Privacy Policy

1. About this Privacy Policy

GyftBox Ltd ("GyftBox", "we", "us" or "our") respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains what personal information we collect, how and why we use it, who we may share it with, how long we keep it and the rights you have in relation to it.

It applies when you use our website, purchase or receive a GyftBox product or service, communicate with us, interact with us through one of our partners, or otherwise provide personal information to us.

2. Who We Are

GyftBox Ltd is the organisation responsible for the personal information covered by this Privacy Policy where we determine how and why that information is used.

Registered Office

Redlake CottageNorth WoottonBA4 4HQ

Email

admin@gyft-box.com

Data Protection Officer

GyftBox's Data Protection Officer is Nikki Moule.

For questions about this Privacy Policy or the way we use your personal information, please contact us using the details above.

3. Our Approach to Privacy

GyftBox aims to balance protecting people's privacy with providing an enjoyable, personalised and efficient customer experience.

We seek to collect and use information only where there is a clear purpose for doing so and to be transparent about how that information is used.

We do not sell personal information.

4. Information We May Collect

Depending upon how you interact with GyftBox, we may collect the following types of personal information.

Identity and contact information

This may include:

• name;
• postal address;
• email address;
• telephone number; and
• details of the person purchasing or receiving a GyftBox.

Order and transaction information

This may include:

• products or services purchased;
• event or experience information;
• order numbers;
• transaction history;
• delivery information;
• redemption information; and
• communications relating to an order.

Payment card details may be processed by our payment providers. GyftBox does not need to retain full payment card information where payments are processed on our behalf by an authorised payment provider.

Personalisation information

Where a GyftBox product allows personalisation, we may process information provided by the purchaser or recipient including:

• names;
• personal messages;
• event information;
• dates;
• photographs or other content where the service permits them; and
• information necessary to create the personalised product.

People purchasing gifts should avoid providing unnecessary sensitive personal information about another person within personalised messages.

Customer service information

Where you contact us, we may retain information relating to your enquiry, complaint or request together with correspondence and records of how the matter was resolved.

Marketing information

We may record:

• marketing preferences;
• communications preferences;
• responses to marketing;
• promotions entered; and
• interactions with our marketing communications.

Technical information

When you use our website or digital services we may collect technical information including:

• IP address;
• device type;
• browser type;
• operating system;
• approximate location derived from technical information;
• website activity;
• referring website;
• pages viewed; and
• interactions with our website.

Further information about technologies used for this purpose is provided in our Cookie Policy.

5. How We Obtain Personal Information

We may receive personal information:

• directly from you;
• from someone purchasing a GyftBox for you;
• when you redeem or personalise a GyftBox;
• through a ticketing or experience partner;
• through a venue, event organiser or other commercial partner;
• from payment providers;
• from delivery and fulfilment providers;
• when you contact our customer service team;
• when you interact with our website or digital services; and
• through marketing and analytics technologies where permitted.

This means that we may sometimes receive your information even though you did not originally provide it directly to GyftBox.

6. How We Use Personal Information

We may use personal information to:

• process and fulfil orders;
• create personalised products;
• deliver physical and digital products;
• enable gift recipients to receive, access, redeem or personalise gifts;
• communicate information relating to an order;
• provide customer support;
• resolve complaints and problems quickly;
• process refunds and replacements;
• operate and improve our website and services;
• develop and improve our products;
• understand how customers use GyftBox;
• maintain the security of our systems and services;
• prevent and investigate fraud or misuse;
• maintain appropriate business and financial records;
• comply with legal and regulatory requirements;
• manage relationships with our commercial partners; and
• send marketing communications where permitted.

We will not use personal information for purposes that are incompatible with the purposes for which it was originally collected unless permitted by law.

7. Our Legal Bases for Using Personal Information

Data protection law requires us to have an appropriate lawful basis for using personal information.

Depending upon the circumstances, GyftBox may rely upon the following bases.

Performance of a contract

We use personal information where it is necessary to provide products or services that you have purchased or requested or to take steps at your request before entering into a contract.

Legitimate interests

We may process information where this is necessary for the legitimate operation and development of GyftBox and those interests are not overridden by the rights and interests of the individual concerned.

These interests may include:

• improving our products and customer experience;
• providing effective customer service;
• protecting the business against fraud;
• maintaining the security of our systems;
• understanding business performance; and
• managing commercial relationships.

Legal obligations

We may process personal information where necessary to meet legal obligations applying to GyftBox, including financial, tax, consumer protection and regulatory requirements.

Information Required to Provide Our Services

Where we ask you to provide personal information that is necessary to process an order, deliver a product or provide a requested service, we may be unable to complete the order or provide the relevant service if that information is not provided.

Consent

Where consent is the appropriate basis, we will ask for it.

You may withdraw consent at any time where our processing relies upon it.

Withdrawal does not affect processing that took place lawfully before consent was withdrawn.

8. Gift Recipients

GyftBox is designed around gifting, which means the purchaser and recipient will frequently be different people.

A purchaser may therefore provide us with limited personal information about another person so that we can create or deliver their gift.

We will only use this information for appropriate purposes connected with providing the gift and our associated services, unless another lawful basis permits its use for another purpose.

Once a recipient interacts directly with GyftBox, additional information may be collected from them in accordance with this Privacy Policy.

Where we receive personal information about a recipient from another person, we will provide the recipient with appropriate privacy information where required by data protection law.

9. Ticketing and Experience Partners

GyftBox may work with ticketing companies, venues, event organisers, attractions and other experience providers.

