Privacy Policy

GIFTVERSE

Last Updated: August 01, 2024

This Privacy Policy (the "Privacy Policy") describes how Giftverse LTD ("Giftverse", "we", "us", "our") processes the following categories of personal data:

"Customer Data" means data provided or generated on the Platform that Giftverse processes on behalf of and under the instruction of a legal entity with whom Giftverse has signed an agreement for the provision of the Services ("Customers").

"End-User Data" means data concerning any individuals who receive a link to access and use the Platform, mainly to choose and receive their gift ("End-User", "you" or "your").

"Visitor Data" means data relating to visitors of the website www.giftverse.ai (the "Website"), who visit or otherwise interacts with our Website, or receives emails or communications under our control ("Visitor", "you" or "your").

Giftverse provides an artificial intelligence tool through Giftverse's Software-as-a-Service platform ("Platform") to personalize gifts chosen by its End-Users or by the Customer’s admins (Tennant) according to their preferences (collectively, "Services").

Please note that this Privacy Policy supplements our Terms of Use.

Please see our full Privacy Policy below in order to better understand our practices in detail. If you have questions or concerns regarding this Privacy Policy please contact us at: adele.r@giftverse.ai

This Privacy Policy is divided into the following sections:

Section 1 Data Controller/Data Processor

Section 2 What personal data do we process about you?

Section 3 For what purposes do we use your personal data?

Section 4 With whom do we share your personal data?

Section 5 How is your personal data transferred outside of the European Economic Area and/or Israel?

Section 6 How long do we store your personal data for?

Section 7 How do we keep your personal data secure?

Section 8 Additional information for consumers in California

Section 9 What rights do you have regarding your personal data?

Section 10 Does this Privacy Policy apply to third party links?

Section 11 What is our policy regarding minors?

Section 12 How do we approach changes to this Privacy Policy?

Section 13 Contact us

DATA CONTROLLER/DATA PROCESSOR

Giftverse is the data controller of Visitor Data. With respect to such data, we assume the responsibilities of data controller, as set forth in this Privacy Policy.

When the Customer (i.e., mainly companies wishing to offer gifts to their employees) enters into an agreement with Giftverse, we are the data processor of Customer Data, which we process on behalf of our Customer who is the data controller of such data. Accordingly, Giftverse processes Customer Data strictly in accordance with our Customer’s reasonable instructions and as further stipulated in our agreements with such Customer.

Giftverse is both a data controller and data processor of End-User Data. Such data is processed by Giftverse for its own purposes (as described in Section 3 below), as an independent data controller; whilst those certain portions of it which are included in Customer Data will be processed by us on our Customer’s behalf, as a data processor.

WHAT PERSONAL DATA DO WE PROCESS ABOUT YOU?

When we use the term "personal data" in this Privacy Policy, we mean information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to an individual.

Collection of personal data – General provisions

We hereby inform you, and you hereby acknowledge that you have no legal obligation to provide us with any personal data when you use the Website and/or Platform, and the provision of it is solely based on your free will, but without such personal data we may not be able to provide our part Services.

Personal data the Customer provides us with

Personal data contained in Customer Data provided by our Customers, namely your full name and email address is processed on the Customer’s behalf and under their instruction in accordance with our agreement with the Customer.

Personal data you provide us with

We may collect or generate the following types of personal data about individuals through the Website and/or Platform or to access to the Platform:

End-User Data

Identification data (i.e., fist name, last name, postal address, zip code, country);

Contact details (i.e., work email, phone number);

Gift preferences (e.g., characteristics of your personality among those suggested, such as ‘game changer’, ‘good vibe person’, ‘true genius’, ‘explorer’, etc; your hobbies among those suggested, such as ‘cooking lover’, ‘sport and fitness’, ‘nature & outdoor fan’, ‘pet lover’, etc; your dislikes among those suggested, such as ‘cooking lover’, ‘sport and fitness’, ‘nature & outdoor fan’, ‘pet lover’, etc; as applicable, the name of the foundation to which you choose to donate); or the name of a website or a store that you share that you’d like to receive a digital gift card to;

Data related to your exchange with Giftverse for requests (e.g., date and subject of your requests, exchanges with our services).

