This Privacy Policy explains how GiftDesk handles personal data. GiftDesk is operated by Alex Walls, a sole trader trading as "GiftDesk", who is the data controller for the purposes of UK data protection law. You can contact us about privacy at privacy@giftdesk.co.uk.
Who this covers
We process personal data about two groups:
- Merchants: the businesses and people who create a GiftDesk account.
- Buyers and recipients: people who buy or receive a gift voucher through a merchant's shop.
For buyer and recipient data, the merchant owns the relationship with their own customers and is the controller of that data, while GiftDesk acts as their processor and operates the platform. We process that data to run the shop, take payment and deliver vouchers on the merchant's behalf.
What we collect
- Account data: name, email, business name, shop settings and branding.
- Order data: buyer and recipient names and emails, gift messages, voucher codes, amounts, delivery method and redemption records.
- Payment data: we use Stripe to take payment. We never see or store full card details. We receive limited payment metadata such as a confirmation, the amount and a reference.
- Technical and usage data: IP address, device and browser information, and analytics if you consent.
- Communications: any emails you send us.
Why we use it, and our lawful bases
- To provide the service and your shop, and to deliver vouchers: performance of a contract.
- To process payments through Stripe: performance of a contract.
- To send transactional and account emails (order confirmations, voucher delivery, refunds, service notices): performance of a contract and our legitimate interests.
- To send marketing or product emails: your consent (you can unsubscribe at any time).
- For website analytics: your consent (analytics only load after you accept on our cookie banner).
- For security, fraud prevention and to enforce our terms: our legitimate interests.
- To meet legal obligations such as tax and accounting: legal obligation.
Who we share it with
We use trusted providers to run GiftDesk. Each only processes data as needed to provide its service:
- Stripe: payment processing.
- Supabase: database, authentication and hosting.
- Vercel: application hosting.
- Cloudflare: DNS, content delivery and email routing.
- Resend: sending transactional and lifecycle emails.
- Zoho: business email.
- Google Analytics: website analytics, only with your consent.
We do not sell personal data.
International transfers
Some providers are based outside the UK. Where personal data is transferred internationally, we rely on appropriate safeguards such as UK adequacy regulations or standard contractual clauses.
How long we keep it
We keep account and order data for as long as your account is active and as needed to provide the service, resolve disputes, and meet legal, tax and accounting requirements. We delete or anonymise data once it is no longer needed.
Your rights
Under UK data protection law you have the right to access, correct, delete, restrict or object to the processing of your personal data, to data portability, and to withdraw consent at any time. To exercise any of these, email privacy@giftdesk.co.uk. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.
If you are a buyer or recipient, you can also contact the merchant whose shop you used, as they control their own customer data.
Cookies and analytics
We use essential cookies to run the site and your shop, for example to keep your basket and your session. We only load analytics cookies after you accept them on our cookie banner, and you can change your choice at any time.
Changes
We may update this policy from time to time and will post the new version with an updated date.