Last updated: 23 September 2026
Your personal information helps us manage your account, fulfil purchases, review cards submitted for sale and resolve problems. This policy explains what we collect, how we use it and the choices and rights available to you.
It applies when you browse giftpayout.com, create an account, buy or submit a gift card, request a payout or contact GiftPayout. It also applies to people whose information is provided in connection with a transaction or enquiry, even if they do not have an account.
1. Who is responsible for your information
GiftPayout Limited, company number 17467384, is responsible for the personal information covered by this policy. In data protection law, this role is called the controller.
Registered office: 67 Sullivan Circle, Casnewydd, United Kingdom, NP19 9RG.
Privacy contact: support@giftpayout.com.
You can use this email address for privacy questions, information requests and complaints. You do not need an active account to contact us. Please tell us what you need and provide enough information for us to identify the relevant account or transaction. Do not include a password, full gift card code or unnecessary identity documents.
This policy explains our use of personal information. It does not replace our Terms and Conditions, and using the website does not mean that you consent to every possible use of your information.
2. Information we collect
The information we need depends on how you use GiftPayout. We do not need every category listed below for every visitor.
| Category | What it can include |
|---|---|
| Account and contact details | Your name, email address, telephone number, date of birth where provided, account reference and relevant contact or billing address. |
| Account preferences and security | Your chosen profile image, preferences, sign in and account recovery information, verification status and records of important account changes. |
| Purchases and balances | Orders, card brands and values, prices, charges, delivery records, GiftPayout Credit, cash proceeds, refunds and payment disputes. |
| Cards submitted for sale | Card details and codes, remaining value, expiry, receipts, photographs, purchase confirmations and explanations you provide about the card's source. |
| Payments and payouts | Payment references, payment status, refund records and the account holder and bank details needed to arrange a requested payout. |
| Identity and contact verification | Information needed to initiate a check, its reference, status, result and relevant information supplied by the verification provider. |
| Support and complaints | Messages, attachments, order references, explanations, evidence and records of how we handled your request. |
| Website and security activity | Browser and device information, network information such as an IP address where processed, sign in activity, failed attempts, essential website identifiers and relevant security events. |
Please provide information that is accurate and relevant. Gift card submissions include one or two private images: a receipt or order confirmation, a card photo or screenshot, or both. A description is optional and may contain up to 400 characters. Avoid including unrelated personal information. Use the dedicated card details field when submitting the complete card code for sale.
If you provide information about another person, you must have a proper reason to do so. Share only what is necessary and, where appropriate, let them know about this policy. A gift card receipt may contain someone else's details; it does not automatically establish who owns the card.
3. Where information comes from
Much of the information comes directly from you when you complete a form, make a purchase, submit a card, change your preferences or contact support. Some information is generated through your use of the website, including delivery, sign in and account activity records.
We also receive information from organisations involved in providing the service. For example, a payment provider confirms a payment or dispute, a bank reports a payout outcome, a verification provider returns a check result, and an email or SMS provider supplies delivery information.
When a card is disputed, relevant information may come from its contributor, issuer, supplier or another person involved in the transaction. Information may also come from an authorised representative, professional adviser or public authority handling a specific matter. We consider its relevance and reliability rather than treating every allegation as fact.
4. Why we use information and our lawful bases
UK data protection law requires a lawful basis for each use of personal information. The main bases relevant to GiftPayout are performing a contract, legitimate interests, legal obligations and consent where it is needed.
| Purpose | Lawful basis and explanation |
|---|---|
| Create and manage your account and provide requested account features | Performing our contract with you, or taking steps you request before entering a contract. |
| Process purchases, deliver gift cards by email, manage refunds and provide transaction support | Performing our contract with you. |
| Review card submissions, manage agreed listings, record proceeds and arrange requested payouts | Performing our contract with you, or taking steps at your request before agreeing a transaction. |
| Verify contact details and assess identity, account authority or the source of a submitted card | Our legitimate interests in preventing impersonation, unauthorised payments and the sale of cards a person is not entitled to sell. Where a particular legal requirement applies, we also comply with that obligation. |
| Protect accounts, investigate suspected misuse and deal with payment disputes or legal claims | Our legitimate interests in protecting customers, staff and the business, preventing loss and establishing or defending legitimate claims. Disclosure required by law is handled on that legal basis. |
| Keep accounting records and respond to valid statutory requirements | Compliance with our legal obligations, including company, tax and data protection requirements. |
| Answer general enquiries, investigate privacy complaints and respond to information rights requests | Legitimate interests in providing effective support for general enquiries; legal obligations where data protection law requires a response or action. |
| Understand service problems and improve reliability | Our legitimate interests in providing a usable and dependable service, using only information needed for that purpose. |
| Send optional product news and offers | Your consent, given through the marketing preference or another clear choice. You can withdraw it without affecting the lawfulness of earlier use. |
When relying on legitimate interests, we consider whether the processing is necessary and how it affects your rights and reasonable expectations. A business benefit does not automatically override your privacy. Section 12 explains how you can object.
