Privacy Policy

1. Who we are

GWP ("GWP", "we", "us") is a gift-with-purchase marketplace operated by [LEGAL ENTITY]. We provide an on-page unit ("the widget") that participating online retailers ("hosts") embed on their basket and order-confirmation pages, offering shoppers advertiser-funded free gifts. Our website is gwpingenuity.com.

You can contact us about anything in this policy at [PRIVACY EMAIL]. We are registered with the UK Information Commissioner's Office under registration number [ICO REG NO].

[LEGAL REVIEW: confirm registered address, company number and whether GWP acts as controller, joint controller or processor for each processing activity below.]

2. What this policy covers

We process personal data about four groups of people, and what we hold differs sharply between them:

• Shoppers who see or use the widget on a host retailer's site;
• Shoppers who opt in to a gift-reminder email;
• Demo leads who submit our "book a demo" form;
• Dashboard users at our host and advertiser partners.

3. Data we process

3.1 Shoppers (via the widget)

The widget is deliberately built to process as little as it can, and most of what it processes is pseudonymous. The two exceptions, your customer account number and your email address, are processed only on sites that switch on the feature that needs them, as described below. When it runs on a host's page it processes:

• an opaque click-identifier ("clid") generated when you interact with an offer — a random reference that is not derived from your name, email or device fingerprint;
• a session reference used for frequency capping and attribution;
• your gift selection (which offer you chose);
• a basket snapshot — the basket's total value, currency and item lines — used to decide whether and which offers to show;
• your resolved consent state as reported by the retailer's consent management platform (see our Cookie Policy);
• telemetry events (for example: the unit rendered, an offer was viewed or clicked) used for reporting and billing;
• your IP address, transiently, for rate limiting and abuse prevention — it is not stored with attribution records;
• where a retailer's own server adds your gift to its order-confirmation email, your customer account number with that retailer, kept only as a keyed hash (see below);
• where a retailer has us email you the link to claim your gift, the email address you sign in with or type in for that email, kept encrypted (see below);
• truncated error diagnostics if the widget encounters a fault, so we can fix it.

Gifts in a retailer's order-confirmation email: some retailers add the gifts you chose to the order-confirmation email their own server sends while your order is being placed. On those sites only, while you are signed in, the widget reads your customer account number from the page. It sends the number to us only while your device holds a gift you chose, together with those gifts, and once more with an empty list when they are gone (for example because you removed them, an order used them, or you withdrew your consent where the retailer does not use essential mode), so that we delete our copy. Until then your device keeps a short hash of the site and your customer account number (gwp_gsync, not the number itself), so that it knows that empty list is owed. All of this happens in essential mode too, that is, where you have refused cookies or not answered the retailer's cookie banner and the retailer allows that mode (see our Cookie Policy). When you order, the retailer's server sends us the same number with your order number (and may send the order total, to check a gift's minimum spend). We use the number only to put the gifts you chose in that order's email. We never store the number itself, only a keyed hash of it (a one-way code made with a secret key): with your current gift list for as long as it holds a gift, and at most 30 days after your device last sent it; and with the order number and that order's gifts, if any, for 60 days, for every order the retailer's server asks us about.

Gift links emailed for the retailer: some retailers have us email you the link to claim your gift after you order, from the retailer's own email domain. On those sites only, we get your email address in one of two ways:

• when you sign in to the retailer's site, if your cookie choices allow the widget's full mode (you have accepted the cookies it needs, or the retailer's site does not ask and the retailer lets the widget run in full mode without asking; never in essential mode), the widget reads the address in the email field of the sign-in form as you submit it. It never reads your password or any other field. It holds the address in memory and keeps it only once the sign-in has worked, forgetting it if that is not clear within 20 seconds. It then encrypts the address on your device so that only GWP can read it, and keeps that encrypted copy on your device for at most 24 hours, together with a SHA-256 hash of the address (the same form of hash many retailers already publish for advertising) used only to check that the address still belongs to the account signed in. That hash is not encrypted, and other scripts on the retailer's page can read it (see our Cookie Policy);
• or you type an address into the order-confirmation page, to have the link sent there.

