This privacy policy explains what personal data Happy Giftlist collects, why, who else receives it and what you can do about it. It covers the website happygiftlist.com and the Happy Giftlist apps for iPhone and Android.
It applies to everyone whose data passes through Happy Giftlist: people with an account, guests who reserve a gift or chip in without an account, and people who are added to a Secret Santa draw by someone else.
Who is responsible for your data
Happy Giftlist is run by BV Wuyts Consultancy, a company registered in Belgium under enterprise number 0691.978.994 (VAT BE0691978994). We are the controller of the personal data described in this policy.
For any question about your data, or to use one of your rights, email [email protected] or use our contact form.
What we collect and why
Below, for each part of Happy Giftlist, you can read which data we use, what for, and the legal basis we rely on under the GDPR.
Your account
When you create an account we store your first name, last name, email address, password (only as a secure hash, never readable), language and whether you have confirmed your email address. If you sign in with Google, Facebook or Apple, we receive your name and email address from that service and store an ID that links your account to it. We never receive your password for those services.
We also note where your sign-up came from, for example a newsletter link, a campaign link or the app. This is only a short tag such as the campaign name and the page you landed on.
We need your name and email address to create your account and keep it secure: without them you cannot have an account. Legal basis: performance of our agreement with you (the terms) for the account itself, and, for the sign-up source, our legitimate interest in knowing which channels bring new users.
Wishlists and gifts
Everything you put on a list is stored: list titles and descriptions, gifts with their links, prices, descriptions and pictures, and photos you upload. Your name is shown on your lists. If you follow someone else's list, we store that too.
If you want to receive money for a gift, you can add payment details such as an IBAN or a PayPal address. We store these encrypted. Guests see them when they contribute to that gift, because that is how they know where to send the money.
Legal basis: performance of our agreement with you.
Reserving a gift or chipping in
When you reserve a gift or contribute to one, with or without an account, we ask for your first name, last name and email address, and for a contribution also the amount and currency you plan to give. We use this to send you a confirmation with a link to undo your reservation, and to show you your reservations in your account if you have one with the same email address.
The owner of the list can see who reserved a gift and who contributed how much. If the owner has turned on reservation alerts, they also receive your name and email address by email. If you have an account with the email address you used, you automatically start following that list.
Legal basis: performance of an agreement (you asked us to register the reservation) and our legitimate interest, and the list owner's, in avoiding duplicate gifts.
Secret Santa draws
An organizer enters the name of every participant and, if they want, an email address. We use these to send invitations, results and reminders, and to let participants add their own wishes. If you were added by an organizer, your data came from them. In a draw that is open for sign-ups, you enter your name and email address yourself.
We also store who drew whom and which people may not draw each other. The organizer can see the participants and their personal result links, so an organizer who opens those links can see who drew whom.
Legal basis: performance of our agreement with the organizer, and the legitimate interest of the organizer and the participants in running the draw. Organizers must only add people who agree to take part.
Emails we send
- Emails you need to use the service: confirming your email address, resetting your password, a welcome email, confirmations of reservations and contributions, reservation alerts for list owners who turned them on, and Secret Santa invitations, results and reminders. Legal basis: performance of our agreement.
- Activity updates: an email when something new is added to a list you follow, and updates about Secret Santa draws you take part in. You can turn these off under Account settings or with the link in each email. Legal basis: our legitimate interest in keeping you informed about lists and draws you are part of.
- Tips and news: when you create an account, you also receive our occasional newsletter about Happy Giftlist, for example a reminder before the holidays or an invitation to draw names again with last year's group. Such an email can mention your own previous draw. You can turn it off at any time under Account settings or with the unsubscribe link at the bottom of every newsletter. Legal basis: our legitimate interest in telling account holders about our own similar services, as allowed by the rules on email marketing to existing customers.
If you unsubscribe, we keep your email address on a list of people not to email, so we can respect your choice.
Push notifications in the apps
If you allow notifications on your phone, the app sends us a device token, the type of phone (iPhone or Android), a device ID created for our app and your language. We use them to tell you when someone reserves or contributes to a gift on your list. The notification text does not say who reserved what. You can turn notifications off in your phone's settings at any time. When you sign out we delete the token, and tokens that are not used for 90 days are deleted automatically. Legal basis: your consent, given through your phone's permission prompt.
Adding gifts with a link
When you paste a link to a product, our server opens that shop page to fetch the title, price and picture. Product searches and suggestions can come from the Amazon and bol.com product services. These requests only contain the link or search words, not your name or email address. To show prices in the right currency we work out your country from your IP address.
Pictures of products that are not uploaded to Happy Giftlist are loaded straight from the shop's own server, which then sees your IP address, as with any picture on the internet.
Statistics and analytics
On the website we use Google Analytics to see how the site is used: which pages are visited, which buttons are clicked and roughly where visitors come from. We do not send your name or email address to Google, and we strip private codes (such as password reset links and personal Secret Santa links) from page addresses before they are measured. More about the cookies involved, and how to refuse them, is in our cookie policy.
The apps use Google Analytics for Firebase in the same way: which screens are opened and which actions are taken. When you are signed in, your Happy Giftlist account number (not your name or email address) is attached to these events. The apps do not use your phone's advertising ID.
Legal basis: for the website, your agreement to our cookie policy, which you give by using the site and can withdraw at any time with the “Reject analytics cookies” button on the cookie page. For the apps, our legitimate interest in understanding how Happy Giftlist is used so we can improve it.
Security and error reports
Our servers record technical data such as IP addresses, the pages requested and error messages. When something goes wrong in the website or the apps, an error report is sent to our logging service Axiom. Reports from the apps include the app version, the type of phone and, if you are signed in, your account number.
