Last Updated: May 7th, 2024
We are a New Jersey corporation legally known as Telenations, Inc. doing business as Giftogram (referred to in this Privacy Policy as “Giftogram”, we, us, our or words of similar import). We provide various rewards, incentives, payouts and other products (“Giftogram Products”) as well as various services, such our digital Giftogram Product delivery service, web-to-print gift card customization service and related support tools and services (“Services”) to our “Customers”. When referring to our “Customers” in this Privacy Policy, we mean (a) “Business Purchasers”, which are companies that are eligible to use our website at www.giftogram.com (the “Site”), and that purchase or desire to purchase Giftogram Products from us as gifts, incentives or payouts to be given to employees, customers and others in a business context, and (b) “Recipients”, which are individuals or companies that are eligible to use our Site and that have received a Giftogram Product from a Business Purchaser. For further information about using our Site, click here if you are or intend to be a Business Purchaser, or click here if you are a Recipient.
Giftogram has prepared this Privacy Policy (as amended or supplemented, the “Privacy Policy”) to inform you about our practices regarding the personal data we collect about “Users” of our Site and other Services. When referring to “Users” (also referred to in this Privacy Policy as “you”, “yours” or words of similar import), we mean (a) employees and representatives of past, current and prospective Business Purchasers, (b) Recipients who redeem or attempt to redeem Giftogram Products using the Services, and (c) other individuals who visit or use our Site or interact with any of our Services.
Third-Party Sites.
This Privacy Policy applies only to our Giftogram Products and Services. It does not apply to other non-Giftogram websites and mobile applications, including those of our Business Purchasers or other third parties that link to or from our Services. Our Site and other Services may contain links to third-party sites or applications that may have privacy policies that differ from ours. We are not responsible for the practices of such sites or applications. The privacy and data security practices of such third-party sites and applications are governed by the privacy policies of those third parties. The links to third-party sites to or from our Services do not imply that we endorse or have reviewed those third-party sites.
Job Applicants and Employees.
This Privacy Policy does not apply to our employees or job applicants within the context of their employment or job seeking.
You should read this Privacy Policy carefully, as it is important that you understand what personal data we collect about you and what we do with that personal data. By using any of our Services, you tell us that you have read, understand and consent to this Privacy Policy, including our privacy practices as described in this Privacy Policy. If you do not consent to these privacy practices, you are not authorized to download, register with us, or otherwise use any of our Services. If you withdraw your consent after having given it to us, you are not authorized to use, and you must immediately stop using, the Site and any of our other Services. You agree to this Privacy Policy by using our Services.
This Privacy Policy may change from time to time, as described below.
Protecting the privacy of children is very important to us. Our Services are not directed at children and children are not eligible to use our Services. We do not collect or maintain personal data from individuals we actually know are under 13 years of age. If you become aware of any data we may have collected from children under 13 years of age, please contact us.
The personal data we collect about you depends upon what type of User you are and how you interact with our Services.
Business Purchasers:
If you access the Services as an employee or other type of representative of a Business Purchaser, you are considered an authorized User under that Business Purchaser’s contract with us. Your use of the Services is subject to that contract, this Privacy Policy and our terms of services applicable to Business Purchasers, which can be found here: https://giftogram.com/terms-of-service. If you have questions about the collection and use of your personal data in connection with us providing our Services to the Business Purchaser you represent, please contact that Business Purchaser.
Recipients:
Visitors to the Site:
We receive and automatically collect data about visitors to our Site when a visitor interacts with our Services. Data that a visitor may provide us includes name, email address and other contact information. The data we automatically collect is the type of Site Usage Data described above that we collect about Business Purchaser and Recipient interactions with our Services.
Giftogram uses cookies (small text files that a website saves on your computer or device when you visit a website) and other tracking tools to automatically collect information about how you use our Site and otherwise interact with our Services. The information collected might relate to you, your preferences or your device, and is mostly used to make the Site work as you expect it to and to provide a more personalized web experience.
Most web browsers are set to accept cookies by default. However, you can choose not to allow certain types of cookies, which may impact your experience of the Site and our Services.
For more information about how we use cookies and similar tracking devices, please review our Cookie Policy.
We use Google Analytics, a web analytics service provided by Google, Inc. Google Analytics uses Cookies to help us analyze how users interact with the Site, compile reports on their activity, and provide other services related to their activity and usage. The technologies used by Google may collect information such as your IP address, time of visit, whether you are a returning visitor and any referring website. The information generated by Google Analytics is transmitted to and stored by Google and is subject to Google’s privacy policies. To learn more about Google’s partner services and to learn how to opt out of tracking of analytics by Google, click here.