Where a GyftBox product or service is purchased through or connected with one of these partners, information may be transferred between the partner and GyftBox where necessary to:

• process the transaction;
• identify the relevant experience;
• create or fulfil the gift;
• provide customer support;
• facilitate redemption; or
• resolve problems.

The respective responsibilities of GyftBox and the partner for personal information will depend upon the service being provided and the arrangements between the organisations.

Partners may also process personal information under their own privacy policies.

10. Sharing Personal Information

We may share personal information with organisations providing services necessary to operate GyftBox.

These may include:

• ticketing and experience partners;
• payment processors;
• printing providers;
• packaging and fulfilment providers;
• postal and courier services;
• website and e-commerce providers;
• cloud hosting providers;
• email and communications providers;
• customer service platforms;
• analytics providers;
• professional advisers;
• insurers; and
• IT and security providers.

We expect organisations processing personal information on our behalf to protect it appropriately and to use it only for authorised purposes.

We may also disclose information where required by law, regulation, court order or a competent authority.

11. Marketing

Where permitted by applicable direct marketing and electronic communications law, including the Privacy and Electronic Communications Regulations (PECR), GyftBox may contact customers about products, experiences, promotions and services that may be relevant to them.

Where consent is required, GyftBox will obtain and record that consent before sending marketing communications. Where another lawful route is available, GyftBox will apply the relevant legal requirements and provide an appropriate opportunity to opt out.

You can unsubscribe from electronic marketing at any time using the unsubscribe facility contained within the communication or by contacting us.

Stopping marketing communications does not prevent us from sending necessary service communications relating to an order, account or transaction.

12. Cookies and Analytics

Our website may use cookies and similar technologies to operate effectively, remember preferences, understand website usage and, where permitted, support marketing activities.

Where consent is required for particular cookies or technologies, they will not be activated until that consent has been obtained.

Further information is provided in our Cookie Policy.

13. International Transfers

Some organisations providing services to GyftBox may operate or store information outside the United Kingdom.

Where personal information is transferred internationally and data protection law requires additional protection for that transfer, we will use an appropriate lawful transfer mechanism.

Depending upon the circumstances, this may include recognised adequacy arrangements, approved contractual safeguards or another mechanism permitted under applicable data protection law.

Further information about the safeguards used for international transfers can be obtained by contacting us using the details in this Privacy Policy.

14. How Long We Keep Information

We do not keep personal information indefinitely.

Information is retained only for as long as reasonably necessary for the purpose for which it was collected, including where necessary to:

• fulfil orders;
• provide customer support;
• maintain appropriate business records;
• comply with financial and tax requirements;
• deal with disputes or claims;
• prevent fraud; and
• meet legal or regulatory obligations.

Different categories of information may therefore be retained for different periods.

Detailed retention periods are maintained within our Data Retention & Disposal Policy and associated retention schedule.

When information is no longer required, it will be securely deleted, destroyed or anonymised as appropriate.

15. Information Security

We take appropriate organisational and technical measures to protect personal information against:

• unauthorised access;
• accidental loss;
• inappropriate disclosure;
• alteration;
• destruction; and
• misuse.

Access to personal information is limited to people and service providers who have an appropriate reason to access it.

We regularly review our approach to information security as the Company and its systems develop.

16. Data Breaches

GyftBox maintains procedures for identifying, investigating and responding to suspected personal data breaches.

Where a breach creates a legal obligation to notify the Information Commissioner's Office or affected individuals, we will do so in accordance with applicable data protection law.

17. Your Rights

Depending upon the circumstances, data protection law gives you rights concerning your personal information.

These may include the right to:

• request access to personal information we hold about you;
• request correction of inaccurate or incomplete information;
• request deletion of your information in certain circumstances;
• request restriction of processing in certain circumstances;
• object to certain processing;
• receive certain information in a portable format;
• withdraw consent where processing relies upon consent; and
• raise concerns about how your information is being used.

Not every right applies in every circumstance.

To exercise a right, contact us using the details at the beginning of this Privacy Policy.

We may need to verify your identity before completing a request.

Your right to object

Where we process your personal information on the basis of legitimate interests, you may have the right to object to that processing. You also have an absolute right to object to the use of your personal information for direct marketing.

18. Automated Decision-Making

GyftBox does not currently make decisions producing legal or similarly significant effects on individuals solely through automated processing.

If this changes materially, this Privacy Policy will be updated accordingly.

19. Children's Information

GyftBox products may be purchased as gifts for children.

Where this occurs, we aim to collect only the information reasonably required to create, deliver or administer the gift.

Our services are not intended to encourage children to provide unnecessary personal information.

Where additional protections or consent requirements apply to information concerning children, we will comply with them.

20. Sale or Restructuring of the Business

If GyftBox undergoes an investment, merger, acquisition, restructuring or sale of some or all of its business or assets, personal information may be disclosed to prospective or actual investors, purchasers and their professional advisers where appropriate.

Any such disclosure will be subject to appropriate confidentiality and data protection requirements.

Personal information transferred as part of a completed transaction will remain subject to applicable data protection law.

21. Complaints

If you have concerns about the way GyftBox has handled your personal information, please contact us first so that we can investigate and attempt to resolve the issue promptly.

You also have the right to raise a concern with the Information Commissioner's Office, the UK's data protection regulator.

22. Changes to this Privacy Policy

We may update this Privacy Policy as GyftBox develops, our services change or legal requirements evolve.

The current version will be made available through our website and the date at the beginning of the policy will show when it was most recently updated.

23. Further Information

If you have any questions regarding this Privacy Policy or the use of cookies by GyftBox, please contact:

GyftBox Ltd

Redlake CottageNorth WoottonBA4 4HQ

Email: admin@gyft-box.com