Privacy Policy

1. Who we are

This Privacy Policy explains how Giftogy Creatives Pvt. Ltd. (“Giftogy”, “we”, “us”, “our”), trading as Giftogy, which operates the website giftogy.com and related sales channels, collects, uses, shares, and protects your personal information.

• Legal/trading name: Giftogy Creatives Pvt. Ltd. (trading as Giftogy)
• Registered/business address: Sarla Appt, Sharanpur Road, Nashik, India 422002
• Country of establishment: India
• Contact for privacy matters: info@giftogy.com

For customers in the European Economic Area (EEA) and the United Kingdom, Giftogy is the data controller of your personal information for the purposes described below, and our representatives are named in Section 15.

2. Scope

This policy applies to personal information we collect through giftogy.com and Giftogy-branded checkout pages; when you place an order, upload photos, or request a design preview; when you contact us, leave a review, or subscribe to marketing; and through our social media profiles and advertising. We ship worldwide, so this policy is written to cover customers in many countries. It does not apply to third-party websites we link to, which have their own policies.

3. The information we collect

3.1 Information you give us

• Identity & contact data: name, email address, phone number, billing and shipping addresses.
• Order data: items ordered, size/options, order value, order history, and the personalisation details you provide.
• Photos and images you upload (the “Uploaded Content”): the photographs you submit so we can create your personalised artwork, and any notes or instructions you attach. Photographs may show you and other identifiable individuals, children, or pets. See Section 4.
• Account data (if you create an account): username and password (stored in hashed form by our platform).
• Communications: messages, emails, chat, support requests, and your design-approval feedback and revision requests.
• Reviews and user-generated content: ratings, review text, and any photos you choose to submit with a review.
• Marketing preferences: your consent and opt-in/opt-out choices.

3.2 Information we collect automatically

• Device & technical data: IP address, browser type, device identifiers, operating system, and time-zone.
• Usage data: pages and products viewed, referral source, clicks, and interactions on giftogy.com.
• Cookies and similar technologies: see Section 7 and our Cookie Policy.

3.3 Information we receive from third parties

• Payment processors confirm your payment status (we do not receive or store full card numbers — see Section 6).
• Shipping and fulfilment partners provide delivery status and tracking.
• Fraud-prevention services may provide risk signals to help us protect against fraudulent orders.

Payment card details: We do not store your full payment card number. Payments are handled by our PCI-DSS-compliant payment provider (Section 6), which processes card data directly.

4. Your photos and personalised content — our commitment

Personalised artwork is the heart of Giftogy, so we treat the photographs you upload (“Uploaded Content”) with particular care.

4.1 We use your photos only to make your order.

We use your Uploaded Content solely to: assess whether it is suitable; create a design preview for your approval; manufacture your keepsake after you approve it; provide support and handle revisions; and keep a record of what was produced for order, refund, and dispute purposes. Our legal basis for this is the performance of our contract with you — fulfilling the order you placed. This processing is a necessary part of providing the product you asked for; it is not based on consent, so it cannot be withdrawn midway in a way that would prevent us completing an order you have placed (you can still exercise your other rights — see Section 11).

4.2 We never publish or display your photos.

Your Uploaded Content is private. We do not post, publish, display, or share your photographs publicly, and we do not use them in our marketing, advertising, website, or social media. They are accessed only by the members of our design and production team, and the limited service providers, needed to fulfil your order (see Section 6).

4.3 We do not use facial recognition or biometric identification.

We do not use your photographs to identify individuals, and we do not create, collect, or store biometric identifiers or biometric information (such as faceprints or face geometry) within the meaning of laws such as the Illinois Biometric Information Privacy Act (BIPA) or comparable laws. Our artists create an artistic, stylised rendering of your photo; we do not perform biometric matching.

4.4 We do not process your photos to reveal sensitive characteristics.

A photograph can incidentally show information that some laws treat as sensitive or “special category” (for example, apparent ethnicity or religious dress). We do not analyse, infer, or record such characteristics; we use your photo only to create the stylised artwork you ordered. Because we do not process your photos to reveal special-category data and do not perform biometric identification, we do not treat this as special-category or sensitive-data processing.

4.5 Your responsibility for the people in your photos.

You may upload photos that show other people, including children. Because those individuals have no direct relationship with us, you are responsible for having the right to use each photograph and the consent of everyone shown in it. Before you upload, we ask you to confirm, via a required checkbox, that: (a) you have the right to use the photograph(s); (b) you have the consent of every identifiable person shown; and (c) for any child, you are their parent or legal guardian, or have that person's consent. These confirmations, and the promises behind them, are set out and enforced in our Terms & Conditions. Please do not upload a photograph if you cannot give this confirmation.

4.6 How long we keep your photos.

We keep your Uploaded Content only as long as needed to create your order and to handle any approval, revision, re-order, refund, or dispute — normally 45 days after your order is delivered — after which we securely delete or anonymise it, unless a longer period is genuinely required by law. (This is separate from order and transaction records, which we retain to meet tax and company-law obligations — see Section 9.) You may ask us to delete your photos sooner (Section 11).

5. How we use your information, and our legal bases

Where the EU/UK GDPR applies, we rely on the following legal bases:

Where we rely on consent, you can withdraw it at any time (this will not affect processing already carried out). Where we rely on legitimate interests, you can object (see Section 11).