Giftogram may obtain personal data about you from third parties or publicly available sources. Such information may include:
If a Business Purchaser or other third party provides us personal data about others, such as Recipients, we will only use that information for the specific reason for which it was provided to us or as otherwise permitted by law. Giftogram treats personal data we obtain from third parties in accordance with this Privacy Policy. We are not responsible or liable for the accuracy of the information provided to us by third parties and are not responsible for any third party’s policies or practices.
Aggregated Data: We collect, use and share “Aggregated Data” such as statistical or demographic data for any purpose. Aggregated Data can be derived from your personal data but is not considered personal data in law because this data will not directly or indirectly reveal your identity. For example, we may aggregate your Site Usage Data to calculate the percentage of users accessing a specific Site feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data that will be used in accordance with this Privacy Policy.
Special Data Categories. We do not collect any of the following types of personal data about you: your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, gender preference, political opinions, trade union membership, information about your health, and genetic and biometric data. Nor do we collect any information about criminal convictions and offenses.
Giftogram does not sell your personal data in the sense of receiving cash for the information. However, the definition of the term “sale” in some states is broad enough to include transactions that would constitute a “sale” under state law. For example, if you are a resident of Colorado or Connecticut, our use of cookies and tracking technologies constitutes a “sale” of personal data to third-party advertisers. California law may find that a sale has occurred if legal consideration other than money is exchanged. See discussion below heading “Additional Rights Available to Residents of Certain U.S. States”.
In certain circumstances we share certain personal data for a business or other lawful purpose. The following describes some of the more common circumstances where Giftogram uses your personal data:
Your personal data is stored on our service provider’s servers in the United States. You understand and agree that we may collect, use, disclose, and otherwise process the personal data you provide as described in this Privacy Policy, even if you are from an area outside the United States.
The security of your personal data is important to us. We protect your personal data through technical and administrative measures designed to mitigate the risk of unlawful or unauthorized access, destruction, loss, alteration, disclosure or use of your data. To protect your account, we encourage you to choose your password carefully and enable two-factor authentication (2FA) for signing in. You can learn more about enhancing your account security in your account settings.
We may grant Business Purchasers credentials to access to our Application Programming Interface (the “Giftogram API”) to enable the Business Purchaser to display content from our Site on its user interface. Access to our Giftogram API is granted in our sole discretion. Any Business Purchaser granted such access must keep its Giftogram API Credentials secure and may not share those credentials with any third party.
The following factors typically affect the retention period:
We keep your personal data for as long as is necessary to provide the Services to you. This includes maintaining and improving the performance of our Services, keeping our Services secure, and maintaining appropriate business and financial records. Most of our retention periods are determined on the basis of this general rule.
If we process personal data on the basis of consent (including consent to the extended storage), we store the data for as long as necessary in order to process it according to your consent or until you withdraw your consent.
Giftogram will retain and use personal data to the extent necessary to comply with our legal obligations.
If you are a resident of a certain U.S. or international jurisdictions, you may have rights applicable to your personal data available to you. In particular,
These rights may include the right to access your personal data and know the specific personal data we have about you, the right to request deletion or correction of your personal data, the right to object to certain processing of your personal data, as well as a myriad of other rights under the laws specific to your country or state of residence. Not all rights may be available under the laws governing the state or country where you live, but you can contact us at any time to inquire regarding your privacy rights. For more information about the specific privacy rights that may be available to you based on your state or country of residence, please review the international and state law sections below.
Managing your Personal Data. If you would like to manage, change, limit, or delete your personal data, you can do so via your Giftogram account settings. Alternatively, you can exercise any of the rights above, subject to applicable law by contacting us in any of the ways described below under the heading “How to Contact Us." Once you contact us to exercise any of your rights, we will confirm receipt of your request. Limiting use of, or deleting, your personal data may impact features and uses that rely on that information.
Communication Choices. You can opt out of receiving marketing emails by using the unsubscribe link in our marketing emails or through your account settings. Certain communications from Giftogram are service-related or legally required and you will continue to receive them even if you opt out of marketing emails.