Visitor Data

Identification data (i.e., first name, last name);

Contact details (i.e., work email address);

Calendar information for a ‘Platform Tour’ (i.e., time and date of the online Platform demonstration and any other information you choose to share preparing such meeting.)

End-User Data and Visitor Data that we collect automatically from you

Each time you interact with the Website and/or Platform we may automatically collect the following personal data through cookies and other tracking technologies:

Electronic network activity information, (e.g., connectivity; Internet protocol (IP) address; date and time of the use; time and length of the use; location, device data (like type, OS, device id, browser version, locale and language settings used, operating system); activity log; session recordings; log-in credentials to the Services).

To collect this data we use cookies and other tracking technologies (hereinafter "Cookies"). Cookies are small text files sent by your browser to your device to store or retrieve information on your browser or device. Cookies can be persistent (Cookies that remain on your device for a set period of time or until you delete them) or session (Cookies that are deleted as soon as you close your browser). When you interact with the Website and/or Platform, we and our third-party providers may place Cookies on your device. These Cookies are (i) "analytics" cookies which allow us and our analytics providers to recognize and count the number of Users in the Website and/or Platform, see how Users interact with the Website and/or Platform and different functions, and when Users are using the Services to improve the Website and/or Platform; and (ii) "social networks" Cookies which allow you to log in and authenticate to your account.

The Cookies we use are the following:

FOR WHAT PURPOSES DO WE USE YOUR PERSONAL DATA?

We may process the following categories of personal data through the Website and/or Platform, for the following purposes:

END-USER DATA AND VISITOR DATA

Purposes

Example of use of End-User Data and Visitor Data

EU Legal Basis

Managing your requests

to answer your questions
to contact you if necessary
to schedule a demonstration of the Platform

Legitimate interest of Giftverse to manage its requests

Marketing and promotional purposes

to send you marketing communications

Your consent

Improving our Services

to de-identified and aggregate personal data
to improve and train our artificial intelligence tool
to evaluate, develop, enhance, analyze and improve the Website and Platform

Legitimate interest of Giftverse to improve its Platform and the Website and User’s experience

Supporting and enhancing our data security measures

to monitor, investigate bugs, and improve the Website and Platform
to prevent and mitigate the risks of fraud, error or any illegal, criminal or prohibited activity.

Legitimate interest of Giftverse to secure its Website and/or Platform and User’s experience

Pre-litigation or litigation management

to take action against any identified security breach
to manage any dispute or litigation

Legitimate interest of Giftverse in defending its rights and interests

Compliance with legal and regulatory obligations

to perform any reporting and notifications obligations we may be subject to, to competent governmental agencies and authorities
to process your requests to exercise your rights

Legal and regulatory obligations to which Giftverse is subject

CUSTOMER DATA AND END-USER DATA

We process Customer Data on behalf of our Customers (as described in Section ‎1). Therefore, Customers, as data controllers are responsible for determining the purposes and legal basis.

We process some part of End-User Data as data processor (as described in Section ‎1) to enable Customer’s End-Users to choose their gift, personalize their gift based on their preferences and received gift. Therefore, for such processing Customers, as data controllers, are responsible for determining the purposes and EU legal basis.

WITH WHOM DO WE SHARE YOUR PERSONAL DATA?

Recipients

Purposes

Service providers and sub-contractors (including hosting, data security services, billing and payment processing services, fraud detection and prevention services, product analytics, session or activity recording services, remote access services, content transcription and analysis services, performance analytics, content and data enrichment providers, insurers)

To perform services on our behalf or complementary to our own. Depending on each of their specific roles and purposes in facilitating and enhancing our Services, and may only use the data as determined in our agreements with them.

Business Partners

To provide the most appropriate gift according to your preferences provided by third party platforms and websites.

You may provide your personal data to such third parties platform and website to purchase products and services of your choice. Please note that we are not responsible for personal data processed by such third parties. These third parties have their own terms and conditions and privacy policies, and you should read these carefully before you submit any personal data to these third parties. We do not endorse or otherwise accept any responsibility or liability for the personal data provided to such third-party platforms and websites

Governmental, administrative or judiciary authorities

Exclusively in case of a subpoena, search warrant or court order (or similar requirement), or in compliance with applicable laws and regulations.

