Careful with yours.

Lysey is the data controller under the GDPR and can be reached through the contact form below. To exercise a right or lodge a complaint, use the form.

Personal data is collected only when you fill in a form. Nothing is collected in the background about your visit.

• Send your case (form page): your name, what happened, and, if you give them, the company involved and your email address (so Lysey can reach you back).
• Come forward on a case page: your email address (so Lysey can reach you back), which cases you sign, your answers to the checkboxes, where a case offers them, the case identifier, and, if you give it, what happened.
• Follow new cases: your email address, the date you signed up and which list you chose, so you can be told when a new case is published.
• First call (art releases): if you ask for first call via the form on the art page, your email address goes on the first-call list, used for one announcement per release.
• Press form: your name, outlet, work email and your request. A press request also puts your address on the press list; /unsubscribe takes it off.
• Contact form: your email address, an optional name, and your message.
• Your browser also sends the page you came from (the referrer), which is stored with your submission for context.

Lysey sets no cookies, and there are no tracking scripts, ads, analytics, or profiling of any kind. Two technical exceptions. When you send something through a case page or the unsubscribe page, your IP address is held for up to one hour after your last submission, to stop automated misuse, then it is gone. And after you sign a case, a flag in your own browser (localStorage) remembers that so the form does not ask you twice; it never leaves your device.

You submit voluntarily, so the legal basis is your consent (Article 6(1)(a) GDPR). Your data is used only to:

• contact you about the case or message you sent;
• understand how many people a case affects;
• notify you when a new case is published, if you asked to be;
• announce an artwork release, if you asked for first call. One email per event, never more, for both lists.

It is used only for the purposes above. If it were ever needed for something else, you would be asked first.

This site is hosted on Cloudflare Pages and served from Cloudflare's global edge network, which delivers each page from the location nearest you rather than from a single country. Cloudflare is the data processor and provides a GDPR data-processing agreement. When you submit a form, what you send is stored in Cloudflare KV (a key-value store), and a notification containing what you sent is passed on to Lysey by a Cloudflare Worker. Confirmation and list email is sent through Resend (EU region, Ireland), a transactional email provider under a GDPR data-processing agreement.

That notification, and any reply, lives in a mailbox held with an email provider under a data-processing agreement, which is also the mailbox behind the contact and corrections on this site. The fonts on this site are self-hosted on lysey.com, so no visitor data is sent to Google when a page loads.

Your data is not shared with anyone beyond the processors named above. If a case ever leads to a collective or legal step, your explicit permission is asked before anything is shared with a third party such as a lawyer, a journalist or editor, or another affected person. Where material is shared with an editor for verification, it is redacted of detail that could identify you.

Your submission is kept only as long as it is needed for the purpose above, and it is deleted on request at any time.

The people in Lysey's cases appear under a pseudonym. Dates of their own correspondence are rounded to the month and amounts around the person are rounded or kept general, so a case cannot be traced back to them. Their real names are known to Lysey and are never published.

Under the GDPR you have the right to access your data, to correct it, to have it erased, to restrict or object to its use, to data portability, and to withdraw your consent at any time. To exercise any of these, use the contact form below and it will be acted on without undue delay.

You also have the right to lodge a complaint with your national data-protection authority.