation message. After confirmation, Nordic Forest Echoes may send an automatic welcome message. A limited pseudonymous record of whether the welcome message has been sent is maintained to prevent duplicate welcome messages; this record does not contain your name or e-mail address.
You can unsubscribe using the link included in every newsletter or by contacting [email protected]. Unsubscribing stops future newsletters but does not affect other use of the website. Limited suppression information may be retained where necessary to ensure that further newsletters are not sent.
Nordic Forest Echoes does not use newsletter open tracking, tracking pixels or tracked links, and does not measure newsletter opens or link clicks.
The signup form is protected by a honeypot, CSRF checks, rate limiting and Cloudflare Turnstile, with the Turnstile token validated server-side. When the widget runs, Cloudflare says it processes security signals including the client IP address, TLS fingerprint, browser User-Agent, sitekey and associated origin to detect automated abuse. Cloudflare processes these signals on behalf of the website operator to protect the site, and states that it also uses them as a controller to improve Turnstile’s bot-detection capabilities. Cloudflare says Turnstile does not access, store or transmit form entries or other page inputs. The signup details themselves are submitted server-side to the self-hosted newsletter service described above. For more information, see Cloudflare’s Turnstile Privacy Addendum and Privacy Policy.
SMTP2GO (Sand Dune Mail Ltd) processes recipient details, message content and operational delivery events to send confirmation messages, welcome messages, newsletters and other subscription-related messages. Operational delivery events may include whether a message was accepted, delivered, delayed, rejected or bounced, and whether it was reported as spam.
Bounce and spam-complaint events are returned to the self-hosted newsletter system. This information is used to suppress invalid addresses, block recipients who report messages as spam, protect sender reputation and avoid sending unwanted or repeatedly undeliverable messages.
Nordic Forest Echoes does not enable SMTP2GO open or click tracking for newsletter messages. SMTP2GO states that e-mail headers are kept for 35 days and that limited message sampling may be retained for 35 days for anti-spam compliance, unless different account features, legal requirements or service settings apply.
Web servers, Cloudflare and related security systems may process limited technical data to deliver content, detect abuse, enforce rate limits and investigate faults. Signup rate limiting stores a one-way representation associated with the visitor's IP address for up to one hour. It is used only to limit repeated signup attempts.
Personal data is not sold. It may be processed by service providers only where needed to operate the website and requested services:
Information may also be disclosed where required by law or necessary to protect legal rights.
Some providers or their subprocessors may process data outside the EU/EEA. Ahrefs Pte Ltd is established in Singapore. Cloudflare is a US-based global provider; it states that it primarily stores information in the United States and the EEA and may transfer or access information from other countries for its global operations. SMTP2GO assigns processing and storage regions according to account configuration and states that personal data for users located in the EEA is stored within the EEA. See Cloudflare’s Privacy Policy and Turnstile Privacy Addendum for its transfer information and safeguards.
Where personal data is transferred outside the EU/EEA, Nordic Forest Echoes relies on an applicable transfer mechanism and safeguards, such as an adequacy decision or the European Commission's Standard Contractual Clauses, where required. Further information about applicable safeguards may be requested using the contact details below.
Depending on the circumstances, you may have the right to request access, correction, deletion or restriction of personal data, to object to processing, and to receive data you provided in a portable format. Where processing is based on consent, you may withdraw that consent at any time.
To exercise your rights, contact [email protected]. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) or the competent supervisory authority where you live.
The website and newsletter are not directed specifically at children, and Nordic Forest Echoes does not knowingly collect personal data from children through these services.
This policy may be updated when the website, newsletter services or legal requirements change. The current version and update date are published on this page.
Nordic Forest Echoes / P-A Jonasson
[email protected]