Privacy and cookies.
Last updated
Givoo is operated by Givoo Ltd, a company registered in England and Wales. We provide a human-centric, people-powered gift recommendation platform. This Privacy Policy explains how we collect, use, disclose, and protect your personal data when you use our website, whether you are a registered account holder or a casual browser searching for gift ideas.
We are committed to protecting your privacy. We process all personal data strictly in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).
1. Important information and who we are
Givoo Ltd is the data controller responsible for your personal data. If you have any questions about this Privacy Policy or wish to exercise your legal rights, you can contact us using the details below:
- Full corporate name: Givoo Limited
- Email address: privacy@givoo.co.uk
- Registered address: 124 City Road, London EC1V 2NX
- Company registration number: 17354319
2. The data we collect about you
Personal data means any information about an individual from which that person can be identified. We collect, use, and store different kinds of personal data about you, which we have grouped together as follows:
- Identity data: the name you choose to give us when you create an account. It is optional.
- Contact data: your email address.
- Account data: your sign-in credentials. We store a hash of your password, never the password itself. If you sign in with Google, we receive your name and email address from Google (see section 4).
- Profile data: the details you choose to share to help us learn your tastes, such as your age range, gender, interests, values, personality traits, lifestyle preferences and life stage.
- Gift data: the specific gifts you list as items you have loved, received or want.
- Recipient data: the information you provide about the people you are buying for: their name, their relationship to you, their age range, interests, lifestyle and personality traits, and any occasions and dates you save for them. This data is used solely to generate gift inspiration and reminders you have asked for, and is not used to build a profile of that person for any other purpose.
- Consent data: when you make a choice on our cookie banner or a consent control, we record what you chose, when, and the version of this policy you were shown, together with a salted, irreversible hash of your IP address and your browser's user-agent string. This is kept so we can evidence your decision. We do not keep your IP address itself.
- Technical data: browser type and version, operating system and the pages you request. Our hosting providers record the IP address of each request in their access logs (see section 7).
Special category data
One of the life-stage options you can choose is expecting a baby, and another is recently had a baby. Information about pregnancy is health data, which UK GDPR treats as special category data. We only record it if you actively choose that option, and we ask for your explicit consent to do so at the point you choose it. You can withdraw that consent at any time by editing your profile or by contacting us, and we will remove the data. We do not infer health information from anything else you tell us.
3. How we use your personal data and lawful bases
We will only use your personal data when the law allows us to. We have mapped our processing operations to their legal bases below:
| Purpose / activity | Type of data | Lawful basis |
|---|---|---|
| Account creation and service delivery: to register your account and manage our relationship with you. | Identity, Contact, Account | Performance of a contract: necessary to deliver the account features you request. |
| Recommendation engine: to provide, maintain, and improve our gift recommendations, so that the suggestions you receive are relevant to the preferences you provide. | Profile, Gift, Recipient | Performance of a contract / legitimate interests: necessary to run the core functionality of the platform. |
| Service emails: to verify your email address, let you reset a forgotten password, and send you reminders about occasions you have saved and asked to be reminded of. | Contact, Recipient | Performance of a contract: these are emails the service needs to send, or that you have asked for. They are not marketing and you do not need to opt in to receive them. |
| Direct marketing: to send you our newsletter and product recommendations by email. | Identity, Contact | Consent: only if you actively opt in. You can unsubscribe at any time via the link in any email, or from your account. |
| Product analytics: to understand how the platform is used and improve it. | Technical | Consent: only if you accept analytics on our cookie banner. No analytics tooling loads until you do. |
| Affiliate links: to record that a click on a retailer link came from Givoo, so that we may earn a commission if you buy. | Technical | Consent: only if you accept affiliate tracking on our cookie banner. If you decline, links go to the retailer unchanged. |
| Aggregate insights: to include your contributions in anonymised, aggregated statistics about what different kinds of people love, which may be shared outside Givoo. Your name, email and account are never part of this. | Profile, Gift | Consent: only if you opt in. |
| Special category data: to record a pregnancy-related life stage you have chosen. | Profile | Explicit consent (see section 2). |
| Security and technical maintenance: to protect our website from abuse, rate-limit requests, and debug errors. | Technical, Consent | Legitimate interests: necessary to keep our platform secure and operational. |
4. Signing in with Google
If you choose to sign in with Google, Google sends us your email address and name so we can create or find your account. We do not receive your Google password and we cannot see anything else in your Google account. Google's own privacy policy governs what Google does with the fact that you signed in.