To stop spam and fake accounts, the sign-up form and the contact form on the website use Google reCAPTCHA, which looks at technical data from your browser. We also use your IP address to limit how many requests can be made in a short time.
Legal basis: our legitimate interest in keeping Happy Giftlist secure and working.
Contacting us
If you use the contact form, we receive your name, email address and message by email and use them to answer you. Legal basis: our legitimate interest in answering your question, or performance of our agreement if your question is about your account.
Links to shops
Links to shops on Happy Giftlist can be affiliate links. When you click one, we may earn a small commission if you buy something, at no extra cost to you. The click goes through our server and then, depending on the shop, through an affiliate network. We do not give these partners your name or email address. The shop and the affiliate network can set their own cookies once you are on their site; their own privacy policies apply to that.
Who can see what you share
- Anyone who has the link to a list can see the list, the gifts on it and your name. Lists that are not set to private can also be found by people who type your exact email address into the search.
- The list owner can see who reserved a gift and who contributed what.
- Guests who contribute to a gift see the payment details the owner chose for it.
- In a Secret Santa draw, each participant sees the name and wishes of the person they drew. The organizer sees all participants and their result links.
Signing in with Google
If you choose to sign in with Google, Google shares your Google account ID, first name, last name and email address with us after you agree on Google's screen. We do not ask for access to your contacts, calendar, Gmail, Drive or any other Google data.
We use these details only to create your Happy Giftlist account, to sign you in and to send the emails that belong to your account, including our occasional newsletter unless you switch it off (you can unsubscribe in every email). We do not sell them, we do not use them for advertising or to train AI models, and we do not share them with anyone other than the service providers below that run Happy Giftlist for us.
We keep them as long as you have your account and delete them when you delete it (see “Deleting your account”). You can also remove Happy Giftlist's access at any time in your Google account, under Security › Your connections to third-party apps and services.
Happy Giftlist's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Service providers we use
We do not sell your personal data. We share it only with companies that help us run Happy Giftlist, and only as far as they need it for that job:
- Amazon Web Services: servers, file storage for pictures, server logs and sending emails (data center in Frankfurt, Germany).
- MongoDB Atlas: our database (hosted on Amazon Web Services in Paris, France).
- Cloudflare: network security and fast delivery of the website.
- Axiom: error reports and logs (stored in the United States).
- Google: Google Analytics and Google Analytics for Firebase (statistics), reCAPTCHA (spam protection), Google sign-in and Firebase Cloud Messaging (notifications on Android).
- Apple: Sign in with Apple and notifications on iPhone.
- Meta: Facebook sign-in.
- ip-api.com: working out your country from your IP address, when our network provider does not already tell us.
We may also share data when the law requires it, for example at the request of a court or the police, or to protect our rights or the safety of others.
Data transfers outside Europe
Our servers, database, file storage and email sending are in the EU. Error reports are stored by Axiom in the United States; for that transfer we rely on the standard contractual clauses approved by the European Commission. Google, Apple, Meta and Cloudflare can also process data in the United States. For those transfers we rely on the European Commission's adequacy decision for companies certified under the EU-U.S. Data Privacy Framework, or on the standard contractual clauses. You can ask us for more information about these safeguards.
How long we keep your data
- Your account: as long as you have it. See the next section for what happens when you delete it.
- Lists, gifts and draws you delete yourself: deleted right away. Copies in our backups are overwritten within 30 days.
- Reservations and contributions: as long as the list exists.
- Secret Santa participants: as long as the draw exists.
- Push notification tokens: until you sign out, and at most 90 days after the app last used them.
- Sign-in sessions: 30 days in the apps and on the website, unless you sign out earlier.
- Messages through the contact form: 1 year.
- Server logs and error reports: 30 days.
- Backups: 30 days.
- The list of addresses that unsubscribed: as long as we send newsletters, so we keep respecting your choice.
Deleting your account
You can delete your account at any time under Account settings on the website, or under Settings in the app. When you delete your account, we delete your account and everything linked to it (your lists, gifts, Secret Santa draws, payment details and uploaded images). Copies in our backups are overwritten within 30 days.
Reservations you made as a guest and Secret Santa draws you were added to by someone else are not part of your account. If you want those removed, contact us and we will delete them.
Your rights
Under the GDPR you have the right to:
- see the personal data we have about you and get a copy of it
- have incorrect data corrected
- have your data deleted
- have the use of your data restricted
- receive the data you gave us in a common format, to take it elsewhere
- object to the use of your data based on our legitimate interest, and always to our newsletter
- withdraw your consent at any time, for example for notifications or analytics cookies, without affecting what was done before
Email [email protected] or use our contact form. We answer within one month. We may ask you to prove who you are before we hand over or delete data.
We do not make decisions about you that have legal or similarly significant effects based only on automated processing.
If you think we handle your data incorrectly, please tell us first. You can also file a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35, 1000 Brussels, www.dataprotectionauthority.be, or with the data protection authority in the country where you live or work.
Children
You must be at least 13 years old to create an account. Younger children can take part in a Secret Santa draw or receive gifts through a list that a parent or another adult organizes, without an account of their own. That adult decides what to share about them.
How we protect your data
All connections to Happy Giftlist are encrypted. Passwords are stored as a secure hash, payment details are stored encrypted, and links in emails that let you undo a reservation or reset a password use one-time codes that we only store in hashed form. No system is perfectly secure, but if a data breach puts your rights at risk, we will tell you and the authorities as the law requires.
Changes to this policy
We update this policy when Happy Giftlist changes. The date at the top shows the latest version. If a change matters for how we use your data, we will tell account holders by email or in the app before it takes effect.