If you are located outside the United States, in particular if you are located in Canada, Brazil, the EU, the EEA, New Zealand, the Republic of South Africa, Switzerland, the UK or another country with similar data privacy laws, please note that we and our servers are located in the United States. Any information that you provide to us may be transferred to and processed in the United States or other countries around the world where we do business. Although this may include recipients of information located in countries where there may be a lower level of legal protection for your personal data than in your country, we will make efforts to protect your information in accordance with requirements applicable to the law in your particular jurisdiction and take steps to only share your personal data with third parties that offer similar protection. By engaging with and providing personal data and other data that we may legitimately collect, process, use or transfer in connection with your relationship with us, you unambiguously and unconditionally consent to your information being collected, processed, used, and transferred as disclosed in this Privacy Policy.
If you are a resident of a country outside the United States, such as but not limited to Canada, a country within the EU or EEA, the law in your country of residence may grant you certain rights with respect to your personal data, in particular the right to access, correct, and delete the personal data we hold about you. We will retain your personal data for the length of time you engage with our Services, as described in the retention section of this Privacy Policy under the heading “Giftogram’s Retention of Your Personal Data”, or until you request deletion of such personal data. We are considered the Data Controller (or equivalent distinction) with regard to your personal data. You can find our contact information here.
In certain circumstances, you have the following data protection rights:
In order make a request regarding your personal data, please contact us as described in this Privacy Policy. You can find our contact information here.
If you have a comment, question, or complaint about how we are handling your personal data, we hope that you contact us to allow us to resolve the matter. In addition, if you are located in the EEA, you may submit a complaint regarding the processing of your personal data to a regulatory authority.
Our legal basis for collecting and using the personal data described in this Privacy Policy depends on the personal data we collect and the specific context in which we collect it.
We may process personal data because:Where certain sensitive personal data is processed based on your explicit consent, you may have the right to withdraw such consent at any time. To do so, please contact us as described in this Privacy Policy. If there is a different legal basis that would permit us to continue processing your personal data after withdrawing consent, we will notify you of that legal basis at the time of your request.
Depending on the state in which you reside, in particular if you reside in California, Colorado, Connecticut, Utah or Virginia, you may have certain privacy rights regarding your personal data. If you are a California resident, please see our “Notice to California Residents” section below. For other state residents, your privacy rights may include (if applicable):
We do not sell your personal data in the sense of receiving cash for the information. However the definition of the term “sale” in some states is broad enough to include transactions that would constitute a “sale” under state law. For instance, if you are a resident of Colorado or Connecticut, our use of cookies and tracking technologies constitutes a sale of personal data to third-party advertisers. We also use cookies and other tracking technologies to display advertisements about our products to you on nonaffiliated websites, applications, and online services. This is “targeted advertising” under applicable privacy laws. We do not use personal data for profiling in furtherance of decisions that produce legal or similarly significant effects concerning individuals.
To exercise your rights, please submit a request by contacting us in any of the ways described below under the heading “How to Contact Us”. If legally required, we will comply with your request upon verification of your identity and, to the extent applicable, the identity of the individual on whose behalf you are making such request. To do so, we will ask you to verify data points based on information we have in our records. If you are submitting a request on behalf of another individual, please use the same contact methods described above. If we refuse to take action regarding your request, you may appeal our decision by replying to the email you received from us in response to your request. If you would like to opt out of targeted advertising, you may alter your cookie preferences.
The California Consumer Privacy Act, as amended by the California Privacy Rights Act of 2020 (“CCPA”), requires that we provide California residents with a privacy policy that contains a comprehensive description of our online and offline practices regarding the collection, use, disclosure, sale, sharing, and retention of personal information and of the rights of California residents regarding their personal information. This section of the Privacy Policy is intended solely for, and is applicable only to, California residents. If you are not a California resident, this section does not apply to you and you should not rely on it.
The CCPA defines “personal information” to mean information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California resident or household. Personal information does not include publicly available, deidentified or aggregated information or lawfully obtained, truthful information that is a matter of public concern.
Notice at Collection of Personal Information.
We currently collect and, in the 12 months prior to the Last Updated Date of this Privacy Policy, have collected the categories of personal information described in this Privacy Policy under the heading “Collection of Personal Data”.
We collect personal information directly from California residents and from advertising networks, internet service providers, data analytics providers, government entities, operating systems and platforms, social networks, and data brokers. We do not collect all categories of personal information from each source.
In addition to the purposes stated above in the section “How Giftogram uses Your Personal Data”, we currently collect and have collected the above categories of personal information for the following business or commercial purposes:
Sale, Sharing, and Disclosure of Personal Information
The CCPA defines “sale” as the transfer of personal information for monetary or other valuable consideration. Although we do not “sell” personal information as that term is commonly understood (for money), we engage in online activities that may constitute a sale or the sharing of personal information under California law if it is determined that we have receive “other valuable consideration” for the personal information.
