The joy is in the giving.
Privacy
Your information accompanies the moments you organize. This notice explains the purposes, access and choices around that information.
Who is responsible?
Controller: [full legal name and legal form]. Address: [service address]. Privacy contact: [email]. Data protection officer, where applicable: [contact or confirmed non-applicability].
Your event information
Giventra processes account details, event and membership information, invitation replies, wishlist entries and gift commitments to provide the event experience. Secret exchanges also involve private assignments. Please avoid entering sensitive personal information that is not needed for your event.
When someone invites you
An organizer may supply your name and email address so that Giventra can send a personal event invitation. Your replies and the information you later enter come from you. Opening an invitation does not accept it or subscribe you to marketing. [Confirm invitation legal basis, legitimate-interest balancing and the organizer’s privacy responsibilities before publication.]
Purposes and legal bases
Account and requested service: [confirm scope of Article 6(1)(b) GDPR]. Invitations and operational security: [confirm Article 6(1)(f), specific interests and safeguards for each purpose]. Legal obligations: [identify obligation and Article 6(1)(c), if applicable]. Optional processing based on consent: [identify purpose and Article 6(1)(a), if used]. Each purpose requires its own confirmed basis; an invitation is not blanket consent.
Who receives information?
Event information is shown according to the event’s access and visibility rules. A private invitation link gives access to its holder and should not be forwarded. Service providers supporting hosting and email: [names, roles, processing locations and contracts]. Transfers outside the EEA: [confirm whether any occur, countries, safeguards and how to obtain a copy].
How long information is kept
[Insert verified periods or deletion criteria separately for accounts, events, invitations, delivery records, security logs and backups, including legal exceptions.] Moving an event to Archive changes its position in your event list; it does not delete its data.
Your rights and contact
Where the legal conditions apply, you can request access, correction, erasure, restriction or portability of your personal data. You can object to processing based on legitimate interests. Consent can be withdrawn for the future without affecting earlier lawful processing. Contact: [verified privacy contact]. You may complain to a supervisory authority, including where you live or work; competent authority: [name and contact].
Required information and automated processes
Information needed for an account or invitation enables the relevant service; without it, that feature may be unavailable. Optional wishes are your choice. A Secret Exchange uses an automated draw to assign participants. [Confirm mandatory fields, whether any processing falls under Article 22 GDPR, and any relevant logic, significance and consequences.]
Links, storage and changes
When you follow a merchant or other external link, that operator’s privacy information applies to its service. Browser storage is described on our Cookies & storage page. [Confirm access-log fields and retention, all embedded services, any optional analytics and consent controls.] Version: draft 2026-09-11. Effective date: [after approval].