FESTY LTD — Privacy Policy
This Privacy Policy explains how FESTY LTD ("Festy", "we", "us" or "our") collects, uses, discloses and protects personal information when you use the Festy mobile application, our website, and related birthday reminder, social, subscription, e-card and gifting services (together, the "Services"). It also explains information we may receive about people who do not have a Festy account.
1. Who we are
FESTY LTD is the controller responsible for the processing described in this Policy, including processing contact and birthday information uploaded by users for FestySync and related suggestions.
FESTY LTD is a company registered in England and Wales under company number 15123095. Our registered office is 20 Wenlock Road, London, England, N1 7GU.
Privacy enquiries, rights requests and general support enquiries may be sent to info@myfesty.io.
2. Scope and minimum age
The Services are intended only for people aged 16 or older. You must not create an account if you are under 16. A user may nevertheless add a birthday or contact record relating to another person, including a person under 16. Such records are treated as information about a non-user and are subject to the safeguards and rights described below.
This Policy applies to users in the United Kingdom, European Union and European Economic Area, and the United States, including California. Additional local rights apply only where the relevant law covers Festy or the processing concerned.
3. Information we collect
Depending on how you use the Services, we collect or receive:
- Account and profile information: name, username, phone number, email address, date of birth, profile photograph, account identifiers, authentication provider identifiers and account preferences.
- Contacts and birthdays: names, phone numbers, email addresses, birthdays, profile images, notes, relationship information and source information that you enter or choose to import from contacts, calendars or external platforms.
- Social and communications information: friends, friend requests, invitations, greeting cards, inbox messages, notification content and interaction history.
- Device and technical information: device identifier, IP address, time zone, operating system, app version, language, authentication/session tokens, network and diagnostic information.
- Usage and analytics information: screens and features used, onboarding and conversion steps, contact-sync status, notification opens, referral and deep-link activity, subscription activity, gift events, crash reports and performance data. Analytics profiles may be linked to your Festy user ID.
- Payment, subscription and gifting information: selected brand, amount, currency, fees, sender and recipient details, billing email, payment and order status, transaction identifiers, subscription entitlement and purchase receipt information, and gift-card fulfilment references or URLs. Festy does not receive or store your full payment-card number.
- Website and support information: form submissions, correspondence, support requests, and website access or storage information such as IP address, browser data, cookies or similar technologies.
- Security and compliance information: verification attempts, fraud and abuse indicators, audit and server logs, and records needed to investigate complaints or comply with law.
4. Where information comes from
We receive information directly from you; automatically from your device and use of the Services; from other Festy users; from sign-in providers you choose; from payment, subscription and gifting providers; and from external platforms when you ask us to import selected information.
If another user has added or imported your details, we may hold your name, contact details and birthday even if you do not have a Festy account. The source is another Festy user or a source that user chose to import. We do not require non-users to create an account. A non-user may ask us to access, correct, suppress or delete their information by contacting info@myfesty.io.
5. Device contacts, calendar and FestySync
With your device permission, Festy reads selected contact or calendar information and uploads information needed to create birthday records, match contacts with Festy users, suggest birthdays and connections, and improve matching quality. Depending on the record, this may include a name, phone number, email address, birthday and relationship or matching signals.
Device permission is optional and can be revoked in your operating-system settings. Revoking permission stops future device access, but it does not by itself delete information already uploaded to Festy. You can remove individual records in the App, delete your account, or contact us to request deletion or suppression. People who do not use Festy may contact us directly.
When you provide information about another person, you must have a lawful basis and the right to do so. Do not upload information that is excessive, sensitive, confidential, or unrelated to the birthday and social features.
6. External birthday imports
If you choose to import birthdays from an external platform, Festy receives the information you select, such as names and birthdays, to add to your account. Your use of the platform remains subject to its terms and privacy policy, and you must have the right to import another person's information.
