Legal
Giftay privacy policy
Giftay knows where you are when you look for somewhere nearby, and it knows which shops you go back to. This explains what happens to both.
Who we are
Neirfeno Limited is the data controller for the personal data described in this policy.
| Who runs Giftay | Neirfeno Limited |
|---|---|
| Company number | SC514019, registered in Scotland |
| Registered office | 7 Thorter Way, Dundee, DD1 3DF |
| Support and data protection | support@giftay.co.uk |
| ICO registration | ZB673603 |
This policy covers the Giftay mobile app on iOS and Android, and this website. Read it alongside our terms and conditions.
Two kinds of user
Giftay has members, who collect stamps and rewards at independent businesses, and businesses, which are listed in our directory and may run those schemes. Information about a limited company or other organisation is not personal data, so this policy is about people: members, and people connected with a business. Some of those people have never used Giftay, for example a sole trader whose business we have listed. The section "People connected with businesses on Giftay" is for them.
Where a business you have visited sees your activity at its own shop, it becomes a controller of that information for its own purposes. What it then does with it is governed by its privacy notice, not this one. We are controller of the Giftay account and the underlying record.
What we collect
Your account
You can look through Giftay without an account. Stamps you collect as a guest stay on that device until you sign in.
On iPhone you sign in with Apple, Google, or an email address and a password. On Android you sign in with Google, or an email address and a password. We receive an account identifier and, normally, your email address and display name. If you use Sign in with Apple and choose to hide your email, we receive Apple's relay address and that is all we ever see of it.
We do not hold your password. Google Firebase Authentication holds the sign-in.
Where you are
Giftay's whole purpose is showing what is near you, so with your permission the app reads your device's location and uses it to sort and filter the shops it shows you, and to place them on a map. The map is Apple's.
- We ask for location only while you are using the app. Giftay does not track you in the background and does not build a history of your movements.
- We use your location to answer the query in front of you. We do not store a log of the positions your device has reported.
- You can refuse, and you can withdraw the permission at any time in your phone's settings. The app still works — you will need to search by area rather than have it find you.
- If you ask for directions, the app can open Apple Maps, Google Maps or Citymapper with that place. The link carries the place, not a log of where you have been.
Your stamps and rewards
When you collect a stamp, redeem a reward or take part in a scheme, we record which business it was, when, and what happened. This builds a record of which independent shops you use and how often.
Scanning a code with the camera happens on your device. The camera image is not sent to us or stored — only the result of the scan is.
People connected with businesses on Giftay
A listing can identify a person, for example a sole trader trading under their own name, or a phone number, email address or social media account that belongs to one person. When it does, that information is personal data and this section applies, whether or not that person has ever used Giftay.
Listings we create. Most listings are created by our own staff, not by the business. We add them by walking the streets ourselves. We use Dundee City Council's published business rates address list only as a checklist of addresses, and we do not copy the names of ratepayers. On visits, our staff note opening times and the business's contact details and social media accounts. A listing can hold the business's name, category, area, listing type, opening hours, address and map pin (home businesses are different, see below), and contact details: phone, email, website, Instagram, Facebook, TikTok and X. Contact details added by our staff or by the business's owner are shown on the listing straight away. Listings are public in the Giftay app and on giftay.co.uk, and search engines can index the giftay.co.uk pages.
Home, by-appointment, mobile and online businesses. Giftay will not store a street address for the home of a home business. The listing shows its area instead. If a home business also trades somewhere else, such as a market or pop-up, that address is shown. Mobile traders' listings show each pitch with its address and times. By-appointment and online businesses show an address only if one has been added.
Claiming a listing. To claim a listing you sign in to Giftay. If the claim creates a new business on Giftay, we ask for the business's legal name, and that becomes the business's name on Giftay. It is not shown on the public listing page, but the Giftay app can retrieve it. If the listing has contact details, you choose one of them to confirm the claim, and we record which one you chose. If it has none, a member of our staff reviews the claim and can see your account email address, the listing and its contact details. If we gave you a claim card, its code confirms the claim. We keep a record of each claim: who made it, when, and what happened.