Such disclosure or access may occur if we believe in good faith that: (a) we are legally compelled to do so; (b) disclosure is appropriate in connection with efforts to investigate, prevent, or take action regarding actual or suspected illegal activity, fraud, or other wrongdoing; or (c) such disclosure is required to protect our legitimate business interests, including the security or integrity of our services.

Lawyers and all interested parties

Exclusively in the case of the management of possible disputes and other legal matters where appropriate

Other third parties

In connection with any proposed or actual reorganization, restructuration, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of Giftverse business, assets or stock (including in connection with any bankruptcy, insolvency or similar proceedings)

HOW IS YOUR PERSONAL DATA TRANSFERRED OUTSIDE OF THE EUROPEAN ECONOMIC AREA AND ISRAEL?

How is your personal data transferred outside of Israel?

When we transfer personal data from Israel to a third country outside Israel, the transfer takes place on the basis of:

a country declared as offering equivalent level of protection by the Israeli Privacy Protection Authority; or

you consent to transfer your personal data to other jurisdictions, understanding that in some countries the level of protection may be lower than the level under Israeli law.

How is your personal data transferred outside of the European Economic Area ("EEA")?

When we transfer personal data from within the EEA to countries or international organizations that are based outside the EEA, the transfer takes place on the basis of:

an adequacy decision by the European Commission; or

in the absence of an adequacy decision, other legally permitted safeguards such as standard contractual clauses (“SCCs”) for the transfer of personal data to third countries.

HOW LONG DO WE STORE YOUR PERSONAL DATA FOR?

We retain personal data for as long as we deem it as reasonably necessary in order to maintain our relationship and provide you with our Website and Services, as required by applicable laws and/or to fulfill our legitimate interests.

Other circumstances in which we will retain your personal data for longer periods of time include: (i) where we are required to do so in accordance with legal requirements, or (ii) for us to have an accurate record of your interaction with us in the event of any inquiries or contact requests, or (iii) if we reasonably believe there is a prospect of litigation.

Customer Data and End-Users that we process on behalf of our Customers (as described in Section ‎1) is processed only on behalf of Customers. Therefore, Customers are responsible for determining the retention period. We will process personal data under their instruction and will delete it from our system in accordance with our agreement with such Customer. If you have questions or concerns regarding Customer Data retention period, please contact the respective Customer directly.

HOW DO WE KEEP YOUR PERSONAL DATA SECURE?

Giftverse has implemented technical and organizational measures to protect personal data, in particular against potential data breaches, either by accident or unlawfully, and against the destruction, loss, modification, unauthorized access or divulgation. However, we do not promise or guarantee that any personal data will be absolutely protected from unauthorized disclosure or use.

We restrict (and require our service providers to restrict) access to personal data to personnel who need to know that personal data to provide our Website and/or Platform. If you have found a vulnerability or would like to report a security incident, you may send an email to adele.r@giftverse.ai

ADDITIONNAL INFORMATION FOR CONSUMERS IN CALIFORNIA

Categories of personal data collected

We collect the personal data detailed in Section ‎2 above. This information includes the following categories of personal information as defined under Californian law:

Identifiers
Personal Information described in California Section 1798.80(e)
Commercial Information
Internet or other electronic activity information
Inferences

Categories of personal data disclosed for business purposes

We may disclose the categories of personal data described above for the business purposes outlined in Section ‎3. The recipients to whom we may disclose your personal data (and that may have received such personal data during the last 12-months) for business purposes include: hosting, data security services, billing and payment processing services, fraud detection and prevention services, product analytics, session or activity recording services, remote access services, content transcription and analysis services, performance analytics, insurers.

Categories of personal data shared with third parties

We will not sell or otherwise disclose Personal Data for monetary or other consideration to any third parties (and have not done so over the last twelve (12) months).
We will not share your Personal Data for cross-contextual behavioral advertising (and have not done so over the last twelve (12) months).

WHAT RIGHTS DO YOU HAVE REGARDING YOUR PERSONAL DATA?

General provisions

Individuals have rights concerning their personal data depending on their jurisdiction. At any time, you may contact us at adele.r@giftverse.ai and request to know what personal data we store about you. We will consider all such requests and provide our response within a reasonable period (and in any event within any time period required by applicable laws).