7. Sign-in and verification
If you sign in with Apple or Google, those providers and our authentication service authenticate you and provide Festy with an identity token and available profile details, such as name, email address, image and, where you authorise the Google People permission, birthday. We use this information to create, secure and prefill your account. A verification provider may deliver phone or email verification codes.
8. How and why we use information
- Provide the Services: create and secure accounts; maintain birthdays and relationships; deliver reminders, notifications, invitations, cards, subscriptions and gifts; provide support; and process requests. Our UK/EU legal basis is performance of our contract with you.
- Optional imports and device access: access contacts, calendars, social import sessions, photos, camera or notifications when you choose the feature. Our legal basis is consent where required. You may withdraw device permission, although this does not affect earlier lawful processing.
- Payments, subscriptions and accounting: take payment, issue gifts, verify entitlements, process refunds and maintain tax and transaction records. Our legal bases are contract and legal obligation.
- Personalisation, matching and recommendations: suggest birthdays, friends, gifts and relevant features using profile, contact, relationship and usage information. Our legal bases are contract where necessary for a requested feature and our legitimate interests in providing a useful, personalised service where those interests are not overridden by individual rights.
- Product analytics and attribution: understand feature use and conversion, measure referral or advertising performance, troubleshoot journeys and improve the Services. We rely on legitimate interests where permitted and consent where applicable law requires it, including device-level tracking permission where required.
- Communications and marketing: send service messages and, where permitted, product or promotional communications. Service messages are necessary to perform our contract. Marketing is based on consent or legitimate interests where allowed, and you may opt out using the message controls or by contacting us.
- Safety, fraud prevention and legal compliance: authenticate users, prevent misuse, investigate incidents, enforce our Terms, protect users and establish or defend legal claims. We rely on legal obligation and our legitimate interests in protecting Festy, users and the public.
Where we rely on legitimate interests, we assess the necessity and impact of the processing and implement safeguards. You may object as described in section 14.
9. Analytics, SDKs and advertising choices
We use analytics, attribution, crash-reporting, notification and similar technologies to understand use of the Services, measure referrals or campaigns, diagnose problems and personalise features. Depending on the service and your choices, providers may receive identifiers, usage and conversion events, referral data, purchase-event details, notification interactions and diagnostic information.
Festy does not sell personal information for money. Some US state laws may treat advertising or attribution disclosures as a "sale", "sharing" or targeted advertising. Where applicable, you may opt out through device tracking controls or by emailing info@myfesty.io with the subject "Do Not Sell or Share". We do not knowingly sell or share personal information of anyone under 16, and we do not use solely automated decisions that produce legal or similarly significant effects.
10. Payments, subscriptions and gifting
Payment, app-store, subscription, gift-card and e-card providers process the sender, recipient, order, value, receipt and delivery information reasonably necessary to complete a transaction and provide support. Festy does not receive or store your full payment-card number.
Payment, subscription and gift providers may act as our processors for some activities and as independent controllers for their own legal, fraud, payment-network or account obligations. Their own privacy notices apply to those independent activities.
11. Service providers and external services
We disclose information only as needed for the purposes in this Policy. The categories of recipients include:
- Cloud infrastructure providers: website and form hosting, application hosting, managed databases, file storage, backups and cloud functions.
- Identity and verification providers: account authentication, social sign-in and phone or email verification.
- Analytics, attribution and diagnostics providers: product measurement, referral and advertising attribution, deep links, crash reporting, service monitoring and incident diagnosis.
- Communications providers: push notifications, service messages, customer communications and marketing where permitted.
- Payment, app-store and subscription providers: payment processing, fraud prevention, refunds, purchase receipts, subscription entitlements and customer-centre features.
- Gift and e-card providers: gift catalogues, issuance, fulfilment, redemption links and e-card creation or delivery.
- User-selected external platforms: social or account services that you choose to connect or use as an import source.
- Professional and legal recipients: advisers, auditors, insurers, regulators, courts, law enforcement and parties to a corporate transaction where permitted or required.
