Privacy Policy

This Privacy Policy explains how Bored Panda Group handles personal data in connection with this website (the “Website”) when you apply for a job and when you contact us. We keep this simple: the Website has no user accounts, no advertising and no analytics or tracking cookies. The only forms on it are for job applications and our talent pool (section 3).

1. Who we are

The data controller is UAB Bored Panda Group, a company registered in the Republic of Lithuania, company code 307694651, registered address Polocko g. 17-113, LT-01205 Vilnius, Lithuania (“we”, “us”).

Bored Panda Group is the parent company of these group companies: UAB Pandos (boredpanda.com), UAB Bored Panda Studios, UAB Spike and UAB Gildium (the “Group Companies”).

For any privacy question, email group@boredpanda.com with the subject line “My privacy”.

2. When you email us

The Website lists email addresses for general enquiries, partnerships, editorial, studio and Spike questions, and job ads name the recruiter to contact. When you write to one of them, we process your name, email address, any company or job title you share, the content of your message and any attachments.

• Purpose: to read and answer your message and to follow up on any cooperation you propose.
• Legal basis: our legitimate interest in answering enquiries and running our business (Art. 6(1)(f) GDPR). Where you contact us about a possible agreement, we process your data to take steps at your request before entering into a contract (Art. 6(1)(b) GDPR).
• Retention: as long as needed to deal with your enquiry, and no longer than 2 years after our last correspondence, unless the correspondence leads to a contract or we need it to establish, exercise or defend legal claims. In that case we keep it for the applicable limitation period.

Several of these mailboxes are handled by the Group Company your enquiry relates to. For example, editorial@ is handled by UAB Pandos, studios@ by UAB Bored Panda Studios and spike@ by UAB Spike. If your message concerns a Group Company, we may forward it to that company, and it will handle your data as a separate controller under its own privacy policy.

3. Job applications

Our open positions are listed on the Website’s jobs pages. Applications and talent pool sign-ups are kept in Teamtailor, the recruitment platform our recruiters work in (see section 6).

Applying through the Website

When you apply for a position using the form on its page, we process the information you give us: your name, email address and phone number, your LinkedIn profile link, your city and country (where the position asks for them), your CV and any other files you attach, your cover letter, and your answers to the questions asked for the position.

• Purpose: to assess your application and, if it goes further, to arrange interviews and the rest of the recruitment process.
• Legal basis: taking steps at your request before entering into an employment or service contract (Art. 6(1)(b) GDPR). If you tick the box to be kept on file for future roles, that is based on your consent (Art. 6(1)(a) GDPR).
• How it reaches us: the form sends your application to a small server function of ours, run on Google Cloud (Firebase) in the European Union (Belgium), which passes it straight on to Teamtailor. The function does not keep your application. Google keeps technical logs of these requests, such as your IP address and the time, for a limited period.
• Sharing: we may share your application with the Group Company that is hiring for the position.
• Retention: we keep your application for up to 6 months after the recruitment for the position ends. If you tick the box to be kept on file, we keep your details for up to 3 years after the recruitment ends, so we can contact you about future roles. You can withdraw that consent at any time.

Joining our talent pool

If you join our talent pool (“Let’s connect”), we process your email address and the team or role you tell us you are interested in, so we can let you know when a role that may fit you opens.

• Legal basis: your consent (Art. 6(1)(a) GDPR).
• How it reaches us: the same way as an application, through our server function on Google Cloud (Firebase) into Teamtailor, which then sends you a welcome email.
• Retention: for as long as your talent pool profile is active. If it has been inactive for 2 years, we delete it, and we let you know by email before we do. You can withdraw your consent and have it deleted sooner at any time.

Open applications by email

If you send us your CV or an open application by email, we process the information you provide, such as your name, contact details, CV, cover letter, work history, education and portfolio.