Running a business on Giftay. Everyone who manages a business has their own Giftay account (see "Your account"). We record each person's role (owner or staff), who invited them, when they joined and when their access ended. A staff invitation holds the email address the owner entered until it is accepted. Owners can edit the listing and add contact details, which go live straight away. Owners of businesses that take part fully can upload a logo and a header image, which are public. When a sale is recorded at the till or through a visit link, we record the business, place, amount and stamps. We do not record which member of staff entered it. Business API keys record who created them.
Asking us to remove or change a listing. An owner can ask for a listing to be removed from the business console. A member of our staff decides. Anyone else, including a person named or contactable on a listing they have not claimed, can email support@giftay.co.uk to object to the listing, or to ask us to correct it or remove information about them. Today we can correct the listing's name, remove contact details our staff added, and close the listing. Closing it takes it out of the app's list and search. A closed listing's own web page stays reachable at its address, marked closed, until we remove it.
Contact details we remove are kept as a record, because they show where a claim was confirmed. They are no longer shown.
When you contact us
If you email support@giftay.co.uk we hold your address, what you wrote, and anything you include.
Why we use it, and our legal basis
| What we do | Data | Legal basis |
|---|---|---|
| Run your account | Account | Performance of a contract |
| Show you what is nearby and put it on a map | Location | Consent, given through your device's permission prompt |
| Record your stamps and let you redeem rewards | Stamp and reward activity | Performance of a contract |
| Run a public directory of independent businesses, including listings nobody has claimed, and show people how to reach them | Listing details that identify a person; contact details and social accounts on a listing | Legitimate interests: helping people find and contact independent businesses near them, and letting a business find and claim its listing. If this is about you, you can object at any time (see "Asking us to remove or change a listing"). |
| Handle a claim to a listing | Your account, the legal name you give, the contact detail you choose, the claim record | Taking steps you ask for before we agree terms with you, where you are a sole trader or partner. Legitimate interests, ours and the business's, in confirming who runs a listing, where you claim for a company. |
| Give the right people access to a business's account | Owner and staff accounts, roles, invitations (including the invitee's email) | Performance of our contract with you, where you are the sole trader or partner who owns it. Legitimate interests, ours and the business's, in controlling who can act for it, for staff and for people at a company. |
| Show a business's logo and header image | The images | As for access, above. |
| Keep records of claims, removal requests, removed contact details and staff decisions | Those records | Legitimate interests in showing who held a listing, and in settling disputes. Legal claims. |
| Give a business the record of activity at its own shop | Stamp activity at that shop | Performance of a contract, and our legitimate interest in operating a loyalty scheme that works for both sides |
| Keep the service secure and prevent fraudulent stamping | Account, activity, technical | Legitimate interests — protecting the service, its members and the businesses on it |
| Answer your support email | Your correspondence | Legitimate interests |
| Meet legal obligations and defend legal claims | Whatever is relevant | Legal obligation, and legitimate interests |
Your device and your consent
Location and the camera are the permissions Giftay asks for. You can refuse either one. You can turn either off later in your phone's settings. The app still works.
We do not use Giftay to serve you third-party advertising.
Who else sees it
We do not sell personal data and we do not share it for anyone else's marketing.
Businesses on Giftay
A business whose scheme you take part in sees your activity at its own shop — that you collected a stamp, when, and what you redeemed — together with the name on your account. It does not see your activity anywhere else, your location, or your email address unless you give it to them.
Service providers
| Provider | What they do for us |
|---|---|
| Google (Firebase Authentication) | Sign-in with Apple, Google, or email |
| Google Fonts | The type on this website. Opening a page sends that request to Google. |
| Google Workspace | Our support mailbox |
Apple and Google act as controllers in their own right for the sign-in you choose, under their own policies.
Otherwise we disclose only where legally required — a court order, or a lawful request from a regulator or law enforcement — or to professional advisers under a duty of confidence, or to a buyer if the business is sold, in which case we would tell you first.