Providers may change as the Services develop. We require providers acting on our behalf to protect information and use it only for authorised purposes. You may contact info@myfesty.io for more information about recipients relevant to your information, subject to lawful confidentiality and security restrictions.
12. International transfers
Festy is established in the United Kingdom, but some providers process information in the United States and other countries. Where UK or EEA personal data is transferred to a country without an applicable adequacy decision, we use an approved safeguard where required, such as the UK International Data Transfer Agreement, the UK Addendum to the European Commission Standard Contractual Clauses, or the European Commission Standard Contractual Clauses. We also assess transfer risks and use supplementary protections where appropriate. Contact us to request information about the safeguard relevant to a transfer.
13. How long we keep information
We keep information only for as long as reasonably necessary for the purposes in this Policy, including:
- account, profile, birthday, contact and social information while the account or relevant feature is active, and until deletion, suppression or closure is completed;
- uploaded non-user information until the contributing user removes it, the relevant purpose ends, or the non-user successfully requests deletion or suppression;
- payment, refund, subscription, gift, tax and accounting records for the period required by applicable tax, accounting, anti-fraud and limitation laws, which may be up to six years or longer where a dispute or legal hold applies;
- verification, session, security, server and support records for the period needed to secure the Services, resolve a request or enforce our rights; and
- analytics, attribution, crash and notification data according to our configured needs and the provider's retention controls, subject to applicable law.
Backups and cached copies may persist until they are overwritten in the ordinary backup cycle. We may retain a minimal suppression record to honour an opt-out, and may retain or de-identify information where required by law or reasonably necessary to prevent fraud, complete a transaction, resolve a dispute, or establish or defend legal claims.
14. Your privacy rights
Depending on where you live and the processing involved, you may have rights to:
- access and obtain a copy of your personal information;
- correct inaccurate or incomplete information;
- request deletion or restriction;
- object to processing based on legitimate interests, direct marketing or certain profiling;
- receive information you provided in a portable format;
- withdraw consent without affecting processing already carried out; and
- complain to a data-protection regulator.
Send requests to info@myfesty.io. We may need to verify your identity and clarify the scope. UK and EEA requests are normally answered within one month, subject to lawful extensions. Rights are not absolute and exemptions may apply.
UK users may complain to the Information Commissioner's Office. EEA users may complain to the supervisory authority where they live, work or believe an infringement occurred.
15. Account and contact deletion
You can start account deletion from the App. You may also contact support if the in-App process is unavailable. Deletion does not cancel or reverse an already issued gift card or automatically erase records that Festy must retain for payments, fraud prevention, legal claims or compliance. Revoking a device permission or deleting the App is not the same as deleting your Festy account or server-held data.
If you are a non-user whose information was uploaded by someone else, contact us with enough information to locate the record. We may suppress matching identifiers so the same information is not immediately suggested again.
16. Security
We use appropriate technical and organisational safeguards designed to protect information. No system is completely secure, and we cannot guarantee that unauthorised access, loss or misuse will never occur. Tell us promptly if you believe your account has been compromised.
17. California privacy notice
Where the California Consumer Privacy Act, as amended by the CPRA, applies, the personal-information categories collected in the preceding 12 months are those described in section 3. Their sources, purposes and recipient categories are described in the preceding sections.
California residents may request to know, access, correct or delete covered personal information; obtain a portable copy; opt out of sale or sharing; limit certain uses of sensitive personal information where that right applies; and receive equal service without unlawful discrimination. Festy does not use or disclose sensitive personal information for purposes that require a right-to-limit notice. Submit a request or authorised-agent request by emailing info@myfesty.io. We will verify requests as required by law.
18. Changes to this Policy
We may update this Policy to reflect changes to the Services, providers or law. We will post the revised version with a new effective date. If a change materially affects how we use information, we will provide additional notice in the App, by email or by another reasonable method before the change takes effect where required.
19. Contact us
FESTY LTD
Company number 15123095
20 Wenlock Road, London, England, N1 7GU
Email: info@myfesty.io