Your information, handled properly.

1. Who is responsible for your information

Here’s A Gift is the trading name of Kayleigh Waterman, sole trader. We are the controller responsible for the personal information covered by this policy.

For privacy questions, requests or complaints, contact hello@heresagift.co.uk, call 07450 314 46 or write to the address above.

2. The information we use and where it comes from

We receive contact, account, billing and delivery information when you create an account, place an order or contact us. This may include your name, email address, telephone number, address, account identifier and order history.

We receive the personalisation you provide, such as names, dates, messages, family relationships and photographs, together with the product choices and artwork needed to produce your order. This can include information about gift recipients and children, provided by the person ordering rather than by those individuals directly.

We receive transaction references, payment status, refund information and limited payment information from Stripe. Payment card information is handled through Stripe’s payment facilities. Please do not send card details to our support email.

Our website and service providers may generate technical information such as IP address, browser type and security events, together with necessary account or checkout identifiers. This website no longer loads Google Analytics or sends site analytics events. Visitors who previously accepted analytics may have historical visit and purchase measurements retained by Google; see the previous analytics use below.

We also receive correspondence and evidence you provide about a query or problem, and delivery status from our fulfilment and delivery providers. We collect only information relevant to these purposes.

3. Why we use information and our lawful bases

Orders and customer accounts

We use your contact details, account information, chosen personalisation and transaction information to take steps you request before an order and to perform our contract with you. This includes producing, taking payment for and delivering products, order updates and dealing with returns.

Gift recipients and other people shown in a design

Where those people are not parties to our contract, our basis is our legitimate interest in making and delivering the gift requested by the purchaser, balanced against their rights and reasonable expectations. We limit use to what is needed for that purpose and associated support.

Security and ordinary customer support

Our basis is our legitimate interest in operating a reliable service, answering enquiries, preventing misuse, protecting accounts and investigating problems. Where a specific legal duty applies, we rely on that legal obligation instead.

Accounting and legal responsibilities

We use necessary records to meet our tax, accounting and other legal obligations. Where necessary to establish, exercise or defend a legal claim, we rely on our legitimate interest in protecting legal rights.

Information needed to take payment, deliver an order and create your chosen personalisation is necessary for the contract. Without it, we may not be able to complete the order.

4. Information about other people and children

Only provide personalisation information that you are entitled to use. Where appropriate, tell the person that you have supplied their details and direct them to this policy. For a child’s photograph or personal information, make sure you have authority from a parent or guardian where needed.

Our shop is intended for adults buying gifts. The designs adults request may contain children’s information. We use that information to make the requested product and provide related support, not to build marketing profiles of children.

Please do not put unnecessary sensitive information into personalisation fields, such as health details or identity document numbers. If an order genuinely requires information subject to extra legal protection, we will assess the request and obtain any additional permission or other legal basis required before processing it.

5. Who receives information

We share information only as necessary for the purposes described here. Stripe handles payments, refunds and related fraud prevention. Supabase supports customer authentication, our database and associated storage. Inkthreadable receives the artwork, product details and delivery information needed to produce and fulfil your order. Delivery companies receive what they need to deliver it.

Our website hosting, email delivery and technical support providers may process the information needed to operate those services. Professional advisers, accountants, insurers or public authorities may receive necessary information where appropriate for advice, a legal obligation or a claim.

Providers working on our instructions are subject to appropriate data processing arrangements. Some providers, including payment providers, also use information as independent controllers for their own legal, security and operational responsibilities. Their own privacy notices explain those activities.

We do not sell your personal information. We do not publish your uploaded photographs or personalisation in advertising without separate permission. We do not use customer artwork to train generative AI models as part of this service.

Previous Google Analytics use

Google Analytics was previously available only after a visitor accepted it. It measured visits, product interest and purchases using technical browser/device information, page paths, referring website domains and purchase measurements, including a random transaction reference, product identifier and amount. It was not intended to receive customer names, email addresses, delivery addresses, photographs, personalised wording, URL queries or sign-in tokens. The website no longer loads Google Analytics or sends new events. Historical data may remain subject to Google’s retention settings; contact us to ask about its status or exercise your data rights. See Google’s Privacy Policy.

6. International processing

Some providers may process information outside the UK. Provider locations and transfer arrangements can change. Where a restricted international transfer takes place, we use an applicable UK adequacy arrangement or appropriate contractual safeguards required by data protection law. Contact hello@heresagift.co.uk if you want information about the safeguards relevant to a particular provider.

7. How long we keep information

We keep information only for as long as it is needed for the purpose collected, a legal obligation, an unresolved dispute or a necessary legal claim. Our normal operating targets are:

• Order and financial records, 6 years after the end of the relevant financial year.
• Uploaded photographs, personalisation files and production artwork, 6 months after delivery or resolution of the relevant issue.
• Account information, while the account is active, with inactive accounts reviewed after 24 months.
• Customer support and complaint records, 24 months after the matter is closed.
• Backups and security logs, for the period needed for security and recovery, subject to the settings of the relevant provider.

These periods may be extended where necessary for a legal obligation, dispute or claim. We restrict any retained information to that purpose. We keep a minimal suppression record where necessary to respect a request not to receive marketing.

8. Security

We use technical and organisational measures appropriate to the information and risks involved. Access is limited to people and providers who need it for their work. Please protect your account login and tell us promptly about suspected unauthorised access.

No online service can promise complete security. We will assess any personal data breach and make the notifications required by law. Contact us privately about a security concern rather than posting personal information publicly.

9. Marketing and cookies

We do not currently send promotional emails or use optional analytics or advertising cookies. Necessary cookies and browser storage support sign in, guest checkout, security and retaining your current checkout draft. See our Cookie Policy for the current inventory.

Order confirmations, delivery updates and responses to an enquiry are service messages, not marketing permission.

10. Your rights

Depending on the circumstances, you can ask to access your information, correct it, erase it, restrict its use or receive certain information in a portable form. You can withdraw consent at any time without affecting processing that was lawful before withdrawal.

You have an absolute right to object to direct marketing. You can also object to processing based on our legitimate interests, including the use of a recipient’s information in an order. We will consider that objection and stop unless we have a valid legal reason to continue.

Contact hello@heresagift.co.uk or use the other contact details above. We may need proportionate information to verify identity. We normally respond to rights requests within one month. If the law allows more time or another qualification applies, we will explain this. We do not normally charge a fee.

11. Automated processing

Our website uses automated tools to process orders and generate the design you request. Payment and security providers may use automated checks that affect whether a payment succeeds.

We do not currently make decisions solely by automated processing that have legal or similarly significant effects on you. Contact us if you believe a payment or order has been rejected incorrectly so we can review the position and explain the available options.

12. Privacy complaints

You can raise a privacy complaint by email, telephone or post using the details in section 1. Tell us what happened and how you would like it resolved. No special form is required.

We will acknowledge your complaint within 30 days, investigate it without undue delay, keep you informed and communicate the outcome and any action taken.

You can also complain to the Information Commissioner’s Office. The ICO can be contacted on 0303 123 1113 or at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. You do not lose that right by contacting us first.

13. Changes to this policy

We will update this policy when our practices or legal requirements change and show the current date above. We will give additional notice or seek new consent where required. A policy change does not retrospectively provide permission for a new use of your information.