Privacy Policy

1. About this policy

Giftzie helps adults organise parties and manage responses using interactive printed invitations and an online app.

This Privacy Policy explains how we collect, use, share and protect personal information relating to:

• Party hosts.
• Adults responding to invitations.
• People being celebrated, including children.
• Party attendees, including children.
• Website visitors and people contacting support.

The Service is intended for adults aged 18 or over. We nevertheless process information about children when adults enter their details for party arrangements.

2. Who is responsible for your information?

Giftzie Ltd is the data controller responsible for the personal information covered by this policy.

Our details are:

• Company number: 11047943
• Registered office: 29 Eastern Way, Bury St Edmunds, Suffolk, IP32 7AB, UK
• Privacy email: privacy@giftzie.com
• Support email: help@giftzie.com
• Postal contact address: 29 Eastern Way, Bury St Edmunds, Suffolk, IP32 7AB, UK

The software platform is owned and operated by YrTech Ltd, company number 12027843.

YrTech acts as a processor for Giftzie when providing the platform and related technical services on our instructions. Its ownership of the software does not give it permission to use your party or guest information for its own unrelated purposes.

We are responsible for explaining and overseeing the processing carried out on our behalf.

This policy addresses UK data-protection requirements. Where other data-protection laws apply, we will also respect the rights and obligations they provide.

3. Information we collect

Account and contact information

We collect information needed to register and manage adult accounts, including:

• Email address and password credentials.
• Forename and surname.
• Telephone number.
• Account verification and recovery information.
• Account settings, service preferences and records of relevant consents.

Passwords are encrypted and are not displayed to hosts or guests.

Party and celebrant information

Depending on the occasion and the fields completed, we collect:

• The occasion, such as a birthday, baby shower, anniversary or wedding.
• The name of the person being celebrated.
• The milestone being celebrated, such as their upcoming birthday age or anniversary.
• The celebrant’s gender, if voluntarily provided.
• The host’s name, contact details and relationship to the celebrant.
• The party location, date and time.
• Activities and food arrangements.
• Gift ideas, interests and other information included in the invitation.
• Information linking the party to its setup code and invitation codes.

We do not collect the celebrant’s date of birth. Providing gender information is optional, with a “Prefer not to say” option available.

We use the milestone being celebrated and the celebrant’s gender, if provided, to suggest birthday cards that the host or invited guests may wish to purchase for the celebrant. Purchasing a recommended card is entirely optional and is not required to use the invitation or RSVP features.

RSVP and attendee information

When an adult responds to an invitation, we collect:

• The responding adult’s name and contact details.
• The attendee’s name.
• The responding adult’s relationship to the attendee.
• The attendee’s gender, if voluntarily provided, with a “Prefer not to say” option.
• Their attendance response.
• Optional dietary requirements.
• Optional messages to the host.
• Information linking the response to the relevant invitation and party.

Dietary requirements may include sensitive personal information. Our handling of this information, including the separate explicit consent required, is explained in Section 6.

Sensitive information

Dietary requirements and messages may contain health information, such as allergies, or information revealing religious beliefs.

We ask you to provide only information needed for the party and to avoid unnecessary medical histories or other sensitive details.

Our approach to sensitive information is explained in Section 6.

Technical and usage information

We may collect:

• IP address, browser and operating system.
• Access times, pages used and relevant app interactions.
• Session and authentication information.
• Security events, errors and diagnostic information.
• Notification preferences and device notification tokens where push notifications are enabled.
• Cookie and similar technology information, as explained in Section 11.

Support and purchase information

If you contact us, we collect the information needed to handle your enquiry, including correspondence and relevant account, party or order references.

Where Giftzie receives order information from Amazon or another sales channel, we use it to fulfil the relevant sale, handle returns, provide support and maintain necessary transaction records.

You do not need to provide payment-card details to submit an RSVP. Payments made through Amazon are handled under the relevant checkout arrangements and privacy information.

4. Where information comes from

We receive information:

• Directly from you when you register, create a party, respond or contact us.
• From a host or another authorised adult who provides information about you or a child.
• From your use of the website and app.
• From service providers acting on our behalf.
• From a retailer or marketplace where necessary for your purchase or support request.

For example, a parent may provide a child’s name and attendance information, or a host may provide the celebrant’s details.

If you provide information about someone else, please make this policy available to them or their parent or guardian, as appropriate. We also take responsibility for providing privacy information where required by law.