On the order-confirmation page the widget sends the address to us with your order number and the gifts you chose. We keep it encrypted, with a keyed hash of it (used to limit how many of these emails one address can receive in a day) and the order number, for 90 days, so that the email can be resent if it goes astray; the retailer's support team sees only a masked form of it (for example j•••@example.com). We decrypt it only to check it (its age, our suppression list and that daily limit), to send the email, which goes through Twilio SendGrid (section 5), and to show the retailer's support team that masked form. We do not send it to an address on our suppression list. This is separate from the gift-reminder opt-in in section 3.2.

What the widget never collects: it does not read or receive your name, postal address, payment card details, password, or any other checkout or sign-in form data, apart from the sign-in email address described above. It never changes the items or prices in the retailer's cart or order. Where a retailer has enabled order-confirmation gift emails, the widget writes gwp_-prefixed metadata attributes to the cart (the gift's name, brand, claim link and image link — no directly identifying data, though the claim link carries the same pseudonymous click-identifier described in section 3.1) so the retailer's own confirmation email can show the gift you picked; it changes nothing else.

3.2 Shoppers who opt in to a gift reminder

If — and only if — you explicitly tick the opt-in when claiming a gift, we store the email address you provide, together with an unsubscribe token, so we can send you a single reminder about the gift you selected. Every email carries a one-click unsubscribe link, and unsubscribed addresses are placed on a global suppression list so we do not email them again.

3.3 Demo leads

When you submit the form on our demo page we store the seven fields you enter — first name, last name, work email, company, role, store URL and monthly order range — together with a record of the consent you give on the form. We use these details to contact you about your demo and our services.

3.4 Dashboard users (host and advertiser teams)

For people who use the GWP partner dashboard we store your name, email address and role, invitation tokens used to set up your account, and an audit trail of significant actions taken in the dashboard (for security and accountability). Bank details entered for payouts are stored masked in the interface.

4. Lawful bases

[LEGAL REVIEW: lawful-basis mapping below to be confirmed by counsel, including for gifts in a retailer's order-confirmation email (section 3.1: the customer account number is sent in essential mode too, and a short hash of it is then kept on the device, and, where the retailer does not use essential mode, the number is sent once more after consent is withdrawn, only to delete the gift list) and for gift links emailed for the retailer (section 3.1: the sign-in email address is read only where the shopper's cookie choices allow the widget's full mode, which under the default posture includes a site with no consent banner, and there is no separate opt-in to that email).]

• Consent — for the gift-reminder email (explicit opt-in) and for any storage on a shopper's device that is not strictly necessary, as reported through the retailer's consent platform;
• Legitimate interests — for the pseudonymous attribution, fraud prevention, telemetry, demo-lead follow-up and dashboard administration described above, balanced against the minimal footprint involved;
• Contract — for providing the dashboard and paying our partners.

5. Who we share data with

We use a small number of subprocessors to run the service:

We also share attribution data with the relevant host retailer and advertiser so that conversions can be validated and commission paid — this is limited to the pseudonymous identifiers and event data in section 3.1, never your email address (a retailer that has us email your gift link sees only the masked form described in section 3.1). We may disclose data where required by law.

6. International transfers

Some of the providers above process data in the United States. Where personal data is transferred outside the UK or EEA, we rely on the UK International Data Transfer Agreement and/or the EU Standard Contractual Clauses with the relevant provider. [LEGAL REVIEW: confirm transfer mechanism and transfer risk assessments for each subprocessor.]

7. How long we keep data

[LEGAL REVIEW: retention periods below to be confirmed by counsel.]

8. Your rights

Under UK and EU data protection law you can ask us to: access the personal data we hold about you; correct it; erase it; restrict or object to our processing of it; and receive a portable copy. Where processing is based on consent, you can withdraw that consent at any time (for reminder emails, the one-click unsubscribe link does this immediately).

To exercise any of these rights, email [PRIVACY EMAIL]. Because most shopper data we hold is pseudonymous, we may need to work with you (and the retailer whose site you used) to locate records tied to your click-identifier.

9. Complaints

If you are unhappy with how we have handled your personal data, please contact us first at [PRIVACY EMAIL] so we can try to put it right. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or by phone on 0303 123 1113, or to your local EU supervisory authority.

10. Changes to this policy

We will post any changes to this policy on this page and update the "Last updated" date above. Material changes affecting opted-in shoppers or partners will be notified directly where we are able to.