Privacy Policy

This Privacy Policy explains how Gyftup ("Gyftup", "we", "us") collects, uses, shares and protects your personal data, and the rights you have. We are committed to data minimisation: we collect only what we need, and we never share your home address or precise location with other users.

Who is responsible for your data

Data controller: Christopher Ashton, trading as Gyftup.

Address: Lytchett House, 13 Freeland Park, Wareham Road, Poole, Dorset, BH16 6FA

Contact our data protection point of contact at privacy@gyftup.com.

1. Data we collect

We collect: account data (display name, email, a securely hashed password, role); profile data you choose to publish (photo, bio, area, country, wishlist, showcase, merchandise); transaction data (treats given or received, amounts, venue, status, messages and proof attached to a gift); payment confirmation and limited references from our providers, not your full card number; identity data where you withdraw money, which in most cases means only a reference and a result from our payment provider, and in the limited case described in section 4 can mean an identity document and a photograph held by us; and usage and device data such as logs, approximate region from IP, and device type. We do not collect or store your precise GPS location and do not need it to run the service.

Some data is collected only for particular features. If a gift is a physical item that a shop posts to you, we hold the delivery address you give us and pass it to that shop for that order only. If you scan a table code at a venue, we record that scan for a short time so that you and another member in the same venue can be told about each other where you have both allowed it. If you work at a venue as a member of staff, we hold your name, your photo and the short description you write, your age if you choose to give it, your job and role at the venue, the times you start and end a shift, the orders you serve and the tips you earn. If you are served by a member of staff, we hold any rating, comment or note you leave about that order.

2. How we use data

We use data to create and manage your account; to process treats, prepaid credit, payouts and refunds; to verify identity where money is paid out and to prevent fraud and abuse; to send notifications such as a treat received; to provide support and handle fault reports; to secure and improve the Platform; and to meet legal, tax and regulatory obligations. We do not sell your personal data and do not use it for third-party advertising.

3. Legal bases (UK GDPR / EU GDPR)

We rely on: contract, to provide the service you ask for; legitimate interests, to secure the Platform, prevent fraud and improve our service, balanced against your rights; legal obligation, to comply with tax and accounting law and with any other legal duty that applies to us; and consent, for non-essential cookies and any optional marketing, which you can withdraw at any time.

Identity checks before a withdrawal are carried out under contract, because we need to know we are sending your money to you. Our payment providers may have their own anti-money-laundering duties, which they carry out as part of the checks described in section 4.

4. Payments and identity verification

Payments are processed by Stripe, PayPal and LiqPay. Card details are entered on the provider's own hosted checkout, not on a Gyftup form, so they do not reach our servers. These providers act under their own privacy policies, which we encourage you to read.

Identity verification. Where you receive money for withdrawal, we have to check you are who you say you are. Normally that check is carried out by our payment provider on their own pages: they collect the document and the photograph, they keep them, and we receive only a reference and the result. We do not see or store the document in that case.

There is one exception, and we would rather set it out plainly than let you find it later. Gyftup also contains a manual verification route in which an identity document and a photograph are uploaded to us and stored on our own server for an administrator to review. That route is switched off unless an administrator has deliberately enabled it, and it is not part of how we intend to verify people. If it is ever used for your account, the document and photograph are held by us, only administrators can open them, and they are covered by the same rights below as everything else: you can ask what we hold, ask for a copy, and ask us to delete it.

Your data export tells you which applies to you. If we hold an identity image for you, it is listed there, and you can ask for a copy at privacy@gyftup.com.

5. Location and privacy by design

Protecting where you are is core to Gyftup. A Recipient is shown to Gifters only by name and, if they choose, by the venue they appear at. We never reveal a Recipient's home address, precise location or scheduled visit times to a Gifter, and venues can be hidden entirely. Physical wishlist items are bought by the Recipient themselves, so no shipping address is shared. Where a shop posts an item to a Recipient, the delivery address goes to that shop for that order and is never shown to the Gifter.

A member of staff's name, photo and short description are shown to the customers they serve. Their age, where given, is seen by their venue only and is never shown to customers. A rating, comment or note a customer leaves about an order is seen by the venue and its staff, not by other customers.

6. Sharing your data

When you make a booking or use a treat at a venue, that venue is shown what it needs to serve you. For a booking: your display name, the size of your party, the date and time, and any note you add. For a treat pass: the display name and public profile link of a signed-in person who used it, the kind of device it was used on (for example "iPhone", and never the fuller details your browser sends), and how the person who paid for it paid, as a payment method and country (for example "Visa, GB"). A treat pass can be used without an account, and the venue then sees no name. So that a venue's counter code can recognise your treat without anyone typing a code, a cookie is set on the device that opened it.

