Privacy policy

1. Who is responsible for your data?

The controller of your personal data is the operator of the site, Pure Digital Marketing Agency Oy (Business ID 3362970-2), Vironkatu 9 A 8, 00170 Helsinki, Finland. For data protection questions, write to [email protected] or use the contact form.

2. What data do we collect?

We collect only what the service needs:

Account: name, email address, a hash of your password (we never store the password itself), whether your email is verified, and your acceptance of the 18+ age limit, the terms of use and this policy.
Premium: your plan, payment status and receipt details. Stripe handles card details. They never reach us.
Newsletter: your email address and when you confirmed the subscription.
Premium notifications: the lotteries you chose and, if you allow browser notifications, the push address your browser gives us.
Contact requests: name, email address, topic and message.
Server logs: IP address, time, requested page and browser details.

We get this data from you. We get the payment status from Stripe. To open an account you must give a name, an email address and a password, otherwise we cannot create it. You can browse results and the archive without an account. The service is for adults, and we do not knowingly collect data from anyone under 18.

3. Why do we use data, and on what legal basis?

Account, Premium, notifications and support: our contract with you.
Newsletter: your consent. You can withdraw it at any time with the link in the newsletter or in your account.
Browser notifications (push): your consent. They are off by default. You switch them on in your account, and your browser asks for permission. You can withdraw consent in your account or in your browser settings.
Replying to contact requests: our legitimate interest in answering you. If the request is about your account or plan, the basis is the contract.
Logs and security: our legitimate interest in keeping the site running and preventing misuse.
Bookkeeping of payments: a legal obligation (Finnish Accounting Act).

We do not sell your data and do not use it for advertising.

4. How long do we keep data?

Account data: for as long as the account is in use. We delete it within 30 days after you ask us to delete the account.
Payment records: 6 years from the end of the year in which the payment was made (Finnish Accounting Act).
Newsletter: until you unsubscribe. We delete the address within 30 days. An unconfirmed subscription is deleted after 30 days.
Push address for browser notifications: for as long as notifications are on. We delete it within 30 days after you switch them off or delete your account.
Contact requests: 12 months after the matter is closed.
Server logs: 30 days.

5. Who receives the data?

We do not sell or rent data. We use a few service providers that process data only on our behalf and under a contract:

a hosting provider in the EU (site, database and logs)
an email service in the EU (verification emails, password reset, notifications and the newsletter)
your browser maker’s push service, if you allow Premium notifications in your browser (it receives an encrypted notification and your device’s push address)
Stripe (Premium payments); Stripe also processes payment data under its own privacy terms

We give data to authorities only when the law requires it.

6. Is data transferred outside the EU?

The site’s server and the email service are located in the EU. Stripe may transfer payment data to the United States. The transfer relies on the EU–US Data Privacy Framework and the European Commission’s standard contractual clauses. If you allow Premium notifications in your browser, your browser maker’s push service may be located outside the EU. It receives only an encrypted notification and your device’s push address. For details of these safeguards, write to [email protected].

7. What are your rights?

You have the right to

know what data we hold about you and get a copy of it
correct wrong data; you can also change your name and email address in My account
ask us to delete your data or restrict its processing
receive the data you gave us in a machine-readable format and pass it to someone else
withdraw your consent at any time; this does not affect processing that happened before.

Send your request with the contact form or to [email protected]. We reply without undue delay and within one month at the latest. If a request is complex or there are many requests, this can be extended by up to two more months. If so, we tell you within the first month. We may ask you to confirm your identity.

If you think we process your data unlawfully, you can complain to the Office of the Data Protection Ombudsman in Finland (tietosuoja.fi).

8. Can you object to processing?

Yes. When processing is based on our legitimate interest (contact requests, logs), you can object to it on grounds relating to your particular situation. We will stop unless we have compelling grounds for it or need it for a legal claim.

9. Do we make automated decisions?

No. We make no automated decisions about you and do no profiling.

10. How do we protect data?

The database sits on the server apart from the public web pages. We store only a hash of your password. Only those people at the operator of the site who need the data for their work can access it. The connection to the site is encrypted.

11. Which cookies do we use?

Only strictly necessary ones: login, language choice and your cookie choice. There is no analytics, no advertising and no third-party cookies, and our fonts come from our own server. More: Cookies.

12. Can this policy change?

We update this policy when the service or the law changes. The date is shown at the top of the page. We email registered users about important changes before they take effect.