If you are in the European Economic Area (EEA) or the United Kingdom, specific data protection laws (including the EU General Data Protection Regulation (EU GDPR) and the UK GDPR/Data Protection Act 2018) provide you with certain rights and information, as detailed below. This section applies to “European Residents” as a whole, covering individuals in EEA member states and the UK. Please use the Privacy Request Center to exercise your rights.
Your Rights: European data protection law grants you the following rights with respect to your personal information, subject to certain conditions and exceptions:
- Access: You may request access to the personal information we hold about you (commonly known as a “data subject access request”). This allows you to receive a copy of the personal data we have collected on you and to check that we are processing it lawfully.
- Correction (Rectification): You may request that we correct any incomplete or inaccurate personal information that we hold about you.
- Erasure: You may request that we delete or remove personal information when there is no good reason for us to continue processing it, or if you have successfully exercised your right to object to processing (see below), or when we are obligated by law to erase your personal data . This is sometimes called the “right to be forgotten.”
- Objection: You may object to our processing of your personal information where we are relying on a legitimate interest (or those of a third party) and you feel such processing impacts your fundamental rights and freedoms. You also have the right to object at any time if we are processing your personal information for direct marketing purposes.
- Restriction: You may request that we suspend the processing of your personal information, for example, if you want us to establish its accuracy or the reason for processing.
- Data Portability: You may request a copy of the personal information you have provided to us in a structured, commonly used, machine-readable format, and you may have the right to transmit that copy to another entity (this is known as the “right to data portability”) .
- Not be Subject to Automated Decision-Making: You have the right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects or similarly significant effects on you , unless it is necessary for entering into or performing a contract between you and us, or you provide explicit consent, or other exceptions apply under law.
We will endeavor to fulfill any valid requests to exercise the above rights within one month, as required by law. Occasionally, it could take us longer than a month if your request is particularly complex or if we have received multiple requests from you; we will notify you of any such delay and the reason for it. You will not have to pay a fee to exercise these rights. However, we may charge a reasonable fee or decline to comply if a request is manifestly unfounded, repetitive, or excessive. In such cases, we will explain our decision as appropriate.
We may need to request specific information from you to help us confirm your identity and ensure your right to access or exercise any other right. This is a security measure to ensure that personal data is not disclosed to any person who does not have the right to access it. We may also contact you to ask for further information in relation to your request to speed up our response.
Supervisory Authorities: If you are an EEA or UK resident and have concerns about how we handle your personal information, you have the right to lodge a complaint with a data protection supervisory authority. In the UK, our lead supervisory authority is the Information Commissioner’s Office (ICO). You can contact the ICO at ico.org.uk or by other means as advised on their website. If you are in the EEA, you may contact your local Data Protection Authority. A list of national authorities is available on the European Data Protection Board’s website. We would, however, appreciate the chance to address your concerns before you approach a regulator, so please consider reaching out to us first so we can discuss any issue and attempt to resolve it amicably.
Legal Bases for Processing: We must have a valid legal basis to process your personal information. We rely on the following legal bases under the GDPR/UK law:
- Legitimate Interests: We process certain data as necessary for our legitimate business interests (or those of a third party), provided that your interests and fundamental rights do not override those interests. For example, we rely on legitimate interests to maintain system security, to communicate with you and respond to your requests, to conduct surveys or analyze how users interact with our App and websites, to improve our products and services, and to protect our rights and the rights of others. We carefully consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal information for our legitimate interests.
- Performance of a Contract: We process personal information when it is necessary to sign a contract with you or to take steps at your request before entering into a contract. For example, when you purchase goods or services from us (such as ordering cards via the App or website), we need to use your personal details to fulfill the contract (process of payment, shipping the product, etc.). Similarly, when you register an account, we must process your information to provide the Services you requested under the Terms of Use.
- Compliance with Legal Obligations: We process personal information as needed to comply with our legal obligations. For instance, we may retain transaction records to satisfy tax and accounting laws or disclose information when required by law enforcement or court order. We also may verify ages or obtain parental consent in order to comply with child data protection regulations.
- Consent: In limited circumstances, we rely on your consent to process your personal information. Where we rely on consent, we will make it clear at the point of data collection (for example, before collecting sensitive information or before sending certain marketing communications or using precise location, we may ask for your consent). You have the right to withdraw your consent at any time, and if you do, we will stop the processing that was based on your consent. Withdrawal of consent will not affect the lawfulness of any processing carried out before you withdraw consent.
International Data Transfers (EEA/UK): Whenever we transfer your personal information out of the EEA or UK, we ensure a similar degree of protection is afforded to it by implementing appropriate safeguards. If we transfer data to countries that are not deemed to provide an adequate level of data protection (such as transfers to the United States from Europe), we will use one or more of the following safeguards:
- We may rely on Standard Contractual Clauses (SCCs) approved by the European Commission (or the UK’s ICO, as applicable) in contracts with the recipient of your data. These clauses oblige the recipient to protect your personal information according to standards equivalent to European data protection law. We may also rely on adequacy decisions or certified participation in the EU-U.S. Data Privacy Framework, if applicable.
- In accordance with Article 46 of the GDPR, we may transfer data to organizations that have implemented other approved transfer mechanisms, such as an EU-U.S. data privacy framework or Binding Corporate Rules, if available and applicable. (Note: In the past, we have relied on the EU-U.S. and Swiss-U.S. Privacy Shield frameworks for certain transfers. While the original Privacy Shield was invalidated by the EU in 2020, we continue to uphold high standards of protection and monitor the development of any new transatlantic data transfer frameworks. We will use any new legally recognized mechanism or framework once established to ensure compliance.)
- We may transfer data to countries that have been formally designated as providing an adequate level of protection by the European Commission or relevant authority. In such cases, personal data can flow freely to those countries.
- In rare cases, we may base transfers on your explicit consent, or another exception provided under Article 49 of the GDPR, but we will only do so when necessary and when the above safeguards are not available.
You can request more information about our international data transfer safeguards by contacting us. By using our Services, you acknowledge that your information may be transferred to and processed in countries outside of your own, including the United States, as described in this Privacy Policy. For European residents, we will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Policy and applicable law during such transfers.
Data Retention (EEA/UK): We will not retain your personal information for longer than necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. In general, for users in Europe, this means:
- If you have an account or ongoing relationship with us, we will retain your personal information for as long as your account is active or as needed to provide you with Services.
- If you make a purchase, we retain your transaction information for the duration required by tax and financial regulations (typically at least 6-7 years in the UK) and for warranty/service periods.
- If you participate in a promotion or contest, we retain the data for the duration of that promotion and any required retention period following its end.
- If you contact us for customer support, we retain communications for a period necessary to resolve your inquiry and for quality assurance.
- If you request deletion of your data or close your account, we will securely delete or anonymize your information, except for any data we are required to keep by law or for legitimate business purposes. Your anonymized data may be retained as long as you continue to use the App/Services but will not be kept longer than necessary for the purposes stated. Once you cease using the Services or withdraw consent (if applicable), any remaining personal data will be either deleted or anonymized. All your data will generally be deleted from our backup systems after a short interval (e.g., after 7 days), except where we are required by law to retain certain information for a longer period.
During the retention period, we maintain appropriate security measures to protect your data (see “Security” below). After the retention period, we will either delete your personal information or anonymize it (for example, by aggregation) so that it can no longer be associated with you, in which case we may use such information indefinitely without further notice to you.