Some information is needed to provide a requested service. For example, we need a working email address for delivery, relevant card details to review a submission and correct bank details for a payout. Without necessary information or verification, we may be unable to complete that particular activity. Optional profile choices are not a condition of buying a card.
5. Identity checks, card evidence and fraud prevention
Identity verification takes place through a specialist provider's verification process. Where that process requires identity documents or photographs, the provider explains what it collects and how it handles them. GiftPayout uses the relevant verification information and result to manage the account and transaction. Do not send identity documents in ordinary support messages unless we identify an appropriate method for a specific request.
A verification provider may use additional checks, including comparison of identity documents and photographs. Its notice should explain any biometric processing and any choice or consent required for that process. This policy does not give blanket consent for such processing.
Card evidence is used to assess the submission and investigate a relevant problem. A contributor's name, receipts, private photographs and submission notes are not published in the card catalogue. The purchased card and its redemption information are provided to the buyer so that the card can be used.
We distinguish a security concern from proven misconduct. An unsuccessful payment, a shared address or an ordinary complaint is not automatically evidence of fraud. Relevant records may be checked together, and information shown to be inaccurate should be corrected.
Information about suspected criminal activity can require additional legal protection. We handle such information only where an applicable legal condition permits it, for example where necessary for legal claims or for preventing or detecting unlawful acts subject to the relevant safeguards. We limit access, retain only what is justified and keep any additional policies or records required by law. We do not publish customer blacklists or use personal information to punish someone for a genuine complaint.
6. Who may receive information
We do not sell personal information. We share relevant information only for a defined purpose and with an appropriate lawful basis.
Recipients can include:
- Payment providers and banks, to take payments, make refunds or payouts and investigate an affected payment.
- Identity and contact verification providers, to carry out the checks needed for an account or transaction.
- Email and SMS providers, to deliver verification messages, receipts, purchased cards, service notices and support replies. Delivery providers necessarily handle the recipient details and message content needed for that delivery.
- Gift card suppliers and issuers, to fulfil a purchase, resolve a card problem or investigate its status. We limit the information to what the relevant task requires.
- Providers supporting website operation, customer support and information security, where they need access to perform those services for us.
- Professional advisers, such as accountants or legal advisers, where relevant to accounting, a dispute or a legal obligation.
- Courts, regulators, law enforcement or other authorised bodies, when disclosure is required by law or is otherwise lawful, necessary and proportionate.
To investigate a disputed card, we may share relevant transaction facts with its contributor. This does not mean giving the contributor unrestricted access to the buyer's identity or private messages. We remove unnecessary personal details wherever practicable.
Providers acting on our behalf must follow appropriate contractual instructions and confidentiality requirements. Some organisations, including banks and certain payment or verification providers, also decide how to use information for their own legal or regulatory responsibilities. Their privacy notices explain those activities.
The provider involved in a payment or verification step is identified through that service. You can also contact us for information about the providers relevant to your account and the recipients of your personal information, subject to any lawful limits on disclosure.
7. Information handled outside the United Kingdom
Some service providers operate internationally, and providing payment, verification, communications or security services may involve handling information outside the UK.
Where a transfer is subject to UK data protection transfer rules, it must have a lawful basis for the transfer. This may be a UK adequacy arrangement recognising appropriate protection in the destination, or approved contractual safeguards with the assessment and additional protections required for the transfer. We do not treat ordinary acceptance of our Terms as consent to unrestricted international transfers.
You can ask us which destinations and transfer arrangements are relevant to your information and how to obtain details or a copy of the applicable safeguards. We may remove confidential commercial information from that copy where appropriate, while still explaining the protection that applies to your information.
