Privacy
Last updated 24 July 2026
Lysey investigates how big companies and public institutions treat the ordinary people who depend on them. It would be hollow to do that while being careless with yours. This page explains, in plain terms, what happens to the personal data you choose to share through the forms on this site, and how to get it back or removed.
Who is responsible
Lysey is an independent journalism project run by one private individual in the Netherlands. That person is the data controller under the GDPR and can be reached through the contact form below. Lysey publishes under that name; if you need the controller's legal identity to exercise a right or lodge a complaint, ask through the form and it will be given to you.
What we collect, and only when you send it
We collect personal data only when you fill in a form. Nothing is collected in the background about your visit.
- Come forward / share a find: your email address (so we can reach you back), and anything you choose to write in the optional fields (what happened, the company involved).
- Follow new finds: your email address, so we can tell you when a new find is published.
- Media sign-up: your email address and, optionally, your outlet.
- Contact form: your email address, an optional name, and your message.
- Your browser also sends the page you came from (the referrer), which we store with your submission for context.
We do not use cookies, we do not run analytics or tracking, and we do not run ads. There is no advertising or profiling of any kind.
Why, and on what legal basis
You submit voluntarily, so our legal basis is your consent (Article 6(1)(a) GDPR). We use your data only to:
- contact you about the case, find, or message you sent;
- understand how many people a case affects;
- notify you when a new find is published, if you asked to be.
We will never use it for anything else without asking you first.
Where it is stored, and who else sees it
Submissions are stored in Cloudflare Workers KV, and a notification of your submission is emailed to the controller through Cloudflare Email Routing. Cloudflare hosts this site and acts as our data processor. This site loads its fonts from Google Fonts, which means Google receives your IP address when a page loads; nothing else about you is shared with Google, and we intend to remove this by self-hosting the fonts.
We never sell or rent your data, and we do not share it with anyone else. If a case ever leads to a collective or legal step, we will ask your explicit permission before sharing anything with a third party such as a lawyer or another affected person.
How long we keep it
We keep your submission only as long as it is needed for the purpose above, and we delete it on request at any time.
Your rights
Under the GDPR you have the right to access your data, to correct it, to have it erased, to restrict or object to its use, to data portability, and to withdraw your consent at any time. To exercise any of these, use the contact form below and we will act without undue delay.
You also have the right to lodge a complaint with a supervisory authority, in the Netherlands the Autoriteit Persoonsgegevens.
Contact
For anything on this page, a privacy request, or to be told the controller's identity, send a message. It reaches the controller directly. No address is published to keep inboxes clean.
Thanks. Your message has reached the controller, who will get back to you.
Something went wrong. Please try again.
Used only to answer you. Nothing else.
Changes
If this statement changes, the date at the top will be updated.