Pikapick
FIEN
Legal

Privacy Policy

This policy explains how PikaPick collects, uses, and protects personal data when you use our website, our browser service, or our mobile apps. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and Finnish data protection law.

Last updated: 28 August 2026

Data controller

PikaPick Group Oy (Business ID 3634802-5) is the data controller for personal data processed through the PikaPick platform.

Mailing address: Jäähallinkaari 4 A 81, 33540 Tampere, Finland. For privacy-related requests, contact support@pikapick.fi.

What data we collect

We collect personal data directly from you when you create an account, use the service, or contact support.

  • Account data: your full name, email address, and phone number when you register.
  • Reservation and rental data: location choice, rental type (one-time or monthly), key codes, locker number, deposit and pickup events, and rental status.
  • Payment data: our payment processor handles payments; we store payment references and order status, we do not store payment details on the PikaPick platform.
  • Support: messages you send to support@pikapick.fi.
  • Technical data: our servers record the requests made to the service, including your user identifier and connection data, and keep these logs for a short time to detect and investigate misuse.
  • Website: our marketing website loads a mapping service to display the fixed locations of service points on the map. The map service provider receives technical connection data — your IP address, browser and device information, the date and time, the page you are viewing, and the map area requested — and may set its own identifiers in your browser.

Managing your account and rental requires this information. Without it, we cannot provide the service you request.

Purposes of processing and legal basis

  • Creating your account, managing your user account, and authenticating you in the app — performance of a contract (GDPR 6(1)(b)).
  • Reserving lockers, coordinating handover with partner service point staff, and enabling pickup, including key codes you share — performance of a contract (GDPR 6(1)(b)).
  • Billing locker reservations and orders through our payment processor — performance of a contract (GDPR 6(1)(b)).
  • Retaining accounting records — legal obligation (GDPR 6(1)(c)).
  • Protecting the service and user accounts, preventing misuse and fraud, and maintaining technical logs — legitimate interest (GDPR 6(1)(f)).
  • Customer support and improving the quality and reliability of the service — legitimate interest (GDPR 6(1)(f)).
  • Displaying public service points on the mobile and web apps — legitimate interest (GDPR 6(1)(f)).
  • Displaying public service points on the marketing website map — consent (GDPR 6(1)(a)).

How long we keep data

  • Account data is kept for as long as your account is active. When an account is deleted, we delete your account and profile data and your customer profile at our payment processor. Rental, locker access and payment records are retained under the retention periods below, because we need them to establish or defend legal claims and to meet our accounting obligations.
  • Data related to rentals, locker use, and access events is kept for as long as we need it for security, investigating misuse, resolving disputes, and establishing or defending legal claims. Where the same record is also an accounting record, the accounting period below applies.
  • Payment and accounting records are kept for 6 years from the end of the financial year, as required by Finnish accounting law.
  • Customer support requests and related communications are kept for as long as needed to resolve the matter, and for a reasonable time to improve service quality.
  • Anonymised statistical and analytics data may be kept indefinitely, as it cannot be linked to an individual.

Who we share data with

We may disclose personal data to the following categories of recipients, to the extent necessary to provide the service:

  • cloud hosting and database service providers
  • payment processors
  • email service providers
  • mapping service providers
  • service point staff, who see only the information necessary to complete the rental
  • competent authorities, where required by law

We have entered into data processing agreements under Article 28 GDPR with all processors of personal data. We only use providers who commit to protecting personal data in accordance with applicable data protection law.

Disclosure to authorities

PikaPick may disclose personal data to competent authorities where there is a legal obligation to do so, or a justified reason to suspect that the service or a rented locker is being used for unlawful activity.

International data transfers

Our primary database and file storage are hosted in the EU. Some processors we rely on operate globally and may process data outside the EU or EEA.

Where that happens, we rely on legally required safeguards, such as the European Commission's Standard Contractual Clauses, together with any additional measures needed to protect your data.

Your rights

  • The right to access a copy of your personal data.
  • The right to rectification of inaccurate or incomplete data.
  • The right to erasure of your personal data, under certain conditions.
  • The right to restrict how we process your data, under certain conditions.
  • The right to object to processing based on our legitimate interests.
  • The right to data portability, under certain conditions.
  • The right to withdraw consent at any time, where processing is based on consent.
  • The right to lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi) if you believe your rights have been violated.

To exercise these rights, send a message to support@pikapick.fi. Our team will carry out the request on your behalf. We may ask you to verify your identity, and we will respond to your request within one month in accordance with the GDPR.

To delete your account, see Delete your account, which sets out the process and what we delete and keep.

Automated decision-making and profiling

PikaPick does not make automated decisions concerning data subjects, nor does it carry out profiling that has legal or similarly significant effects on data subjects.

Security measures

We protect personal data with appropriate technical and organisational measures:

  • Encrypted connections during data transmission
  • Encryption of data at rest
  • Access control
  • Role-based access permissions
  • Data processing agreements with our processors

Customer app permissions

The PikaPick app uses network access as required for the service to function. The app does not request permission to your device's location, camera, Bluetooth, or photos, and does not track your location.

Cookies

Our website uses cookies that are strictly necessary for the site to function.

The site may also load a third-party mapping service, which can result in cookies being set and personal data, such as your IP address, being processed by the map service provider. Where necessary, we ask for your consent before loading the map.

Changes to this policy

We may update this privacy policy from time to time, for example to reflect changes to our service or to legal requirements. The "last updated" date at the top of this page reflects the most recent change.

Contact

For privacy questions or data subject requests, contact support@pikapick.fi.

PikaPick Group Oy, Business ID 3634802-5, Jäähallinkaari 4 A 81, 33540 Tampere, Finland.