Privacy Policy

Last updated: 18 August 2026

Giftory respects the privacy of website visitors, business contacts, customers, suppliers and other people with whom it interacts. This Privacy Policy describes the types of information Giftory collects, the reason for collecting them, who we may share them with, how long we keep your information and your rights regarding your personal data.

1. Who is responsible for your personal data?
2. Who does this Privacy Policy apply to?
3. Which personal data does Giftory process?
4. Sources of personal data
5. Purposes and legal bases
6. Required and optional data
7. Sharing personal data with third parties
8. Transfers outside the European Economic Area
9. Website, forms, cookies and technical data
10. Business communications and marketing
11. Retention periods
12. Security and personal-data breaches
13. Your privacy rights
14. Automated decision-making and minors
15. Questions and complaints
16. Changes to this Privacy Policy

1. Who is responsible for your personal data?

Giftory is the controller of the personal data processed under this Privacy Policy.

Company name: Giftory
Legal form: Sole proprietorship
Chamber of Commerce number: 73777668
Location: Herengracht 449 A, 1017BR Amsterdam, The Netherlands
Email: info@giftory.nl
Website: https://giftory.nl

For privacy questions or to exercise your privacy rights, contact Giftory at info@giftory.nl.

2. Who does this Privacy Policy apply to?

This Privacy Policy applies to personal data relating to:

website visitors and people who contact Giftory (e.g. via contact or application form);
business contacts of customers;
prospective retail partners;
suppliers, manufacturers, service providers and advisers;
sole traders and other natural persons who deal with Giftory in a business capacity;
people involved in quotations, orders, payments, deliveries, complaints, returns, custom work or product-safety matters.

Giftory serves business customers only. Nevertheless, information about natural persons, such as an owner or employee of a business customer, is personal data and may fall within the scope of the General Data Protection Regulation (GDPR). Such personal data shall only be processed where strictly necessary and under an appropriate and lawful legal basis.

3. Which personal data does Giftory process?
3.1. Types of personal data

Depending on the relationship and purpose, Giftory may process the following categories of personal data:

Contact and business information: name, job title, business name, business and delivery address, email address, telephone number, website or business social-media details, business registration information and information needed to verify identity or authority.
Commercial and transaction information: enquiries, product preferences, quotations, orders, specifications, designs, approvals, delivery information and correspondence concerning the business relationship.
Financial and administrative information: invoice details, payment status, payment date and reference, bank-account details where required, outstanding amounts and information needed for accounting, tax and audit purposes.
Service, complaint and product-safety information: tracking and delivery confirmations, complaints, returns, damage, defects, replacements, reimbursements, photographs or videos supplied in connection with a case, product incidents, corrective measures, recalls and traceability information.
Website and technical information: IP address, access date and time, pages visited, technical request data, browser/device information, security and access logs and information generated by cookies or similar technologies.

3.2. Special categories of personal data

Giftory does not intend to collect special categories of personal data, such as health data, political opinions, religious beliefs or criminal-offence data. Please do not provide such information through forms or email unless Giftory requests it and it is strictly necessary.

In the event Giftory receives such information unnecessarily, it will delete or limit access to it where reasonably possible.

4. Sources of personal data

Giftory usually receives personal data directly from the data subject, for example through:

contact or retail-partner forms on the website;
email, telephone, meetings, quotations, orders, payments, complaints, returns, custom-order enquiries and other business communications with Giftory.

Giftory may also receive personal data from:

the business or organisation for which a person works;
colleagues, owners, representatives or other authorised contact persons;
public sources, such as the Dutch Commercial Register, business websites, public business social media profiles and public sector or address information;
suppliers, manufacturers, carriers, payment providers, insurers or advisers involved in performing an agreement or handling a case; and
competent authorities or other parties where this is legally permitted or required.

Where Giftory obtains personal data from another source, Giftory will provide information about that source as required by data protection law..

5. Purposes and legal bases

Giftory processes personal data only for specific purposes and where there is a valid legal basis. The applicable legal basis depends on the processing activity and circumstances.

5.1. Contact enquiries and retail-partner applications

Giftory processes contact and business information to answer questions, assess business applications, schedule a collection presentation and assess potential cooperation.

Where processing is necessary to take steps at the individual’s request before entering into an agreement, the legal basis is the necessity to take those steps prior to entering into a contract.

For a business contact acting for a legal entity, Giftory generally relies on its legitimate interests in efficiently handling enquiries and managing prospective business relationships, subject to the applicable balancing assessment.

