Privacy policy

1. Controller

• Evil Unicorn Oy, Business ID 3314508-9
• Iivisniemenkatu 2, 02260 Espoo, Finland
• Email: [email protected]

This policy explains how we process personal data on the evilunicorn.fi website in accordance with the EU General Data Protection Regulation (GDPR).

2. What data we process

We only process data that you send to us yourself:

• Found-item reports (/found): the sticker ID, your optional contact details, your message, the site language and the time of submission.
• Contact form: your name, email address, message, the site language and the time of submission.
• Technical data: your IP address is used briefly to protect the service from abuse (limiting the number of submissions). We do not store it with the form data.

The site uses no cookies, no analytics and no ad tracking.

3. Purposes and legal basis

• Found-item reports: recovering our lost property and communicating with the finder. Legal basis: our legitimate interest (GDPR Art. 6(1)(f)).
• Contact messages: replying to you and managing a possible customer relationship. Legal basis: legitimate interest or steps prior to entering into a contract (GDPR Art. 6(1)(b) and (f)).
• Security: protecting the service from spam and attacks (legitimate interest).

4. Retention

Found-item reports are deleted automatically after 12 months and contact messages after 24 months. We may delete them sooner once the matter has been resolved.

5. Recipients and processors

We never sell your data or share it for marketing. We use the following service providers:

• Hetzner Online GmbH (Germany): server and database hosting in the EU.
• Cloudflare, Inc.: content delivery and protection of the site. Data may also be processed outside the EU.
• Telegram: new reports are forwarded to our staff as Telegram messages.
• Resend, Inc. (USA): email delivery of reports as a fallback channel.

Where data is transferred outside the EU/EEA, the transfer relies on the European Commission’s standard contractual clauses or another transfer mechanism permitted by the GDPR. If necessary, we may share a found-item report with the police for the handling of lost property.

6. Your rights

You have the right to access your data, have it corrected, request its erasure or restriction of processing, and object to processing. Send your request to [email protected].

You also have the right to lodge a complaint with a supervisory authority. In Finland this is the Office of the Data Protection Ombudsman (tietosuoja.fi).

7. Security

Data is transmitted encrypted (HTTPS) and stored in a protected database that is accessible only to the people who need it for their work.

8. Changes

We may update this policy. The current version is always available on this page, with the date of the latest update shown at the top.