GDPR & data protection
What this website does technically to handle information carefully, and the organisational arrangements that need to support it.
Version: 9 October 2026
Concrete controls, not a certification
This page is not a GDPR certificate or a guarantee that all business processes are compliant. The application uses server validation, restricted management functions, limited form inputs, abuse controls and retention limits. Booking details do not appear in the public availability list.
Data minimisation and privacy-conscious design
The introduction flow requests contact details and a short explanation only. Document uploads are not available. Fonts are served from this website. Analytics and marketing trackers are not installed. An optional display preference is stored only if you allow it.
Controller and processor roles
Unicorn-EOOD acts as controller for its own enquiries and appointments. For client services, the role must be assessed for each processing activity. Where Unicorn acts as processor, an appropriate processing agreement must be concluded beforehand, covering instructions, confidentiality, security, assistance with rights requests, incidents, subprocessors and deletion or return of data.
Management, incidents and oversight
The site owner must periodically review access, handle exports carefully and maintain processing records and incident procedures where applicable. An incident requires assessment of whether notification to the supervisory authority and affected individuals is necessary. Report a suspected security issue to unicorn-eood@proton.me without attaching sensitive files.
Before public launch
The supplier contracts, actual processing locations and handling of email, backups and client files must be finalised. Publishing a statement does not replace these measures. The privacy notice describes the website and must be updated when features or suppliers change.