5. Why we use information and our lawful bases

We use personal information only where we have a lawful basis.

Contract means we need the information to provide the service you have signed up for.

Legitimate interests means we have a reasonable purpose for using the information, have checked that its use is necessary, and have balanced that purpose against your rights—particularly where children’s information is involved.

Consent means you have given permission, which you can withdraw.

Legal obligation means the law requires us to use the information.

Where we rely on legitimate interests, we assess whether our use is necessary and whether the interests or rights of the individuals concerned override those interests. We give particular weight to children’s privacy and wellbeing.

We do not use sensitive dietary information for advertising or general customer profiling.

6. Dietary requirements and explicit consent

Providing dietary requirements through Giftzie is optional. You may submit an RSVP without entering them and discuss requirements directly with the host instead.

If you choose to enter information revealing health conditions, religious beliefs or other special category information, we ask for separate explicit consent to:

• Receive and store that information.
• Associate it with the relevant attendee and party.
• Make it available to the relevant host for party and catering arrangements.

We record the consent and when it was given.

For a child who cannot give valid consent themselves, consent must come from someone with parental responsibility. Where a child has sufficient understanding to give their own consent, we must respect their capacity and applicable rights. Someone submitting information on another person’s behalf must have appropriate authority.

You can withdraw consent by contacting privacy@giftzie.com.

Withdrawal does not affect processing that was lawful before withdrawal. We will stop the relevant consent-based processing and delete the information unless a specific legal basis and special category condition justify limited further retention.

Withdrawal does not require you to close your account.

Information already read or copied by a host cannot automatically be recalled. We will explain relevant steps and, where appropriate, notify the recipient of a deletion or withdrawal request.

If sensitive information is submitted in a general message without a suitable basis, we may remove it or contact the sender to resolve the issue.

7. Who can see party and RSVP information?

Invitation recipients

People accessing a party through an invitation can see the party information made available through that invitation. This includes relevant details about the occasion, celebrant, venue, date, time, activities, food, gift suggestions and host.

Invitation codes and links may be passed on or photographed. Depending on the access controls used, someone who obtains a valid code may be able to view party information. Keep invitations and setup codes secure.

Hosts

The relevant host can see the RSVP information submitted for their party, including the responding adult’s name and contact details, attendee details, attendance status, optional dietary requirements and messages.

Other guests

Other guests cannot view your RSVP details, telephone number, dietary requirements or private message through the Service.

Giftzie and its providers

Authorised personnel may access information where necessary to operate, support and secure the Service, resolve an enquiry or meet a legal obligation. Access is limited according to responsibilities.

Your password is not disclosed to hosts or guests.

Copies held by hosts

Hosts may retain information they have read or copied outside the app. Our Terms restrict their use of guest information to appropriate party-related purposes.

Deleting information from Giftzie does not automatically erase an independent copy held by a host. Contact us if you need help addressing a concern.

8. Other recipients of information

We do not sell your personal information.

We share information where necessary with:

• YrTech Ltd, our platform and technical service provider.
• Hosting, storage, email, notification and other technical providers appointed by us or authorised as subprocessors.
• Professional advisers, such as legal or accounting advisers, where appropriate.
• Authorities or other recipients where disclosure is required by law or necessary and lawful to address fraud, security incidents or legal claims.
• A prospective or actual business successor where necessary for a business transaction, subject to confidentiality, lawful processing and appropriate safeguards.

Providers processing information on our behalf must follow contractual requirements concerning instructions, confidentiality, security and other applicable obligations.

Amazon and other retailers process information under their own privacy notices for the activities they control but do not have access to information held within the Giftzie App.

9. International transfers

Primary hosting location: UK

Where personal information is transferred outside the UK in circumstances requiring safeguards, we use an applicable lawful transfer mechanism. This may include UK adequacy regulations or appropriate contractual safeguards, such as the UK International Data Transfer Agreement or UK Addendum, together with required assessments and additional measures.

Where EU GDPR transfer rules also apply, we use an appropriate mechanism under those rules.

10. How long we keep information

We retain personal information only for as long as reasonably necessary for its stated purpose, taking account of legal requirements, security needs and individual rights.

Our standard data retention periods are as follows, unless an earlier valid withdrawal or deletion request is received:

Deleting an account does not necessarily require us to erase every record immediately. For example, we may need to retain a limited transaction record or evidence concerning a dispute. Any exception must have a valid purpose and lawful basis.