8. Cookies, remembered details and website security
Cookies and similar technologies help the website recognise your current visit and carry out functions you request. GiftPayout uses essential information for signing in, maintaining a basket, protecting account actions and completing verification or account recovery steps.
| Function | What it does and how long it is needed |
|---|---|
| Signed in access | Keeps your visit connected to your account. Ordinary signed in access lasts up to 24 hours. If you choose Remember me, it can last up to 30 days. Signing out or a security action can end access sooner. |
| Browser and basket security | Helps associate activity with the correct visit and protect requests. The browser security cookie lasts up to seven days and may be renewed when you return. |
| Remembered email address | If you choose Remember me, your email address can remain saved on that device until you remove the choice or clear the relevant browsing information. |
| Temporary account and checkout steps | Keeps a verification, account recovery, quote or checkout step connected while you complete it. This information is cleared when the step is completed, expires or the relevant browsing session ends, depending on its purpose. |
Where a Google reCAPTCHA security check is displayed, Google processes information associated with the check, including browser and network information, to help distinguish legitimate activity from automated misuse. Google's Privacy Policy explains its handling of that information.
GiftPayout does not use advertising trackers on this website. If we introduce an optional technology that requires consent, we will explain its purpose and ask for that consent before using it. Declining optional consent will not remove access to functions that do not depend on it.
You can remove saved website information or block cookies through your browser settings. Blocking essential cookies can prevent sign in, checkout or other requested functions from working. On a shared device, avoid Remember me and sign out when you finish.
9. Service messages and your choices
We use your contact details to send messages needed for your account and transactions. These include verification messages, payment confirmations, receipts, purchased cards, payout updates, security notices and responses to your enquiries.
Creating an account or receiving a service message does not, by itself, subscribe you to promotional messages. Where promotional contact requires consent, we obtain that separately. You can withdraw marketing consent in your account preferences, through the relevant message or by contacting support. You can also object to direct marketing at any time. This does not prevent essential service messages about an existing account or transaction.
10. How long we keep information
We keep personal information for the purpose for which it is needed, taking account of the type of record, any active issue and applicable legal requirements. We review the need to retain it and delete or anonymise information when that need ends.
| Type of information | Retention approach |
|---|---|
| Active account information | Kept while needed to provide the account and requested services. On closure, we review which information can be removed and which limited records remain necessary for the purposes below. |
| Accounting and transaction records | Normally retained for six years from the end of the last company financial year they relate to. A longer period may be required for an ongoing tax enquiry or another applicable accounting requirement. This does not mean that every item of personal information is kept for six years. |
| Card details, receipts and submission evidence | Kept while needed to review a submission, provide the purchased card, address a relevant dispute or meet a specific recordkeeping requirement. We review unnecessary detail separately from the transaction record. |
| Verification information | Kept while necessary to establish the account's verification status, protect relevant transactions or address a specific legal or security issue. The verification provider applies its own disclosed retention rules to information it handles independently. |
| Support and complaint records | Kept while the matter is open and afterwards only to the extent needed to demonstrate its handling, address a reasonably foreseeable related claim or meet a legal requirement. The subject of the request and relevant claim deadlines determine the period. |
| Routine security and sign in information | Kept for the period needed to protect access and investigate relevant activity. Information attached to a specific incident may need to be retained until that incident and any justified follow up are resolved. |
| Information rights requests | We keep an appropriate record of the request and our response to demonstrate compliance and address any challenge. Unnecessary identity evidence is not retained merely because a request was made. |
Where an active dispute, investigation or legal obligation requires longer retention, we keep the information relevant to that matter rather than treating it as a reason to retain everything indefinitely. Access and use remain limited. Account closure does not automatically erase records that we must or are otherwise lawfully entitled to retain. Contact support to request closure. An authorised member of staff closes the account and signs it out of all active sessions. A closed account may be restored following a reviewed request to support. You can separately exercise your access and deletion rights, whether the account is open or closed.
Unused and unverified accounts
An unused account may be considered for deletion after at least 90 days of inactivity if both its email address and telephone number remain unverified. This review applies only where the account also has no identity verification, transactions, uploaded evidence, support requests or data change requests.