• Purpose: to assess your application for current or future roles in the Bored Panda Group.
• Legal basis: taking steps at your request before entering into an employment or service contract (Art. 6(1)(b) GDPR). Keeping your application for future roles is based on your consent (Art. 6(1)(a) GDPR).
• Sharing: we may share your application with the Group Company that is hiring for a relevant role.
• Retention: we keep your application for up to 6 months after we receive it. If you agree, we keep it for up to 3 years so we can consider you for future openings. You can withdraw your consent at any time.

Please do not send us sensitive information, such as health data or ID documents, unless we specifically ask for it.

4. Visiting the Website

The Website is hosted on Firebase Hosting, a service provided by Google LLC (USA), and on GitHub Pages, a service provided by GitHub, Inc. (USA). When you visit the Website, the hosting provider automatically processes technical data, including your IP address, browser type and the time of your request, to deliver the pages and keep the service secure. It may keep this data in server logs for a limited period. Our legal basis is our legitimate interest in operating a secure website (Art. 6(1)(f) GDPR).

Map on the Contacts page. The Contacts page shows where our offices are on a map from OpenStreetMap. To display it, your browser loads the map images directly from servers of the OpenStreetMap Foundation (United Kingdom), which receive your IP address and browser information. The OpenStreetMap Foundation processes this data under its own privacy policy. Our legal basis is our legitimate interest in showing you where to find us (Art. 6(1)(f) GDPR).

Job listings and recruiter photos. The Careers page and the jobs pages load the current list of open positions directly from Teamtailor, and a position’s page loads its recruiter’s photo from Teamtailor’s image servers. Teamtailor therefore receives your IP address and browser information when you view these pages. Our legal basis is our legitimate interest in showing you our open positions (Art. 6(1)(f) GDPR).

Your browser’s storage. The Website sets no cookies. The homepage keeps one note in your browser’s session storage, so its opening animation plays only once per visit. It contains no personal data and is deleted when you close the tab.

5. Links to social media and other websites

The Website links to our profiles and to other Group websites, including Instagram, LinkedIn, Facebook, TikTok, Pinterest, Reddit, YouTube, boredpanda.com and our jobs board. Once you follow a link, the operator of that site controls how your data is processed, under its own privacy policy. We encourage you to read those policies.

6. Who we share your data with

We do not sell your personal data. We share it only when necessary with:

• Group Companies, as described in sections 2 and 3;
• Service providers who process data on our behalf, such as our email and workspace provider (Google Workspace), our website hosts (Google Firebase and GitHub), Google Cloud (Firebase), which runs the server function that passes job applications and talent pool sign-ups to Teamtailor, and our recruitment platform (Teamtailor). They may use the data only on our instructions;
• Professional advisers, such as lawyers, auditors and accountants, where needed;
• Public authorities, courts or other parties, where the law requires it or where we need to protect our rights. This also applies to a potential buyer or investor if our business or part of it is reorganised or sold.

Transfers outside the EEA. Some of our service providers are based in the USA. Where personal data is transferred outside the European Economic Area, we rely on an adequacy decision, such as the EU–US Data Privacy Framework, or on the European Commission’s Standard Contractual Clauses.

7. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted;
• restrict the processing of your data;
• receive your data in a portable format;
• object to processing based on our legitimate interests;
• withdraw your consent at any time, without affecting processing that took place before you withdrew it.

To use any of these rights, email group@boredpanda.com with the subject line “My privacy”. We may ask you to confirm your identity. We will reply within one (1) month of receiving your request. We may extend this by up to two (2) further months where needed, taking into account how complex your request is and how many requests we have, and we will let you know if we do.

If you believe we are processing your data unlawfully, you can complain to the State Data Protection Inspectorate of Lithuania (Valstybinė duomenų apsaugos inspekcija), L. Sapiegos g. 17, LT-10312 Vilnius, vdai.lrv.lt. You can also complain to the data protection authority in the EU country where you live. We would appreciate the chance to resolve your concern first.

8. Changes to this Policy

We may update this Policy from time to time, for example if we add new features to the Website. The date at the top shows when it was last updated.