Giftaweb Privacy Policy

1. Data controller

Navik OÜ (hereinafter We or Service Provider):

• Registration number: 17454389
• Address: Rehe põik 5, 76909 Vääna-Jõesuu, Estonia
• Phone: +372 5067651
• Email: [email protected]

Giftaweb is a trade name and trademark of Navik OÜ.

2. What data do we collect?

2.1. When buying a gift card (buyer's data)

• First and last name
• Email address
• Phone number (optional)
• Billing address (when ordered with an invoice)
• Payment method and transaction reference (via the payment service provider; we do not store card data)

2.2. When redeeming the gift card (recipient's/customer's data)

• First and last name
• Email address
• Phone number
• Company details (name, registration number and address)
• Information submitted through the website form: industry, description of services, preferred domain, style preferences, social media links, colours, etc.
• Uploaded images and logos

2.3. Automatically collected data

• IP address (for security only, retained for up to 30 days)
• Browser type and version
• With consent, technical website-use and advertising-campaign data (page visited, event, campaign identifiers, device data and approximate location)
• Technical data required by Cloudflare Turnstile for spam prevention

3. How do we use personal data?

3.1. To perform the contract (GDPR art. 6(1)(b))

• Generating and sending the gift card
• Building and delivering the website to the Customer
• Communicating with the Customer during the service
• Registering the domain in the Customer's name

3.2. To comply with legal obligations (GDPR art. 6(1)(c))

• Retention of accounting data under accounting law (7 years)
• Tax reporting

3.3. Based on legitimate interests (GDPR art. 6(1)(f))

• Improving service quality
• Ensuring security (anti-spam and anti-fraud)
• Sending a reminder if a gift card remains unused after six months

3.4. Based on consent (GDPR art. 6(1)(a))

• Measuring website use and advertising performance with Google Analytics 4, Google Ads and the Meta Pixel
• Attributing purchase and checkout events to advertising campaigns

Consent is voluntary and can be withdrawn at any time through the “Cookie settings” link in the website footer. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

4. To whom do we transfer data?

We do not sell your personal data. We transfer data to the following service providers who help us deliver the service; analytics and advertising services are activated only with your consent:

All third parties are required to process data in accordance with GDPR and a data processing agreement (DPA).

5. Retention periods

After the retention period ends, data is deleted or anonymised.

6. Cookies

Giftaweb uses essential browser storage and, with your consent, analytics and advertising technologies:

Google and Meta scripts are not loaded and no analytics or advertising data is sent to them before you select “Accept”. If you decline, the Google Consent Mode v2 analytics and advertising consent signals remain “denied” and the Meta Pixel is not loaded. Measurement does not transmit form contents, names, email addresses or card data.

7. Your rights

Under GDPR, you have the following rights:

• Right of access — to obtain a copy of your data
• Right to rectification — to have incorrect or incomplete data corrected
• Right to erasure ("right to be forgotten") — to have personal data deleted when there is no legal basis for retention
• Right to restriction of processing
• Right to data portability — to receive your data in a structured form
• Right to object — to processing based on legitimate interests
• Right to lodge a complaint — with the Estonian Data Protection Inspectorate (aki.ee)

To exercise your rights, send a request to: [email protected]. We respond within 30 days.

8. Data security

• HTTPS encryption for all traffic (Cloudflare SSL)
• Cloudflare WAF (web application firewall) for protection against spam and attacks
• Limited access to personal data (only authorised persons of the Service Provider)
• Regular backups
• Encrypted passwords (where used)

9. Data transfers outside the European Union

Some of our service providers or their subprocessors (including Cloudflare, Resend, Namecheap, Google and Meta) may process data outside the European Union. Where applicable, transfers take place under the EU-US Data Privacy Framework (DPF). Where the DPF does not apply, the providers use Standard Contractual Clauses (SCCs) approved by the European Commission and other safeguards available under Chapter V of the GDPR.

Neither we nor the AI service providers we use train general-purpose AI models on personal data or form data submitted through the API. AI processing is used only to provide the specific service, namely creating the website.

10. Minors

Giftaweb services are intended for people aged 18 or over. We do not knowingly collect data from minors. If we discover that a minor has submitted data, we delete it without delay.

11. Changes to the Privacy Policy

We may amend this Privacy Policy from time to time. We will notify you of significant changes by email. Changes take effect 14 days after publication.