Version of the 18th of May 2024

1. PREAMBLE ‍

   Giftit lets users find out what their loved ones want without killing the surprise. It turns a sometimes anxiety-inducing, but often wasteful guessing game into a delightful experience for both givers and receivers. The platform of Giftit has been set up in order to : (i) make gifting more fun, interactive and spontaneous, and (ii) reduce the amount of waste caused by unwanted or non-fitting gifts. Furthermore, the Giftit platform aims to facilitate the search for gifts by allowing gifters and potential recipients to see and interact with each other’s wish lists and consult each other’s profiles. To this end, users on Giftit can also request Sherlock, an AI chatbot, to anonymously message their friends on their behalf through chat apps like WhatsApp and iMessage and share the transcript of the conversation with them, along with shoppable gift recommendations.
   
   The present privacy policy (« Privacy Policy ») addresses the use of personal data collected through the Giftit Social platform, managed by Giftit Social, Inc. (DBA The Fire Company) with its office located at Clausiusstrasse 16, 8006 Zürich, Switzerland. The Giftit Social platform is accessible under the following address « https://www.giftit.social » as well as through the Giftit Social mobile app, downloadable on Android through the Google Play Store, and on iOS through TestFlight and the App Store. Additionally, you can access our platform through connected messaging apps (SMS, WhatsApp, iMessage) by messaging the phone number connected to our AI chatbot, Giftit Sherlock: +14066167610 (collectively referred to as the "Platform").
   
   Please read this Privacy Policy carefully before using the Platform. This Privacy Policy explains how information relating to an identified or identifiable individual (« Personal Data ») is collected, used and protected.
   
   As a basic principle, the Swiss Federal Data Protection Act applies to the processing of your personal data. If you access our services from the State of California, USA, the California Consumer Privacy Act of 2018 (CCPA) may also apply.
   
   By using our Platform, you acknowledge and agree with the collection and processing of your Personal Data in accordance with this Privacy Policy. If you do not wish your Personal Data to be processed according to the present Policy, please do not use the Platform.
   
   

2. DATA CONTROLLER

   1. The Platform is managed by Giftit Social, Inc. (DBA The Fire Company), incorporated in the State of Delaware, United States and primarily based in Zurich, Switzerland.

   2. Giftit Social Inc. (DBA The Fire Company) is considered the Data Controller in relation to the processing of Personal Data on the Platform and your first point of contact. You can contact us by e-mail to info@giftit.social or by post at Clausiusstrasse 16, 8006 Zürich.

   3. Giftit has the role of making the Platform available to users who wish to register requests for account creation on the Platform and to accompany users in their search for gifts and to consult other user’s profiles.
      
      

3. GENERAL PRINCIPLES

   1. We use the Personal Data collected through our Platform, as described below, to provide the following information and services : 

      1. registration on the Platform and creating a user account ; 

      2. profiles and wishlist consultation ;

      3. sending and answering chatbot messages through the Platform and other third-party messaging apps ;

      4. informational updates in relation to Giftit and its services ; 

      5. gift recommendation ;

      6. birthday and event reminders ;

      7. displaying friend activity ;

   2. This Privacy Policy does not apply to any services offered offline.
      
      

4. PERSONAL DATA WE COLLECT, AND OUR USE OF SUCH PERSONAL DATA

   A. Sources of collection

   1. The Personal Data that we collect through our Platform consists of the Personal Data that you provide us with (as described in section B below)

   
   B. What Personal Data do you provide to us? 

   We collect the Personal Data you provide to us on a voluntary basis when, through our Platform, you : 

   1. Exchange messages with the Sherlock AI Persona (chatbot) through the Platform or third-party messaging services, irrespective of the existence of a user-account for the phone number being used to exchange messages. Note: we only initiate conversations with phone numbers at the explicit request of users on our app that have that phone number in their phone contacts ；

   2. Register on the Platform and create an account with your phone number ;

   3. Log into your account using your personal login (phone number and verification code) ;

   4. While logged into your account, visit and use the Platform ;

   5. Phone contacts and information you attach to contacts such as birthdays, nicknames or gift ideas.

      
      

   If you register on the Platform as a user, the Personal Data we may collect (with your consent) includes:

   1. Phone number (required for authentication) ;

   2. Full name ;

   3. Date of birth ;

   4. Profile image ;

   5. Friends network (of other users on the app) ;

   6. Phone contacts and information you attach to contacts such as birthdays, nicknames or gift ideas for such contacts ;

   7. Messages exchanged with the Sherlock chatbot including those of third parties you request an investigation for ;

   8. Personal wishlist and gift ideas for friends.

   
   

   It should be noted that the only Personal Data that is displayed on the Platform and visible on your profile is your name, your profile image and your preferences for products or gifts on your wishlist (you have granular control over the visibility of the latter). The transcript of conversation you have with Sherlock will only be accessible to your friends on the Giftit app, and if you don't have a user account on Giftit, it will only be visible to the person who requested the investigation. Giftit may store these conversations for the purposes listed under Section 12 of this Privacy Policy. At any time, the user can exercise his rights as listed under Section 11 of this Privacy Policy.