5. Recipient data and your responsibility
Our recommendation engine relies on you entering descriptive traits of real people, such as your relatives or friends.
When you enter attributes, interests or demographics about someone else, you warrant to Givoo Ltd that you have the necessary relationship, right, or authorisation to give us that information. We process it purely to generate recommendations and reminders at your request, and we do not use it to contact or profile that person.
6. How long we keep your data
We only keep your personal data for as long as necessary to fulfil the purposes we collected it for.
- Registered accounts: we keep your account and the profile, gifts, people and occasions attached to it for as long as your account is active. If you want your account deleted, email privacy@givoo.co.uk and we will delete it, together with your name, email address, credentials and consent records. The gift ideas you contributed remain in Givoo's shared gift library, but with nothing that links them to you.
- Anonymous visitors: if you build a profile without creating an account, it is tied to a session cookie that lasts 30 days from your last visit. Around a week after that expires, the session and the profile attached to it are deleted automatically. As with accounts, gift ideas you contributed stay in the shared library without any link to you.
- Gift searches: the details you enter about a recipient to run a search are not stored unless you are signed in and choose to save that person or that search.
- Consent records: kept for as long as your account or session exists, so that we can show what you agreed to.
- IP addresses: we do not store them. Our hosting providers keep them in access logs for a limited period under their own retention policies.
7. Who we share your data with, and international transfers
We do not sell your personal data. We share it only with the service providers we need in order to run Givoo:
- Vercel (website hosting)
- Railway (application servers and database)
- Sentry (error monitoring: when something goes wrong on our servers, the error and the request that caused it are recorded so we can fix it)
- Resend (sending service emails)
- Google (sign-in, only if you use it)
- PostHog (product analytics, only if you consent)
Givoo Ltd is based in the United Kingdom and our platform is optimised for the UK market. Some of these providers are based in, or may store data in, the United States or other regions outside the UK. Where that happens, the transfer is covered by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or by a UK adequacy decision.
8. Cookies
We use a small number of cookies. Two are strictly necessary and are set without asking; the rest are set only if you consent.
| Cookie | Purpose | Lifetime | Requires consent? |
|---|---|---|---|
| Session cookie | Keeps you signed in, or keeps an anonymous profile attached to your browser while you build it. | 30 days from last visit | No — strictly necessary |
| CSRF token | Protects forms and actions from being triggered by other websites. | Same as session | No — strictly necessary |
| Analytics cookies (PostHog) | Understand how the site is used. | Up to 1 year | Yes |
You can change your choices at any time from the cookie settings link in the footer. Declining non-essential cookies does not limit what you can do on Givoo.
9. Your legal rights
Under UK data protection law you have the right to access your data, to have it corrected, to have it erased, to restrict or object to how we process it, to receive it in a portable format, and to withdraw any consent you have given. To exercise any of these rights, email privacy@givoo.co.uk. We will respond within one month.
10. Changes to this policy
We may update this policy to reflect operational or legal changes. Updates are published on this page with a revised date at the top. If a change materially affects how we use data you have consented to, we will ask for your consent again rather than rely on the earlier one.
11. Complaints
You have the right to complain at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues, at ico.org.uk. We would appreciate the chance to deal with your concerns before you approach the ICO, so please contact us first at privacy@givoo.co.uk.