The following table identifies the categories of personal information that we shared with third parties in the 12 months preceding the Last Updated Date of this Privacy Policy and, for each category, the categories of third parties to whom we shared personal information:
|
Category of Personal Information |
Categories of Third Parties |
|
Unique personal identifiers (device identifier; cookies, beacons, pixel tags, mobile ad identifiers, or other similar technology; customer number, unique pseudonym or user alias; telephone numbers, or other forms of persistent or probabilistic identifiers that can be used to identify a particular consumer or device); email address. |
Advertising network |
We sold or shared personal information to third parties for the following business or commercial purposes:
The following table identifies the categories of personal information that we disclosed for a business purpose in the 12 months preceding the Last Updated Date of this Privacy Policy and, for each category, the categories of recipients to whom we disclosed personal information:
|
Category of Personal Information |
Categories of Recipients |
|
Identifiers such as name, e-mail address and IP address |
Service providers, including for cloud storage, customer support, marketing and payment processing; financial institutions that issue your reward; and our Recipient and Business Purchaser Customers |
|
Personal information categories listed in the California Customer Records statute such as name, address, and telephone number |
Service providers, including for cloud storage, customer support, marketing and payment processing; financial institutions that issue your Giftogram rewards; and our Recipient and Business Purchaser Customers |
|
Characteristics of protected classifications under California or federal law such as age |
Service providers, including for cloud storage |
|
Financial information such as bank account information and credit card information |
Financial institutions that issue your Giftogram rewards; and Service providers, including for payment processing |
|
Commercial information such as records of products or services purchased from us |
Service providers, including for cloud storage, customer support, payment processing and marketing; financial institutions that issue your Giftogram rewards; and our Recipient and Business Purchaser Customers |
|
Internet or other similar network activity such as information regarding your interaction with the Site |
Service providers, including for analytics, cloud storage and customer support |
|
Geolocation data such as IP address |
Service providers, including for analytics, cloud storage and customer support |
|
Client Account access credentials such as account log-in in combination with any required security or access code, password, or credentials allowing access to your Business Purchaser Account |
Service providers, including for cloud storage and security purposes |
We disclosed personal information for the following business or commercial purposes:
Retention of Personal Information
We retain your personal information for as long as necessary to fulfill the purposes for which we collect it as described above under the heading “Giftogram’s Retention of Your Personal Data”.
Your Rights
If you are a California resident, you have the following rights with respect to your personal information:
How to Submit a Request to Know, Delete, and/or Correct
You may submit a request to know, delete, and/or correct by contacting us as described below in this Privacy Policy.
If you submit a request to delete online, you may be asked to confirm separately that you want your personal information deleted.
If you are submitting a request on behalf of a California resident, please submit the request through one of the designated methods. After submitting the request, and if the request is not subject to an exemption or exception, we will require additional information to verify your authority to act on behalf of the California resident.
Our Process for Verifying a Request to Know, Delete, and/or Correct
We will comply with your request upon verification of your identity and, to the extent applicable, the identity of the California resident on whose behalf you are making such request. Our verification process may differ depending on whether you maintain a password-protected account with us.
If you maintain a password-protected account, we may verify your identity through existing authentication practices available through your account. Prior to disclosing or deleting the personal information, we will ask you to re-authenticate yourself with respect to that account.
If you do not maintain a password-protected account, or if you are an account holder but we suspect fraudulent or malicious activity with your account, we will verify your identity either to a “reasonable degree of certainty” or a “reasonably high degree of certainty” depending on the sensitivity of the personal information and the risk of harm to you by unauthorized disclosure, deletion, or correction as applicable. To do so, we will ask you to verify data points based on information we have in our records concerning you.
Right to Opt-Out of Sale or Sharing of Personal Information
If you are a California resident, you have the right to direct us to stop selling or sharing your personal information. You may submit a request to opt out of sales or sharing by contacting us as described below in this Privacy Policy.
Right to Limit Use and Disclosure of Sensitive Personal Information
California residents have the right to limit our use or disclosure of their sensitive personal information for purposes other than those allowed by the CCPA and its regulations. You may submit a request to limit our use or disclosure of your sensitive personal information by contacting us as described below in this Privacy Policy.
Shine the Light Law
We do not disclose personal information obtained through our Site or Services to third parties for their direct marketing purposes. Accordingly, we have no obligations under California Civil Code § 1798.83.
If you have any questions, do not hesitate to contact us in any one or more of the following ways: