1. Who we are and how to contact us

Inispo Ltd is the data controller for the personal data described in this policy. We are registered with the Information Commissioner's Office (ICO) under registration number CSN0928645.

Registered office: 128 City Road, London, England, EC1V 2NX.

For anything to do with your personal data — including a request to exercise your rights, or a complaint — email support@inispo.com with "Data protection" in the subject line.

2. What we collect

Information you give us:

• Account details: name, email address and password. Your password is held by Amazon Cognito, our authentication provider, and we never see it.
• Profile details: country, currency preference, profile photo and, where you provide it, a phone number.
• Anything you send us: support tickets, contact form messages and the correspondence that follows.
• Verification information: if we review your account for fraud or security reasons, the information and documents we ask you for, such as an identity document, proof of address, a bank or card statement, a photograph of your payment card with most digits covered, receipts, and any additional information or documents we ask for during the review. Section 13 of our Terms & Conditions explains when and why we ask for them.

If you take part in our referral programme:

• Your username, which is part of your public referral link and which you cannot change.
• Who referred you, if anybody, and the customers you referred.
• Your Rewards, and every deduction, purchase and withdrawal made with them, with the order each Reward came from.
• Before your first cash withdrawal: your full legal name, date of birth, residential address, a verified mobile number and the details of a UK bank account in your name.

Information created when you use the Service:

• Order and Wallet records: what you bought, when, the price, the order status, and whether and when you revealed each card.
• Device information: device model, operating system and a device identifier. We keep a record of the devices used on your account, because a first sighting of an unfamiliar device is one of our fraud signals.
• Usage information: pages and features used, and the times you used them.
• Network information: IP address and browser type.

Payment information:

Card details are entered directly into a payment form hosted by Stripe and are processed by Stripe. We do not receive or store your full card number, expiry date or security code. From Stripe we receive a payment reference, the amount, the currency, the outcome, and the last four digits and brand of the card.

We also receive from Stripe the results of its fraud checks — a risk level, a risk score, and notifications of disputes and early fraud warnings. Section 5 explains what we do with these.

3. Why we use it, and our lawful basis

• To sell you Gift Cards and run your account — taking payment, delivering cards to your Wallet, sending order confirmations and receipts, handling refunds and support requests. Lawful basis: performance of our contract with you (UK GDPR Article 6(1)(b)).
• To prevent fraud and keep accounts secure — the checks described in section 5, and checking the verification information you send us during a review. Lawful basis: our legitimate interests in preventing fraud against us, against payment providers and against our customers (Article 6(1)(f)), and in some cases our legal obligations.
• To run the referral programme — recording referrals, calculating Rewards, letting you spend them, and checking your identity and bank account before we pay a withdrawal. Lawful basis: performance of our contract with you (Article 6(1)(b)), and our legitimate interest in preventing fraud (Article 6(1)(f)).
• To keep the records the law requires — tax, accounting and anti-money-laundering records. Lawful basis: compliance with a legal obligation (Article 6(1)(c)).
• To send you marketing — offers and product news, only where you have opted in. Lawful basis: your consent (Article 6(1)(a)), which you can withdraw at any time.
• To investigate complaints and defend legal claims — including disputes about a purchase or a chargeback. Lawful basis: our legitimate interests in establishing and defending legal claims (Article 6(1)(f)).

4. Transactional messages and marketing

We send transactional messages — order confirmations, delivery notifications, refund notices, security alerts and replies to your support tickets — because they are part of providing the Service. You cannot opt out of these while you hold an account, but they contain no marketing.

Marketing emails and push notifications are sent only if you opt in. Every marketing email has an unsubscribe link, and you can change your preferences in your account settings at any time. Unsubscribing from marketing does not stop transactional messages.

5. Fraud prevention and automated decisions

Gift cards are bought with stolen payment cards more often than most products, so we run automated fraud checks on account activity and purchases. This is profiling under the UK GDPR, and we want to be clear about it.

What we look at. Repeated declined payments, repeated purchases of the same product in a short period, sign-ins from an unfamiliar device, repeated attempts to register with an email address that already belongs to an account, frequent changes to sensitive profile fields, bursts of refused or rate-limited requests, mismatches between the price you were quoted and the price submitted, and the fraud signals Stripe sends us, including Stripe Radar risk levels, payment disputes and early fraud warnings.

What happens. Each signal adds to a risk score for your account, and the score decays over time. Most signals do nothing on their own. A high enough score opens a case for a member of our team to look at. A small number of signals — principally an issuer or card network confirming that a charge was fraudulent — can block an account automatically, because that is a confirmed finding rather than an estimate.

Your right to a human decision. Where a restriction was applied automatically and it has a significant effect on you, you have the right under Article 22 of the UK GDPR to ask for it to be reviewed by a person, to give us your side of it, and to contest the decision. Email support@inispo.com and say that you want a human review. A member of our team, not a system, will make the final decision.

Our Terms & Conditions explain what a restriction does and does not affect, including that it does not automatically invalidate Gift Cards you bought legitimately.

6. Who we share your data with

We do not sell your personal data, and we do not share it with advertisers. We share it only with the following, and only with what each of them needs:

• Stripe (Stripe Payments UK, Ltd. and Stripe, Inc.) — to take payments, issue refunds and run payment fraud checks. Stripe is a controller in its own right for its fraud prevention, and its own privacy policy applies to that.
• Other customers, in the referral programme only — your username is visible to anybody who sees your referral link. If you were referred, your referrer can see the Rewards they earned from your purchases, with their dates, amounts and an order reference; the face value of your purchases can be worked out from these. Your referrer cannot see your name, your email address or which Gift Cards you bought.
• Our bank — to send a referral withdrawal to your bank account. This includes your name and bank account details.
• Amazon Web Services — our hosting provider. Every part of the Service runs on AWS, including Amazon Cognito, which holds your login credentials. See section 7.
• Gift card suppliers and distributors — the minimum needed to obtain the card you ordered. This is normally the product and quantity and an order reference, and does not include your name or email address.
• Google — our web pages load fonts from Google Fonts. Loading a file from Google Fonts discloses your IP address and browser type to Google. It is not used to track you across sites.
• Law enforcement, regulators, and our professional advisers — where we are legally required to disclose, where we report suspected fraud or another crime, or where we need to establish or defend a legal claim.

We do not use analytics, advertising or session-recording services, and no third-party tracking scripts run on our website or in our application.

7. Where your data is processed

Inispo's infrastructure runs in Amazon Web Services' US East (N. Virginia) region. This means your personal data — including your account details, order history and Wallet — is stored and processed in the United States, not in the United Kingdom or the European Economic Area.

Stripe processes payment data in the United States and in the United Kingdom. Google serves the font files described in section 6 from servers worldwide.

8. International transfers and the safeguards we rely on

Because your data is processed outside the United Kingdom, we rely on the safeguards permitted by Article 46 of the UK GDPR:

• Amazon Web Services: the AWS Data Processing Addendum, which incorporates the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum issued by the ICO.
• Stripe: Stripe's data processing agreement, which incorporates the Standard Contractual Clauses and the UK International Data Transfer Addendum.

You can ask us for more detail about these safeguards by emailing support@inispo.com.

9. Cookies and similar technologies

Our website does not set advertising or analytics cookies, and we do not show a cookie banner because there is nothing optional to consent to.

We store a small amount of information in your browser's local and session storage so that the Service can work: your sign-in session, your currency and display preferences, and the state of a checkout in progress. This is strictly necessary to provide the service you asked for, so under the Privacy and Electronic Communications Regulations it does not require your consent. Clearing your browser storage signs you out.

The Stripe payment form on our checkout page sets its own cookies, which Stripe uses to process the payment and to detect fraud. These are necessary for the payment to work. Stripe's use of them is covered by Stripe's own privacy policy.

10. How long we keep your data

We retain financial records for the period required by applicable law. Other personal information is retained only for as long as necessary for its stated purpose. In practice:

• Order, payment and refund records: six years from the end of the relevant accounting period, because HMRC requires it. We keep these even after you close your account, and we cannot delete them on request.
• Account and profile data: for as long as your account is open. When you close your account we delete it, except for the financial records above and anything we must keep for an unresolved dispute or investigation.
• Gift card codes in your Wallet: until the card expires or is refunded, and then deleted.
• Fraud signals and risk records: for as long as they remain relevant to preventing further fraud, and no longer than six years.
• Referral records: your referral, Rewards, deductions and withdrawals are financial records and are kept like the order records above. A negative Referral balance is kept until it has been cleared. A username is never given to anybody else, so the record that it was yours is kept for as long as the referral records are.
• Identity and bank details for referral withdrawals: for as long as you can make withdrawals, and then six years after your last withdrawal.
• Verification documents: when a review ends with no concern remaining, we delete them within 90 days of the end of the review. When a review confirms fraud, or leads to a dispute or a legal claim, we keep them with the fraud and risk records above, for no longer than six years.
• Support tickets and correspondence: three years after the matter is closed.

You can ask us to close your account from the account deletion page, or by emailing us.

11. How we protect your data

• In transit: all traffic between your device and our systems is encrypted with TLS.
• At rest: stored data, including gift card codes, is encrypted using AWS Key Management Service.
• Gift card codes: a code is only decrypted when you reveal it, and it is not displayed anywhere in the Service before then.
• Access control: access to customer data inside Inispo is restricted by role, and is limited to staff who need it to do their job.
• Review: we review our security arrangements and our code for security defects on an ongoing basis.

12. Your rights

Under the UK GDPR you have the right to:

• Access a copy of the personal data we hold about you.
• Rectification of data that is inaccurate or incomplete.
• Erasure of your data, where we have no continuing lawful reason to keep it. Financial records we are legally required to retain are an exception.
• Restriction of how we use your data while a question about it is resolved.
• Portability — to receive the data you gave us in a structured, commonly used, machine-readable format.
• Object to processing we carry out for our legitimate interests, including profiling. You can object to direct marketing at any time and we will stop.
• Withdraw consent where we rely on it, without affecting anything we did before you withdrew it.
• Human intervention in an automated decision that significantly affects you, as described in section 5.

To exercise any of these, email support@inispo.com. We respond without undue delay and normally within one calendar month, subject to any extensions or timing rules permitted by law. If a request is particularly complex we may extend this, and we will tell you within the first month if we do. We do not charge for responding.

13. Complaints about how we handle your data

If you are unhappy with how we have handled your personal data or a request about it, email support@inispo.com with "Data protection complaint" in the subject line. We will acknowledge your complaint within three working days and give you a written answer, with our reasons, within one calendar month.

You can also complain to the ICO at any time, and you do not have to come to us first. The ICO can be reached at ico.org.uk, on 0303 123 1113, or at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. We would still appreciate the chance to put things right ourselves.

14. If there is a data breach

If a personal data breach occurs and it is likely to result in a risk to your rights and freedoms, we will report it to the ICO without undue delay and within 72 hours of becoming aware of it, as required by Article 33 of the UK GDPR.

If the breach is likely to result in a high risk to you, we will also tell you directly, without undue delay, in plain language: what happened, what data was involved, what we are doing about it and what you can do to protect yourself.

15. Children

The Service is for adults. You must be 18 or over to hold an account, and there is no exception for people under 18 acting with a parent's or guardian's permission. We do not knowingly collect personal data from anyone under 18. If you believe someone under 18 has given us personal data, contact us and we will delete it and close the account.

16. Changes to this policy

We may update this policy. If a change is significant — for example a new recipient of your data, a new purpose, or a change in where your data is processed — we will tell you through the Platform or by email before it takes effect.

Questions about this policy: support@inispo.com.