5.2. Quotations, orders and performance of agreements

Giftory processes personal data to prepare quotations, confirm orders, reserve stock or production, deliver products, process payments and maintain the business relationship. This processing is necessary to take the requested pre-contractual steps or for the performance of the agreement between Giftory and the relevant party.

For employees and other contacts of a business contracting party, processing is based on the legitimate interests in communicating with the customer and performing the business relationship.

5.3. Custom Work, designs and production

For custom work, Giftory may process business contact details, instructions, designs, files, approvals and production information to assess feasibility, prepare samples and perform the custom assignment. Giftory may provide selected manufacturers or suppliers with the designs and production specifications necessary to prepare samples and fulfill the assignment, while limiting the personal data shared with them to what is necessary for those purposes. Manufacturers only receive a Giftory assignment or order reference and do not receive the retailer’s identity or direct contact details. Processing is necessary to take steps at the retailer’s request prior to entering into an agreement or, where an agreement has been entered into, to perform the agreement.

5.4. Delivery and logistics

Giftory processes names, delivery addresses, telephone numbers and delivery information to arrange transport, enable access and resolve delivery problems. This processing is necessary to perform the agreement. For a business contact for whom that basis does not apply, Giftory relies on its legitimate interest in completing business deliveries correctly.

5.5. Financial administration and legal obligations

Giftory processes invoice, payment and administrative data to receive payments, make reimbursements, maintain its accounts and comply with tax, customs and other legal obligations. This processing relies on the necessity to comply with a legal obligation, where applicable, or for the performance of the agreement.

5.6. Payment risk, fraud, security and legal claims

Giftory may process necessary data to assess payment risks, prevent fraud and misuse, collect outstanding amounts, establish or defend legal claims and protect its property, systems and rights.

This processing is based on Giftory’s legitimate interests in financial risk management, security and legal protection. Giftory does not use more data than reasonably necessary for those purposes.

5.7. Complaints, returns and disputes

Giftory processes case information to investigate complaints and returns, inspect products, provide solutions, pursue suppliers or carriers and preserve evidence.

Where applicable, this processing relies on the necessity to perform the agreement, comply with a legal obligation or Giftory’s legitimate interest in handling complaints and disputes and in establishing or defending legal claims.

5.8. Product safety, traceability and recalls

Giftory processes necessary personal data to investigate product-safety risks, identify products and business recipients, implement corrective measures and cooperate with economic operators and competent authorities.

Where applicable, the processing is necessary to comply with a legal obligation, such as product-safety and traceability obligations, or in the legitimate interests of Giftory and its customers in safe and legally compliant products and the protection of customers.

5.9. Website management and information security

Giftory processes technical data and security logs to keep the website available and secure, investigate failures, ensure that forms function and prevent spam, misuse and unauthorised access.
This processing is based on Giftory’s legitimate interest in operating and securing a reliable website and information systems.

5.10. Business communications and marketing

Giftory may use contact details for necessary communications concerning enquiries, quotations, orders, delivery, complaints, product-safety notices and the business relationship.

Where applicable, the processing is necessary to perform the agreement, to take requested pre-contractual steps, or for Giftory’s legitimate interest in managing the business relationship.

Giftory sends electronic direct marketing only where permitted under applicable electronic-communications law. Where consent is required, Giftory obtains consent before sending the relevant marketing communications. Where a statutory exception applies, Giftory relies on that exception and provides a clear and free means to object or unsubscribe.

5.11 Consent

Where Giftory relies on consent, that consent is voluntary and may be withdrawn at any time. Withdrawal does not have retroactive effect and does not make earlier lawful processing unlawful.

6. Required and optional data

Some personal data are necessary to handle an enquiry, assess a business relationship, prepare a quotation or perform an agreement.
If necessary data are not provided, Giftory may be unable to provide a substantive response, issue a quotation, assess an application, confirm an order or make a delivery.

Personal data not requested as necessary are provided voluntarily. Giftory asks business customers to provide only personal data that are relevant and necessary for the purpose concerned.

7. Sharing personal data with third parties

Giftory does not sell personal data. Giftory shares personal data only where necessary for a purpose described in this Privacy Policy, where there is a valid legal basis or where Giftory is legally required to do so.

