Privacy Policy

This Privacy Policy explains how Bored Panda Group handles personal data in connection with this website (the “Website”) and when you contact us. We keep this simple: the Website has no user accounts, no forms, no advertising and no analytics or tracking cookies.

1. Who we are

The data controller is UAB Bored Panda Group, a company registered in the Republic of Lithuania, company code 307694651, registered address Polocko g. 17-113, LT-01205 Vilnius, Lithuania (“we”, “us”).

Bored Panda Group is the parent company of these group companies: UAB Pandos (boredpanda.com), UAB Bored Panda Studios, UAB Spike and UAB Gildium (the “Group Companies”).

For any privacy question, email group@boredpanda.com with the subject line “My privacy”.

2. When you email us

The Website lists email addresses for general enquiries, press, partnerships, editorial, studio and distribution questions. When you write to one of them, we process your name, email address, any company or job title you share, the content of your message and any attachments.

• Purpose: to read and answer your message and to follow up on any cooperation you propose.
• Legal basis: our legitimate interest in answering enquiries and running our business (Art. 6(1)(f) GDPR). Where you contact us about a possible agreement, we process your data to take steps at your request before entering into a contract (Art. 6(1)(b) GDPR).
• Retention: as long as needed to deal with your enquiry, and no longer than 2 years after our last correspondence, unless the correspondence leads to a contract or we need it to establish, exercise or defend legal claims. In that case we keep it for the applicable limitation period.

Several of these mailboxes are handled by the Group Company your enquiry relates to. For example, editorial@ is handled by UAB Pandos, studios@ by UAB Bored Panda Studios and spike@ by UAB Spike. If your message concerns a Group Company, we may forward it to that company, and it will handle your data as a separate controller under its own privacy policy.

3. Job applications

Applications through our jobs board

Open positions are published at jobs.boredpanda.com, which runs on the Teamtailor recruitment platform. Applications submitted there are covered by the candidate privacy notice shown on the jobs board. That notice names the company that processes your application.

Open applications by email

If you send us your CV or an open application by email, we process the information you provide, such as your name, contact details, CV, cover letter, work history, education and portfolio.

• Purpose: to assess your application for current or future roles in the Bored Panda Group.
• Legal basis: taking steps at your request before entering into an employment or service contract (Art. 6(1)(b) GDPR). Keeping your application for future roles is based on your consent (Art. 6(1)(a) GDPR).
• Sharing: we may share your application with the Group Company that is hiring for a relevant role.
• Retention: we keep your application for up to 6 months after we receive it. If you agree, we keep it for up to 12 months so we can consider you for future openings. You can withdraw your consent at any time.

Please do not send us sensitive information, such as health data or ID documents, unless we specifically ask for it.

4. Visiting the Website

The Website is hosted on Firebase Hosting, a service provided by Google LLC (USA), and on GitHub Pages, a service provided by GitHub, Inc. (USA). When you visit the Website, the hosting provider automatically processes technical data, including your IP address, browser type and the time of your request, to deliver the pages and keep the service secure. It may keep this data in server logs for a limited period. Our legal basis is our legitimate interest in operating a secure website (Art. 6(1)(f) GDPR).

Map on the Contacts page. The Contacts page shows where our offices are on a map from OpenStreetMap. To display it, your browser loads the map images directly from servers of the OpenStreetMap Foundation (United Kingdom), which receive your IP address and browser information. The OpenStreetMap Foundation processes this data under its own privacy policy. Our legal basis is our legitimate interest in showing you where to find us (Art. 6(1)(f) GDPR).

5. Links to social media and other websites

The Website links to our profiles and to other Group websites, including Instagram, LinkedIn, Facebook, TikTok, Pinterest, Reddit, YouTube, boredpanda.com and our jobs board. Once you follow a link, the operator of that site controls how your data is processed, under its own privacy policy. We encourage you to read those policies.

6. Who we share your data with

We do not sell your personal data. We share it only when necessary with:

• Group Companies, as described in sections 2 and 3;
• Service providers who process data on our behalf, such as our email and workspace provider (Google Workspace), our website hosts (Google Firebase and GitHub) and our recruitment platform (Teamtailor). They may use the data only on our instructions;
• Professional advisers, such as lawyers, auditors and accountants, where needed;
• Public authorities, courts or other parties, where the law requires it or where we need to protect our rights. This also applies to a potential buyer or investor if our business or part of it is reorganised or sold.

Transfers outside the EEA. Some of our service providers are based in the USA. Where personal data is transferred outside the European Economic Area, we rely on an adequacy decision, such as the EU–US Data Privacy Framework, or on the European Commission’s Standard Contractual Clauses.

7. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted;
• restrict the processing of your data;
• receive your data in a portable format;
• object to processing based on our legitimate interests;
• withdraw your consent at any time, without affecting processing that took place before you withdrew it.

To use any of these rights, email group@boredpanda.com with the subject line “My privacy”. We may ask you to confirm your identity. We will reply within one (1) month of receiving your request. We may extend this by up to two (2) further months where needed, taking into account how complex your request is and how many requests we have, and we will let you know if we do.

If you believe we are processing your data unlawfully, you can complain to the State Data Protection Inspectorate of Lithuania (Valstybinė duomenų apsaugos inspekcija), L. Sapiegos g. 17, LT-10312 Vilnius, vdai.lrv.lt. You can also complain to the data protection authority in the EU country where you live. We would appreciate the chance to resolve your concern first.

8. Changes to this Policy

We may update this Policy from time to time, for example if we add new features to the Website. The date at the top shows when it was last updated.