6. Sharing your information

We share personal information only as needed to run our business, with categories of recipients such as:

• E-commerce & hosting platform: Shopify — hosts our store, checkout, and order data.
• Payment processor: Shopify Payments (and any additional payment methods we enable, such as PayPal) — process payments securely.
• Shipping & logistics: India Post and its partner carriers — deliver your order and provide tracking.
• Communications & reviews tools we use within Shopify (for order emails and any reviews feature) — to contact you and display reviews you choose to leave.
• Analytics: Shopify's built-in analytics (and any analytics tools we add later) — to measure site performance.
• Professional advisers and legal/government authorities where required by law, and in connection with a business sale, merger, or restructuring.

We require these providers to protect your information and use it only for the services they provide to us. We never share your Uploaded Content (your photos) for advertising, marketing, or any purpose other than fulfilling your order (see Section 4.2).

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We do not currently run third-party advertising pixels. If this changes in future, we will update this policy and provide any opt-out required by law (see Section 11.2).

7. Cookies and tracking technologies

We and our providers use cookies and similar technologies to run the site, remember your cart and preferences, and measure traffic.

• Strictly necessary cookies keep the site and checkout working.
• Analytics cookies are used only where permitted — in the EEA/UK, only after you consent via our cookie banner.

You can manage your choices through our cookie banner and your browser settings. See our separate Cookie Policy for the full list.

8. International transfers of your information

We operate from India and ship worldwide, so your information will be transferred to and processed in India and in the countries of our service providers, which may be outside your home country, including outside the EEA and UK.

Where we transfer personal information out of the EEA or UK to a country without an “adequacy” decision (which includes India), we use a lawful transfer mechanism — principally the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, with additional safeguards where needed. You can request more information using the contact details in Section 15.

9. How long we keep your information

We keep personal information only as long as necessary for the purposes we collected it:

• Order and transaction records: for the period required by Indian tax and company law (generally 6–8 years).
• Uploaded photos/artwork files: as described in Section 4.6 (normally 45 days after order delivery).
• Account data: while your account is active, then deleted or anonymised after a period of inactivity.
• Marketing data: until you unsubscribe or withdraw consent.

When information is no longer needed, we securely delete or anonymise it.

10. How we protect your information

We use appropriate technical and organisational measures to protect personal information, including encryption in transit (HTTPS/TLS), access controls that limit who on our team can view your photos and order details, and reliance on reputable, security-audited platforms and payment processors. No method of transmission or storage is 100% secure, but we work to protect your information and to notify you and regulators of any breach where the law requires.

11. Your privacy rights

Your rights depend on where you live. We honour requests as required by applicable law and will not discriminate against you for exercising them.

11.1 EEA & UK (GDPR / UK GDPR)

You have the right to: access your data; rectify inaccurate data; erase data; restrict or object to processing; data portability; and withdraw consent at any time. You may also lodge a complaint with your data protection authority (in the UK, the ICO; in the EEA, your national supervisory authority). You can contact our EU/UK representatives (Section 15).

11.2 California (CCPA/CPRA) and other US states

If you are a California resident, you have the right to know/access, delete, and correct your personal information, to opt out of the “sale” or “sharing” of personal information, and to limit the use of sensitive personal information. As stated in Section 6, we do not sell or share your personal information, so there is currently nothing to opt out of; if that changes, we will provide the required opt-out. We will not discriminate against you for exercising your rights. Residents of other US states with privacy laws (e.g., Virginia, Colorado, Connecticut, Texas, Oregon) have similar rights, which we honour where they apply.

11.3 Canada (PIPEDA)

You have the right to access and correct your personal information and to withdraw consent, subject to legal and contractual limits. You may also contact the Office of the Privacy Commissioner of Canada.

11.4 Australia (Privacy Act / APPs)

You have the right to access and correct your personal information and to complain to us and, if unresolved, to the Office of the Australian Information Commissioner (OAIC).

11.5 How to exercise your rights

Email info@giftogy.com with your request. We may need to verify your identity before acting, and will respond within the timeframe required by law (generally 30–45 days). You may use an authorised agent where the law allows.

12. Children's privacy

Giftogy is intended for adults and is not directed to children under 16. We do not knowingly collect personal information directly from children. If you upload a photograph that includes a child, you confirm you are the child's parent or legal guardian, or have their consent (see Section 4.5). If you believe a child has provided us with personal information without appropriate consent, contact info@giftogy.com and we will delete it.

13. Marketing communications

With your consent (where required), we may send you emails about products, offers, and new designs. You can opt out at any time using the unsubscribe link in any marketing email or by contacting us. We will still send transactional messages (order confirmations, design previews, shipping updates), as these are necessary to fulfil your order. We never use your uploaded photos in marketing (Section 4.2).

14. Third-party links

Our site and social channels may link to third-party websites and services. We are not responsible for their privacy practices; please review their policies.

15. Contact us (and our representatives)

For any privacy question, or to exercise your rights:

• Email: info@giftogy.com
• Postal address: Giftogy Creatives Pvt. Ltd., Sarla Appt, Sharanpur Road, Nashik, India 422002
• EU representative (GDPR Article 27): [to be appointed — see note below]
• UK representative: [to be appointed — see note below]

Because we are established in India and offer goods to customers in the EEA and the UK, we are required to appoint an EU (Article 27) representative and a UK representative. Their names and addresses will be inserted here once appointed.

16. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will change the “Last updated” date above and, where changes are significant, provide a more prominent notice (such as an email or a banner on our site). Your continued use of giftogy.com after an update means you accept the revised policy.