You can order from a venue without an account, on a tablet in the venue or through its ordering link. We keep what you choose to give: a first name so your order can be called, and, for a delivery, the address to deliver to and a phone number the driver can reach you on. The venue sees these so that it can make and deliver your order. If the venue offers a text message when your order is ready and you leave a mobile number for it, that number is passed to our text message provider to send that one message. The address and phone number are deleted from the order 30 days after it is completed. The screen a venue may show on its wall lists order numbers only, never names.

We share personal data only as needed: with payment and verification providers to take payments and make payouts; with venues for the limited details needed to fulfil a treat, such as a redemption code and a display name; with service providers such as hosting and email, under contract and on our instructions; with authorities where required by law or to prevent fraud and protect safety; and with a successor in a merger or acquisition, subject to this policy.

7. International transfers

Some providers may process data outside your country. Where we transfer personal data internationally we rely on appropriate safeguards such as adequacy decisions or standard contractual clauses, as permitted by law.

8. Data retention

We keep personal data only as long as we need it, then delete or anonymise it. There is no single period that covers everything, so each kind of data has its own:

• Your account and profile. Deleted when you close your account. Sign-in credentials and access tokens are destroyed at that point and are never kept.
• Check-ins and scheduled visits. Deleted 30 days after the visit has passed, and immediately if you close your account. We do not keep a history of where you have been.
• Messages and attachments. Attachments are removed from our servers 48 hours after they are sent. Message text is deleted 12 months after the order it belongs to is closed, unless that specific conversation is evidence in an open dispute.
• Proof photos. Deleted 600 days after the transaction, and immediately when you close your account if no dispute is open. That is the longest period a card payment can still be disputed under the card scheme rules, plus a short buffer for us to answer it. After that the photo cannot help anyone, so we do not keep it.
• Transaction, payment and tax records. Kept for 6 years, and longer only while a dispute, chargeback, enquiry or legal claim about them is open. Two rules apply and we follow the longer: HMRC requires a sole trader to keep records for at least 5 years after the 31 January filing deadline, and a claim about the transaction itself could be brought for 6 years. We remove the personal detail we do not need for that purpose, such as names, messages and venue information, and keep the amounts, dates and payment references.
• Identity verification. Where a check is done by our payment provider, we keep only the reference and the result, deleted with your account. In the limited case where we hold an identity document ourselves, it is deleted once the verification decision is made and any dispute about that decision is closed, and always when you close your account.
• Records of what you agreed to. Which version of these terms you accepted, and when. Kept for 6 years from the date your agreement with us ends, which is the period during which a claim about it could still be brought in England and Wales. We keep the version and the date, and remove the account details attached to it once your account is closed.
• Backups. Held on a rolling 35 day cycle, after which each backup is deleted. Data you have asked us to erase can remain inside a backup until the backup itself expires. It is not used for anything in the meantime, and if we ever restore from one, your closure is re-applied before the restored system is used again.

When you close your account we tell you exactly what was deleted, what was kept, why, and for how long. If you think we are keeping something we should not, email privacy@gyftup.com and we will look at it again.

9. Your rights

Subject to applicable law, you have the right to access your data, rectify inaccurate data, request erasure of your data and account (subject to records we must keep by law), receive your data in a portable form, restrict or object to certain processing, withdraw consent at any time, and complain to your supervisory authority, for example the UK Information Commissioner's Office (ICO) at ico.org.uk. You can export your data and delete your account from your privacy settings, or contact privacy@gyftup.com. We will respond within the time required by law, normally one month.

10. Cookies

We use a small number of cookies and similar technologies. Essential cookies are needed to sign you in and keep the service secure; optional cookies are used only with your consent. See our Cookie Policy for details and to manage your choices.

11. Security and children

We use appropriate technical and organisational measures, including encryption in transit, strong password hashing, access controls and admin-only handling of sensitive documents. No system is perfectly secure, but we work to protect your data and respond quickly to incidents, notifying you and the authority where required. Gyftup is not for anyone under 18 and we do not knowingly collect data from children.

12. Changes and contact

We may update this policy and will post the new version with a revised date, giving notice of material changes. For any privacy question or to exercise a right, contact privacy@gyftup.com.