   
   C. For what purpose do we collect this information?

   We collect the Personal Data you provide to us on a voluntary basis in order to provide the services you have requested, namely :

   1. To send messages using the details of the contact(s) you provide to the Sherlock chatbot, and share the conversation transcript of the gift receiver with the sender of the Sherlock request ;

   2. To validate your registration to the platform ;

   3. To contact you to understand your needs ;

   4. To publish your profile and wishlist on the platform ;

   5. To continuously improve the quality of our services.

   6. To potentially send you phone messages on supported third-party messaging apps if a Sherlock investigation is requested on you. By creating a user account, you opt-in to this possibility. Please note that you can opt-out of receiving such messages at any time by contacting us at info@giftit.social.

   
   

   D. Sharing of Sensitive Information
   Giftit does not require users to share sensitive information such as email addresses, physical addresses, payment details, or other personally identifiable information with Sherlock, our AI chatbot. We strongly advise against sharing such sensitive information through our platform. If a user chooses to share such information, Giftit will not be held liable for any consequences that may arise from the sharing of this sensitive information with the sender of the Sherlock request. Users are responsible for the information they choose to share through our platform and our connected third-party messaging apps.

   
   

5. LINKS TO GIFTIT’S MAIN WEBSITE

   1. Our Platform contains links that direct you to Giftit’s main website enabling you to access the content available therein. 

   2. Please refer to the privacy policy of this website for any information in relation to the purpose and extent of the collection of Personal Data, the further processing and use of such Personal Data, as well as the rights related thereto and the adjustment possibilities to enable the protection of your Personal Data.

      
      

6. DISCLOSURE OF YOUR PERSONAL DATA TO THIRD PARTIES

   1. We store the Personal Data of our users on servers provided by third-party partners and some of the user data, such as messages, flows through certain third-party services. As of now, these partners and services include :

      1. Backend service providers for data storage: Google (Cloud), based in the United States of America ;

      2. Authentication service provider: Google (Firebase), based in the United States of America ;

      3. Messaging services for message flow: Twilio Ireland Limited based in Ireland (e.g., WhatsApp or SMS), and SendBlue (for iMessage), based in the United States of America.

   2. We take all necessary steps to ensure that your Personal Data is processed securely and in accordance with this Privacy Policy and applicable laws. All our partners are committed to protect your Personal Data using procedures similar to ours. These partners have their own privacy policies and terms available online, which we encourage you to review.

   3. To the extent agreed by the user when sending or answering Sherlock chatbot messages through the Platform, Giftit may collect, send and store messages with the chatbot to carry out investigations with the contacts requested and provided by the user, as well as storing the chatbot conversations, irrespective of the existence of a user account. This data may be used for troubleshooting, statistics, analytics, quality assurance, and to monitor system security and can be analyzed to that end.

   4. The purpose of sharing your Personal Data with the above-mentioned third parties is to provide you with the Platform and our services of registering on our Platform, creating accounts and consulting information of other users and phone contacts, as well as to maintain and seek to improve our Platform on an ongoing basis.

      
      

7. DISCLOSURE OF YOUR PERSONAL DATA TO AUTHORITIES

   1. We may use your Personal Data (including your communications) if we think it is necessary for security purposes, to investigate possible fraud and/or attempts to harm other users of our Platform. Hence, we may use your Personal Data to investigate, respond to and resolve complaints or disputes relating to our Platform.

   2. It is possible that we will need to disclose your Personal Data when required by law or if we have good faith belief that disclosure is necessary to:

      1. investigate, prevent, or take actions regarding suspected or actual illegal activities or to assist government enforcement agencies ;

      2. enforce our agreements with you ;

      3. investigate and defend ourselves against any third-party claims or allegations ;

      4. protect the security or integrity of our Platform ; or

      5. exercise or protect the rights and safety of our users, employees, or others.

   3. We attempt to notify users about legal demands for their Personal Data when appropriate in our judgement and technically feasible, unless prohibited by law or by an authority decision or when the request is an emergency. We may dispute such demands when we believe, in our discretion, that the requests are overbroad, vague or lack proper authority, but we do not promise to challenge every demand. 

   4. The purpose of sharing your Personal Data with the aforementioned authorities, is to comply with our duty to comply with a legal obligation to which we are subject.
      
      

8. NO DISCLOSURE OF YOUR PERSONAL DATA FOR COMMERCIAL PURPOSES

   1. We do not sell your Personal Data to third parties. We do not share or otherwise make available your Personal Data to third parties, except as otherwise provided in this Privacy Policy.
      
      

9. CROSS-BORDER COMMUNICATION OF PERSONAL DATA

   1. If, as a result of certain services provided by third parties, we need to transfer your Personal Data to one of their databases outside Switzerland, potentially to a country that does not have a level of personal data protection comparable to that prevailing in Switzerland, unless provided otherwise under this Privacy Policy, we undertake to enter into an agreement with the third-party service provider in order to ensure an adequate level of protection of your Personal Data.