We do not retain children’s party or dietary information merely because a parent keeps an account for future invitations.

Information awaiting removal from backups is restricted from ordinary use. If a backup is restored, relevant deletion instructions are reapplied.

We may retain genuinely anonymised statistics that no longer identify individuals.

11. Cookies and similar technologies

We use cookies and similar technologies for purposes such as authentication, session management, security and remembering relevant choices.

Where a technology is strictly necessary to provide a service you request, we may use it without seeking consent, as permitted by law.

Where consent is required, we ask before placing or accessing the technology and provide a way to withdraw consent.

Cookie controls: Only strictly necessary cookies are used in the provision of the Service. Blocking necessary cookies through your browser may prevent login or other core features from working.

12. Service messages, push notifications and marketing

We may send messages needed to provide the Service, such as account verification, password resets, security alerts, RSVP activity and relevant party updates.

These messages are separate from promotional marketing.

Where push notifications are available, we use the relevant device permission and notification token to deliver them. You can manage push permissions through your device and any controls provided in the app.

If we offer promotional emails or similar marketing, we will request a separate opt-in under our proposed marketing approach. You can withdraw that choice using the unsubscribe facility or by unticking the marketing consent box on your Profile page.

Declining marketing does not prevent you from using the core Service.

We do not treat registering an account, submitting an RSVP or accepting the Terms as marketing consent.

13. Children’s information

Children do not need a Giftzie account to be included in a party invitation or response.

We collect information about children from adults for the limited purpose of providing relevant party arrangements and associated support and security.

We ask adults to:

• Provide only necessary information.
• Have appropriate authority to provide it.
• Explain relevant uses to the child in an age-appropriate way.
• Consider the child’s wishes and understanding.
• Avoid unnecessary sensitive information.

A child’s personal information belongs to the child for data-protection purposes. Parents and guardians do not automatically have unrestricted access to it.

We consider the child’s understanding, best interests and the authority of the requester when dealing with requests on a child’s behalf.

If we discover that a child has created an account contrary to our adult-account rules, we will assess the circumstances, restrict inappropriate access and take proportionate steps to resolve the issue.

The fact that an account is operated by an adult does not remove our responsibility to protect information about children.

14. Security

We use appropriate technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration and disclosure.

These include measures appropriate to the Service, such as encrypted transmission, secure password handling, access controls, monitoring and contractual safeguards for providers.

No system can guarantee absolute security. If a personal-data breach occurs, we assess it and notify the relevant authority and affected individuals where required by law.

You can help by keeping passwords and setup codes secure and contacting us promptly about suspicious access.

15. Your rights

Depending on the circumstances and applicable law, you may have the right to:

• Obtain access to your personal information.
• Correct inaccurate or incomplete information.
• Request deletion.
• Restrict certain processing.
• Object to processing based on legitimate interests.
• Object to direct marketing.
• Receive certain information in a portable format.
• Withdraw consent where processing relies on consent.
• Challenge relevant solely automated decisions, where applicable.
• Complain about our handling of your information.

These rights are not absolute. We will explain any lawful restriction that applies to a request.

To make a request, contact privacy@giftzie.com. You do not need an active account.

We may request proportionate information to verify identity or authority, particularly for requests concerning children or another person.

We respond without undue delay and normally within one month, subject to any lawful extension or other adjustment allowed by applicable law. We explain when additional time is needed.

Requests are normally free of charge. We only charge a fee or refuse a request where the law permits.

Where required, we also communicate relevant corrections, deletions or restrictions to recipients.

16. Privacy complaints

If you are concerned about our handling of personal information, contact privacy@giftzie.com or write to Giftzie Ltd, 29 Eastern Way, Bury St Edmunds, Suffolk, IP32 7AB, UK.

We will acknowledge a data-protection complaint within 30 days, investigate without undue delay, keep you appropriately informed and explain the outcome.

You also have the right to complain to the UK Information Commissioner’s Office.

Where another supervisory authority has jurisdiction, you may also have the right to complain to that authority.

Contacting us first may help resolve a concern promptly, but this policy does not restrict your legal rights.

17. Changes to this policy

We may update this policy to reflect changes to the Service, our processing or applicable law.

We will update the effective date and take appropriate steps to bring material changes to your attention.

If we propose a new use of personal information, we will assess its lawfulness and provide required information before starting it. Where fresh consent is required, we will obtain it.

A change to this policy does not itself give us consent to use your information for a new purpose.