Where it is kept
Your account, your stamp record and business listings are stored in the United Kingdom and the European Economic Area.
The sign-in record is with Google Firebase Authentication, and with Apple if you use Sign in with Apple. This website loads its type from Google Fonts.
How long we keep it
| Data | Kept for |
|---|---|
| Your account | While it is open. Deleted within 30 days of you asking — see deleting your account. |
| Stamp and reward activity | While your account is open, so you keep progress towards a reward. Deleted with the account. |
| Listings, including ones nobody has claimed | While the listing is on Giftay. We do not yet delete closed listings automatically. |
| Contact details removed from a listing | Kept as a record of where a claim was confirmed. Not shown. |
| Claim records, including the legal name given | Kept. The legal name stays as the business's name while the business is on Giftay. |
| Owner and staff access records | While access lasts. The record that access existed is kept after it ends. |
| Staff invitations, including the email address | Kept after they expire or are accepted. |
| Logos and header images | While set. Images that have been replaced are not yet deleted from storage. |
| Support correspondence | 24 months from the last message. |
| Encrypted backups | Deleted data persists in backups for up to 90 days before being overwritten. |
We do not keep a log of the locations your device reported, so there is nothing to retain.
Your rights
UK data protection law gives you rights over the personal data we hold about you. They are not all absolute: some apply only in particular circumstances, and some are limited where we have to keep data to meet a legal obligation or to establish, exercise or defend a legal claim.
| Right | What it means |
|---|---|
| Access | Ask for a copy of the personal data we hold about you, and for an explanation of how and why we use it. |
| Rectification | Have inaccurate data corrected, and incomplete data completed. |
| Erasure | Ask us to delete your data — for example where we no longer need it, where you withdraw consent we were relying on, or where you object and we have no overriding grounds to continue. |
| Restriction | Ask us to stop using your data, while keeping it, when you are contesting its accuracy or our grounds for holding it. |
| Objection | Object to processing we carry out on the basis of our legitimate interests. Where we process for direct marketing, your objection is absolute and we must stop. |
| Portability | Receive the data you gave us in a structured, commonly used, machine-readable format, and have it transmitted to another provider where that is technically feasible. |
| Withdraw consent | Withdraw consent at any time where consent is the basis we rely on. This does not affect the lawfulness of processing carried out before you withdrew it. |
| Automated decisions | Not be subject to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you. |
To exercise any of these, email support@giftay.co.uk. We may need to confirm your identity before we act, so that we do not disclose your data to somebody else. We respond within one month. We can extend that by a further two months where a request is complex or where you have made several — if we need to, we will tell you within the first month and explain why. There is no charge, unless a request is manifestly unfounded or excessive.
If you are unhappy with how we have handled your data or your request, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, by telephone on 0303 123 1113, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. We would rather you came to us first so we have a chance to put it right, but you do not have to.
A note on erasure: deleting your account removes your stamp record, which means losing progress towards any reward you had not yet claimed. We will say so before we do it, so you can redeem first if you want to.
Security
Data is encrypted in transit and at rest. Our database rules restrict each member to their own records and each business to its own, while shop listings are deliberately public. Access to production systems is restricted.
No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will report it to the ICO within 72 hours of becoming aware of it, and tell you directly if the risk to you is high.
Children
Giftay is not intended for under-16s and we do not knowingly collect their data. If you believe a child has given us personal data, email support@giftay.co.uk and we will delete it.
Automated decision-making
Giftay ranks shops by distance and by activity at the place, such as stamps collected and scans at the till. That is a list put in front of you, not a decision made about you. We do not carry out solely automated decision-making that produces legal effects concerning you or similarly significantly affects you.
Changes to this policy
When we change this policy we publish it with a new version date. Where a change materially affects how we use your data we will tell you in the app or by email before it takes effect, and where a change needs consent we will ask rather than assume.
Contact us
Email support@giftay.co.uk or write to Neirfeno Limited, 7 Thorter Way, Dundee, DD1 3DF.