A member of staff must approve deletion. This is a review process, not automatic removal after exactly 90 days. Active and verified accounts are not automatically removed under this process. Any relevant legal obligation or unresolved information rights request must be considered before deletion.
11. Protecting your information
We use appropriate safeguards to protect personal information against unauthorised access, misuse, loss and disclosure. Access is limited according to the work a person needs to perform. We take care when selecting service providers, handling sensitive evidence and responding to requests for personal information.
You can help by keeping your password and verification codes private, securing access to your email account and telling us promptly about suspected unauthorised activity. Do not post full gift card codes or identity documents publicly.
If a personal information incident occurs, we assess it, take appropriate action and notify affected people or the relevant authority where the law requires. These steps do not limit your rights or our responsibilities.
12. Your information rights
Depending on the circumstances, you can:
- Request access to your personal information and an explanation of how it is used.
- Request correction of inaccurate or incomplete information.
- Request deletion where there is no continuing lawful reason to keep the information.
- Request restriction of certain uses while an issue, such as accuracy or an objection, is considered.
- Object to use based on legitimate interests, explaining your circumstances. We must consider the objection and stop unless the law permits continued use, for example for overriding legitimate grounds or legal claims.
- Object to direct marketing at any time. We must stop using your information for that purpose.
- Request portability of information you provided where the legal conditions apply, including certain processing based on consent or contract.
- Withdraw consent where we rely on it, without affecting earlier lawful processing.
- Challenge a relevant automated outcome and ask for human involvement where applicable, as explained in section 13.
You can request a copy of your account information by contacting support@giftpayout.com. An authorised member of our support team prepares the account export after any proportionate identity checks. This does not limit your right to request other personal information we hold. You do not need to sign in, close your account or use a particular form to exercise a right.
We normally respond without undue delay and within one month. Where the law allows an extension because a request is complex or there are several requests, we may take up to two further months and explain the reason within the initial month. If reasonably necessary identity information or clarification affects the response period, we explain what is needed and how the timing is affected. We do not seek unnecessary information to delay a request.
Requests are normally free. A fee or refusal is possible only in circumstances allowed by law, such as a manifestly unfounded or excessive request. We explain any refusal or limitation and how you can challenge it. We may protect another person's information or withhold information covered by a lawful exemption, but do not refuse a request merely because you have complained or your account is restricted.
13. Checks, decisions and human review
Automated checks support routine account security, payment confirmation and verification. Depending on the result, an action may not proceed, another check may be requested or a transaction may be referred for review. These checks consider information relevant to the activity, such as verification status, payment confirmation and signs of repeated or unauthorised attempts.
Our support team reviews reported card problems and decisions about additional transaction holds or alleged misuse. An automated alert alone is not a final finding that someone committed fraud.
If you believe a result or restriction is wrong, contact support to explain the circumstances and request a review. You can provide additional information and challenge inaccurate records. Where a decision is made solely by automated means and has legal or similarly significant effects, we provide the information and safeguards required by law, including an opportunity to make representations, obtain human intervention and contest the decision. A provider's own privacy notice explains decisions it makes independently.
14. Privacy complaints
If you have a concern about how we handle your information, email support@giftpayout.com or write to our registered office. Describe the concern and the outcome you are seeking. You can complain without being signed in.
We aim to acknowledge your complaint within two working days and will acknowledge it no later than 30 calendar days after receipt. We investigate, provide appropriate progress information and communicate the outcome without undue delay. These complaint arrangements do not replace the separate deadlines for information rights requests.
You can also raise a concern with the Information Commissioner's Office (ICO), the UK data protection regulator. Its complaints page explains how to proceed and what information to provide. The ICO can be contacted on 0303 123 1113. You do not need our permission to contact it. Your right to seek another legal remedy is unaffected.
15. Children and changes to this policy
GiftPayout accounts and transactions are intended for people aged 18 or over. If you believe a child has provided personal information to us, contact support so we can assess the circumstances and take appropriate action. We do not disregard a child's privacy rights because an account did not meet our age requirement.
We may update this policy when our services, use of information or legal requirements change. The date at the top identifies the latest version. We will bring a material change to your attention in an appropriate way and obtain consent where a new use requires it. An update does not retrospectively authorise an unlawful use of information.
For privacy questions or requests, contact GiftPayout Limited at support@giftpayout.com.