Privacy Policy

OVERVIEW

Scope

This Privacy Policy describes the personal data Giftpack collects, the sources from which we collect it, how we use it, when we share it, and the rights and choices individuals may have under applicable law.

INFORMATION WE COLLECT

Categories of Personal Data

Depending on the nature of your relationship with Giftpack, we may collect and process the following categories of personal data:

• Contact and profile information: name, work email, phone number, job title, company name, account credentials, and other profile details.
• Account and business information: workspace, billing, subscription, plan, or account administration information associated with a customer organization.
• Recipient information: recipient names, contact details, addresses, gift messages, redemption details, and related campaign or order data provided in connection with incentive or gifting workflows.
• Transaction and order information: order details, fulfillment information, delivery data, payment-related metadata, and records associated with purchases, redemptions, or campaign execution.
• Communications and support data: messages, requests, survey responses, meeting details, and other information shared in communications with Giftpack.
• Device, log, and usage information: IP address, browser type, operating system, device identifiers, timestamps, log data, and information about how users interact with the website or platform.
• Compliance and verification information: business verification, fraud screening, sanctions screening, identity or payment-risk information, where appropriate and reasonably necessary.

Sources of Personal Data

Giftpack may collect personal data:

• directly from users, customers, or website visitors;
• from customer administrators and authorized users;
• from customers who provide recipient or campaign data;
• from recipients who interact with redemption, delivery, or communications workflows;
• from service providers, integrations, analytics providers, and other business partners; and
• from publicly available or commercially available sources where permitted by law.

HOW WE USE PERSONAL DATA

Purposes of Processing

Giftpack may use personal data for the following purposes:

• account setup, workspace administration, authentication, and access management;
• providing the website, platform, and related services;
• processing orders, redemptions, sourcing requests, and fulfillment workflows;
• supporting recipient engagement, delivery coordination, and customer campaign execution;
• customer support, communications, and responding to inquiries;
• billing, payment support, and transaction administration;
• security, monitoring, fraud prevention, abuse prevention, and platform integrity;
• compliance with legal, regulatory, contractual, and tax obligations;
• analytics, service performance measurement, troubleshooting, and product improvement; and
• sending service-related updates and, where permitted by law, marketing or promotional communications.

We aim to process personal data in a manner that is relevant, proportionate, and appropriate for the purposes described in this Privacy Policy.

DATA PROTECTION ROLES

Controller and Processor Context

Giftpack processes personal data in different roles depending on the context.

• When customers provide personal data for Giftpack to handle on their behalf in connection with campaigns, recipient workflows, or other customer-managed activities, customers may act as controllers or businesses, and Giftpack may act as a processor, service provider, or similar role where applicable.
• Giftpack may also process personal data as an independent controller or business for its own legitimate operational purposes, including security, fraud prevention, analytics, service improvement, legal compliance, account management, and internal business operations.

This Privacy Policy is a public notice and does not replace any more specific data processing terms that may apply under a separate agreement.

HOW WE SHARE PERSONAL DATA

Service Providers and Subprocessors

Giftpack may share personal data with service providers and subprocessors that support the delivery and operation of our services, including providers of:

• hosting and cloud infrastructure;
• data storage and backup;
• communications and email delivery;
• analytics and service performance tools;
• payment processing and billing support;
• customer support systems;
• sourcing, logistics coordination, and fulfillment support; and
• security, fraud prevention, and compliance support.

These parties are authorized to access personal data only as needed to provide services to Giftpack and are generally subject to contractual confidentiality, security, and data protection obligations.

Giftpack may also disclose personal data:

• within its corporate group where reasonably necessary for internal operations;
• in connection with a merger, acquisition, financing, restructuring, or sale of assets, subject to appropriate safeguards where applicable; and
• where required to comply with law, regulation, legal process, or to protect the rights, safety, and security of Giftpack, its customers, users, or others.

Information about certain service providers or subprocessors may be made available upon request or through additional trust documentation, where appropriate.

INTERNATIONAL DATA TRANSFERS

Cross-Border Processing

Giftpack may process personal data in the United States and in other jurisdictions where Giftpack or its service providers operate, including through Google Cloud Platform infrastructure in Tokyo for disaster recovery purposes. Where required by applicable law, Giftpack implements appropriate safeguards for international data transfers.

VERIFICATION AND PLATFORM INTEGRITY

KYC and Due Diligence

Giftpack may conduct verification, due diligence, or screening activities where appropriate for fraud prevention, legal compliance, sanctions screening, payment risk management, business verification, or platform integrity. Such activities are designed to be limited to what is reasonably necessary for the relevant purpose.

COOKIES AND TRACKING

Cookies and Similar Technologies

Giftpack uses cookies and similar technologies to operate the website and platform, remember preferences, understand usage, and improve performance. For more information, please review Giftpack's Cookie Policy.

RIGHTS AND CHOICES

Data Subject Rights

Depending on your location and the applicable law, you may have rights to:

• access personal data we hold about you;
• request correction of inaccurate or incomplete data;
• request deletion of personal data in certain circumstances;
• request restriction of processing or object to certain processing;
• request portability of personal data where applicable;
• manage communication preferences, including marketing opt-outs; and
• exercise region-specific rights available under laws such as the GDPR and CCPA, where applicable.

Giftpack may need to verify your identity before responding to a request. Some rights may be limited by legal, contractual, technical, or operational requirements.

To submit a privacy request, contact privacy@giftpack.ai.

RETENTION

Data Retention

Giftpack retains personal data for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide services, maintain business records, resolve disputes, enforce agreements, and comply with legal, regulatory, tax, accounting, or security obligations.

Retention periods may vary depending on the type of data, the customer relationship, the service context, and applicable legal requirements. Where appropriate, personal data may be deleted, aggregated, or anonymized when no longer needed.

SECURITY

Security Measures

Giftpack maintains administrative, technical, and organizational measures designed to protect personal data. These measures support platform security, confidentiality, integrity, and responsible data handling. Additional information is available on the Giftpack Security page.

CHILDREN

Children's Data

Giftpack's website and services are not directed to children, and Giftpack does not knowingly collect personal data from children except where this may arise in a customer-managed gifting or recipient context and is permitted by applicable law and customer instructions.

CONTACT US

Privacy Contact Information

If you have questions about this Privacy Policy or Giftpack's privacy practices, please contact:

• Email: privacy@giftpack.ai

If you are located in a jurisdiction that provides a right to complain to a supervisory authority or regulator, you may also contact the relevant authority in accordance with applicable law.