Depending on the circumstances, Giftory may share personal data with the following categories of recipients:

STRATO GmbH, for hosting, domain and email services. Giftory’s website and regular email environment are hosted through STRATO in Germany;
technical software and plugins within the WordPress installation, including WPForms for website forms and Polylang for language functionality;
Cloudflare, Inc., for Cloudflare Turnstile, which protects forms against automated misuse and spam;
Defiant, Inc., the provider of Wordfence, for firewall, malware, login and other website-security functions;
WhatsApp Ireland Limited, where applicable, for business communications with customers and business contacts, including operational communications relating to business interactions and, separately, for sending product images, offers and other promotional communications to contacts who have agreed to receive such communications;
bookkeepers, accountants, administrative service providers and tax advisers;
banks and payment providers;
carriers and logistics providers;
manufacturers, suppliers, printers and packaging companies and other parties necessarily involved in an order or custom assignment;
insurers, collection providers, bailiffs, lawyers and other professional advisers;
competent supervisory, tax, customs, law-enforcement or judicial authorities;
prospective buyers, successors or advisers in connection with a business transfer subject to appropriate safeguards.

Giftory limits disclosures to what the recipient reasonably needs. Where a recipient processes personal data solely on Giftory’s documented instructions and the GDPR requires a processor arrangement, Giftory enters into an appropriate data-processing agreement. Other recipients, including some banks, carriers, accountants and authorities, may be independent controllers for their own processing.

For custom work or delivery, Giftory will avoid providing more identifying information than reasonably necessary and will use an order number, business name or other less identifying information where that can achieve the same purpose.

8. Transfers outside the European Economic Area

Giftory’s regular website and email hosting is provided through STRATO GmbH. STRATO data centres are in Germany, so the primary hosting remains within the European Economic Area (EEA).

Giftory also uses Cloudflare Turnstile and Wordfence to secure the website. Cloudflare, Inc. and Defiant, Inc. are service providers established in the United States. When these services are used, limited technical and security data, including IP addresses, may be processed outside the EEA.

Giftory also uses WhatsApp Business for business communications with customers and business contacts and, where applicable, for occasional promotional communications. Depending on the applicable processing, personal data may be processed outside the EEA.

Where personal data are transferred outside the EEA, Giftory relies on the transfer mechanism applicable to the relevant provider and processing activity, including an applicable adequacy decision or appropriate safeguards under data protection law. Where required, Standard Contractual Clauses apply to transfers involving Cloudflare and Defiant. For transfers involving WhatsApp Business where WhatsApp Ireland Limited is the contracting entity, the WhatsApp Business Data Transfer Addendum incorporated into WhatsApp’s Business Data Processing Terms applies, including the appropriate safeguards specified in that addendum.

Giftory will maintain appropriate transfer assessments and supplementary measures where required. On request, Giftory will provide further information about the safeguard applying to a specific transfer, insofar as legally possible.

9. Website, forms, cookies and technical data

9.1. Hosting and website forms

Giftory uses WordPress hosted by STRATO in Germany. Contact and retail-partner forms are processed through WPForms. Submitted data are used to handle the enquiry. Under Giftory’s current WPForms Lite configuration, form submissions are not stored in the WordPress database; they are sent directly to Giftory’s STRATO-hosted email environment.

9.2. Essential and functional cookies

The website currently uses the functional “pll_language” cookie provided by Polylang. Separately, Giftory uses Wordfence and Cloudflare Turnstile as security technologies where required for website or form security.

The “pll_language” cookie is used solely to remember the language preference selected by a website visitor and to enable the website to be displayed in the selected language. It is a functional cookie and is not used by Giftory for analytics, advertising, profiling or other tracking purposes. The cookie is retained for approximately one year.

These technologies are not used by Giftory for advertising or commercial tracking.

9.3. Cloudflare Turnstile

Giftory uses Turnstile to distinguish human form use from automated software and protect forms against spam and misuse. Depending on the implementation, limited technical signals such as IP address, User-Agent information and other security signals may be processed. Giftory relies on its legitimate interest in website and form security for this processing.

9.4. Wordfence

Giftory uses Wordfence and related hosting/security functions for firewall protection, malware detection, protection against unauthorised access and investigation of suspicious requests. Security logs may contain IP addresses, requested URLs, timestamps and technical information. Giftory relies on its legitimate interest in securing its website, systems and business information.

9.5. Analytics or marketing tracking

Giftory currently does not use analytics, advertising or other non-essential tracking technologies on the website. If this changes, Giftory will update its cookie information and obtain consent where required before deploying technologies that require consent.

9.6. External links

The website may contain links to third-party websites or platforms. Giftory is not responsible for the privacy practices of those third parties. Users should consult the relevant third-party privacy policy, and any other privacy information from that third party, before providing personal data.

10. Business communications and marketing

Giftory distinguishes between necessary business communications and commercial marketing.

Service and transactional messages may concern enquiries, appointments, quotations, orders, payments, delivery, complaint or product-safety measures. These communications are not treated as direct marketing where they are genuinely necessary for the relevant business relationship or legal obligation.
Newsletters, promotional emails and other electronic advertising are sent only where permitted under applicable electronic-communications law. Where consent is required, Giftory will obtain consent before sending the relevant marketing communication. Every commercial message provides a clear and free means to unsubscribe or otherwise object.