   2. If the level of data protection in a particular country is lower than that applicable in Switzerland, we will ensure under contract the level of protection for your Personal Data is equivalent to that applicable in Switzerland. We shall ensure this through one or more of the following measures :

      1. by concluding EU & Swiss Model Clauses with the appointed services providers, or

      2. through the appointed service providers having in place Binding Corporate Rules (BCR) that are recognised by a European data protection authority.

         
         

10. PROTECTION OF YOUR PERSONAL DATA AND NOTIFICATION OF A PERSONAL DATA BREACH

    1. We are committed to using commercially reasonable means to prevent exposure or disclosure of your Personal Data. In Particular, we implement and maintain measures (including administrative, physical, and technical measures) to manage unauthorised disclosures or exposures of your Personal Data. 

    2. In the event of a data breach, or in the event that we suspect a data breach, we will (i) use our best efforts to promptly notify you, where technically feasible, and (ii) cooperate with you to investigate and resolve the data breach, including without limitation by providing reasonable assistance to you in notifying injured third-parties. We will give you prompt access to such records related to a data breach as you may reasonably request; provided such records shall be our confidential information, and we shall not be required to provide you with records belonging to, or compromising the security of, other users. 

    3. In the event of a data breach, or in the event that we suspect a data breach, we will in addition notify the competent authorities in accordance with applicable law.
       
       

11. MANAGEMENT OF YOUR PERSONAL DATA (YOUR RIGHTS)

    1. Right to access and update your Personal Data: Wherever we process your Personal Data, we take reasonable steps to ensure that your Personal Data is kept accurate and up-to date for the purposes for which it was collected.

    2. Right to delete your Personal Data: You may request the deletion of your Personal Data at any time, subject to any retention obligations imposed on us. You may also delete your account, at any time, which will result in the deletion of your Personal Data. We may retain de-personalized (anonymous) information after the deletion of your Personal Data.

    3. Right of rectification: You have the right to obtain the rectification of your Personal Data if it is inaccurate or incomplete.

    4. Right to object to processing: Within the limits of the law, you have the right to object our processing of your Personal Data.

    5. Right to restriction: You have the right to request that we restrict the processing of your Personal Data.

    6. Right to data portability: You have the right to be provided with a copy of the personal Data we have on you in a structured, machine-readable and commonly used format.

    7. Right to withdraw consent: You have the right to withdraw your consent at any time where we relied on your consent to process your Personal Data. However, it should be noted that such withdrawal: (i) does not affect the lawfulness of any processing carried out prior to such withdrawal and based on your consent; and (ii) may result in you no longer being able to use certain features of the Platform.

    8. Right to complain to a supervisory authority: You have the right to complain to a data protection supervisory authority with regards to our collection and use of your Personal Data.

    9. Right to stop receiving messages from Sherlock with STOP keyword, and to delete all exchanged messages from our systems with the DELETE keyword if you don't have an account on the Giftit app.

    10. We may ask you to prove your identity before responding to a request based on the abovementioned rights or otherwise related to your Personal Data. In order to exercise the abovementioned rights, you may make your request in writing by sending us an e-mail to the following address: info@giftit.social, or by post to the following address: Clausiusstrasse 16, 8006 Zürich, Switzerland.
        
        

12. RETENTION OF YOUR PERSONAL DATA

    1. We retain the Personal Data you provide us with to the extent necessary to provide you access to and use of our Platform and our services, as well as to the extent required to comply with our legal obligations (for example, if we are required to retain your Personal Data under applicable law), to resolve a dispute or to enforce agreements we have entered into and our internal regulations.

    2. We automatically delete any Personal Data from accounts that have been inactive during two (2) years.

    3. We reserve the right to store the data in a depersonalized (i.e. anonymous) form after deletion of your Personal Data.
       
       

13. PERSONAL DATA RELATED TO MINORS

    1. We do not provide services specifically targeted at minors (individuals under the age of 18) and, unless provided otherwise under the present Privacy Policy, notably it’s Section 4.10, we do not proactively collect Personal Data from minors.
       
       

14. SECURITY

    1. Each user agrees to use the Platform at their own risk. We implement commercially reasonable technical, administrative and organizational measures to protect Personal data both online and offline from loss, misuse, and unauthorized access, disclosure, alteration, or destruction. We are not responsible for circumvention of any privacy settings or security measures contained on the Platform, or third party websites. 
       
       

15. AMENDMENT TO THIS PRIVACY POLICY

    1. We may change this Privacy Policy at any time by posting a new version on this page or on a successor page, without prior notification. In this case, you shall be notified of any change to the Privacy Policy through a notice on the Platform home page. By continuing to access or use our Platform after such notification becomes effective, you acknowledge and agree to the processing of your Personal Data in accordance to the revised Privacy Policy. If you do not agree to the new terms, please do not use the Platform. If you do not wish your Personal Data to be processed in accordance with the revised Privacy Policy, please do not use our Platform.

    2. The new version of the Privacy Policy will become effective on the date it’s posted, which will be listed at the top of the page as the new effective date. 
       
       

16. QUESTIONS? 

    1. Should you have questions or complaints regarding the present Privacy Policy, please contact us by e-mail at info@giftit.social

    2. You can also reach us by post at Clausiusstrasse 16, 8006 Zürich.