When you ask us to exercise any of your rights under this Privacy Policy and the applicable laws, we may need to ask you to provide us with certain credentials to make sure that you are who you claim you are, to avoid disclosure to you of personal data which is related to others that you are not authorized to receive, and to ask you questions to understand better the nature and scope of data that you request to access.

We may redact from the data we will make available to you any personal data related to others.

Customer Data requests

Customer Data that we process on behalf of our Customers (as described in Section ‎1) is processed only on behalf of Customers. Therefore, Customers, as data controllers are responsible for answering and implementing your request to exercise your rights. If you send your request to us, we will transfer it to the respective Customer in accordance with our agreement with such Customer.

You may also send your request to exercise your rights to the respective Customer directly.

Israeli data subjects rights

If you are based in Israel, you are entitled to request us to:

review your personal data that we process;

update, amendment, and deletion of personal data which is incomplete or outdated.

EU data subjects rights

If you are based in the EEA, you are entitled to request us to:

access your personal data in order to obtain clear, transparent and understandable information on how we process your personal data and on your rights (as provided in this Policy), as well as a copy of your personal data;

rectify your personal data in case your personal data are obsolete, inaccurate or incomplete;

object the processing of your personal data when the processing is based on Giftverse’s legitimate interest. Giftverse will no longer process your personal data unless Giftverse demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms, such as the respect of a legal obligation (e.g. legal obligation involving the retention of documents), or for the establishment, exercise or defense of legal claims;

in certain circumstances under applicable laws, restrict the processing of some of your personal data during a limited period of time;

withdraw your consent when it has been obtained and processing is based on consent;

in certain circumstances under applicable laws, request data portability, meaning that you can receive the personal data originally provided by you in a structured and commonly used format or that the data subject can request the transfer of the personal data provided by him or her to another data controller;

in certain circumstances under applicable laws, delete your personal data (also known as the right to be forgotten);

not to be subject to any automated decision making and profiling;

lodge a complaint with your national data protection authority.

If you have a complaint about how we use your personal data, we would always prefer you to contact us first. However, you may also make a complaint to your local data protection authority in the EEA country where we are based. If you are unsure which data protection authority to contact, please contact us at adele.r@giftverse.ai

California residents rights

If you are a Californian resident, you are entitled to request us to:

access your personal data by requesting what personal data we collect about you within the preceding twelve (12) months, including the categories of personal data, the sources from and purposes for which we collect it, and the types of recipients we disclose it, and to request a copy of the specific pieces of personal data that we maintain about you;

subject to certain exceptions, delete your personal data;

correct inaccurate personal data;

opt-out of "sales" or "sharing" of your personal data to third parties;

not receive discriminatory treatment if and when you exercise your rights to access, delete, or opt-out.

Only you, or a person registered with the California Secretary of State that you authorize to act on your behalf, may make a request related to your personal data. If you are an authorized agent making a request on behalf of another individual, you must provide us with signed documentation that you are authorized to act on behalf of that individual.

DOES THIS PRIVACY POLICY APPLY TO THIRD PARTY LINKS?

You may, during your use of the Website and/or Services, access links to or other websites and platforms operated by third parties outside of Giftverse, including when the gift you choose according to your preferences is provided by third party platforms and websites. Please note that this Privacy Policy only applies to personal data that we (or third parties on our behalf) collect from or about you and we cannot be responsible for personal data collected and processed by third parties. Third party websites and platforms have their own terms of use and privacy policies, and you should read these carefully before you submit any personal data to these websites and platforms. We do not endorse or otherwise accept any responsibility or liability for the content of such third-party websites or third-party terms and conditions or policies.

WHAT IS OUR POLICY REGARDING MINORS?

The Website and/or Platform are not intended for persons under 18 and we do not knowingly collect and process personal data relating to minors under 18. If these age requirements are not met, you are required to avoid using the Platform.

HOW DO WE APPROACH CHANGES TO THIS PRIVACY POLICY?

We will change this Privacy Policy from time to time. Any changes we make to our Privacy Policy in the future will be posted on this page. The effective date of any change of Privacy Policy will be clearly marked on the top of each new Privacy Policy posted.

If you have any comments or questions regarding this Privacy Policy or the information practices in connection with the Website and/or Platform, please contact us at adele.r@giftverse.ai