Giftory does not use purchased address lists for untargeted mass marketing. An objection or unsubscribe request does not apply to necessary service messages, payment communications or safety notices.

Giftory may retain a minimal suppression list containing the email address and date of the unsubscribe request where necessary to ensure that the person does not unintentionally receive further marketing.

11. Retention periods

Giftory does not retain personal data longer than necessary for the purpose for which they were collected. In determining retention periods, Giftory considers statutory retention obligations, the duration of the business relationship, product-safety obligations, evidential interests and applicable limitation periods.

The following retention periods apply:

General contact enquiries: up to two years after the last substantive contact, unless a business relationship or another relevant matter arises.
Unsuccessful retail-partner applications and quotations that are not pursued: up to two years after the last communication or decision, unless a longer period is reasonably required for a dispute or an express request to make contact again later.
Customer, supplier, contract, order, delivery and invoice data: for the duration of the business relationship and subsequently for as long as the applicable tax and administrative retention obligation require. Core accounting records and invoices are generally retained for seven years.
Custom-order files, approvals and production data: for as long as necessary for performance, repeat orders, complaints, legal obligations and establishing or defending rights; generally, no more than seven years after completion, unless a longer period is necessary.
Complaint, return and damage files: generally, up to five years after final closure. Financial components may be retained for seven years and longer where a dispute or claim remains ongoing.
Product-safety and traceability information: where legally applicable, for at least ten years after the relevant receipt or supply of the product.
Website and security logs: Wordfence Live Traffic records are currently configured to be retained for no more than 30 days and are limited to 2,000 records. Separate hosting or server logs generated by STRATO or another service provider are retained according to the applicable provider settings. Relevant logs may be retained longer where necessary for a security incident, investigation, block or legal obligation.
Evidence of marketing consent and commercial communications: for as long as necessary to demonstrate compliance, generally up to five years after the last relevant message. Minimal suppression data may be retained longer where necessary to respect the unsubscribe request.

Data may be deleted earlier where they are no longer needed, and no legal obligation or legitimate evidential interest prevents deletion. Backup copies may remain for a limited period until overwritten or deleted through the normal backup cycle.

12. Security and personal-data breaches

Giftory implements appropriate technical and organisational measures proportionate to the risks of the processing, including access controls, authentication, security updates, secure communications, backups and measures designed to prevent unauthorised access, loss or disclosure.

No security measure can eliminate every risk. If a personal-data breach occurs, Giftory will investigate the incident and notify the Dutch Data Protection Authority and/or affected persons where required by law.

13. Your privacy rights

Where the GDPR applies, you may have the right to:

request access to the personal data Giftory processes about you;
have inaccurate or incomplete data corrected;
request erasure of personal data in certain circumstances;
request restriction of processing in certain circumstances;
object to processing based on a legitimate interest;
object to direct marketing at any time;
request data portability where the statutory conditions are satisfied;
withdraw consent; and
file a complaint with a competent supervisory authority.

You can send a request to info@giftory.nl. Giftory will facilitate the exercise of your rights and may request additional information where reasonably necessary to verify your identity.

Giftory will ensure that data subject requests are handled within the legally required timeframe.

Giftory may refuse a request in whole or in part where there is a legal basis to do so, for example because of a statutory retention obligation, the rights of others or the need to establish or defend a legal claim. Giftory will explain a refusal insofar as legally possible.

14. Automated decision-making and minors

14.1. Automated decision-making

Giftory does not make decisions based solely on automated processing that produce legal effects or otherwise significantly affect data subjects. While a business application may be assessed using fixed criteria or administrative checks, any decision with legal or similarly significant effects is ultimately reviewed and made by Giftory, with human involvement in the decision-making process.

14.2. Minors

Giftory’s services are directed primarily to business users and are not intended for children. Giftory does not knowingly seek to collect personal data from children through its business services.

15. Questions and complaints

If you have a question or complaint about the processing of your personal data, first contact Giftory at info@giftory.nl. Giftory will endeavour to handle your question or complaint carefully and within a reasonable timeframe.

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). Further information is available at autoriteitpersoonsgegevens.nl.

16. Changes to this Privacy Policy

Giftory may amend this Privacy Policy when its website, business activities, service providers, products, legal obligations or data processing change. The most recent version will be published on giftory.nl. Where a material change is directly relevant to existing business contacts, Giftory may also inform them in an appropriate manner.

The date at the top of this Privacy Policy indicates when the published version was last updated.