Gift Box Privacy Policy

1. Who processes personal data

The joint controllers of personal data in Gift Box are:

BiVi Labs EOOD, company registration number 208879698, with its registered office and business address at: 89 Aleksandar Stamboliyski Blvd., Vazrazhdane district, Sofia 1303, Bulgaria,

and

Vasil Petrov Vasilev, Nadezhda 2 residential district, Sofia, Bulgaria.

Contact email for personal data questions and requests: giftboxsupport@proton.me
Phone: +359 885442201

2. What data we process

When you use Gift Box, we process:

• name;
• email address;
• information needed to register and verify the email address;
• information the user adds to their wishlist - title, description, product link, and selected category;
• technical data needed for security, authentication, and maintaining the user session;
• correspondence when the user contacts us.

The password is managed by the authentication system and is not accessible to Gift Box in readable form. The password confirmation field is used only for validation in the form and is not stored as a separate field.

3. Why we process the data

We use the data to:

• create and manage the user account;
• verify the email address and enable account sign-in;
• store and display the user’s wishlist;
• provide the public link to the list;
• respond to enquiries and requests;
• maintain the security and normal operation of the service;
• fulfil applicable legal obligations.

The main legal basis is providing the service requested by the user. Where applicable, processing may also be based on a legal obligation or on the legitimate interest in protecting Gift Box and ensuring its secure operation.

We do not use the data for direct marketing, advertising tracking, profiling, or automated decision-making.

4. What data is public

The public wishlist page displays:

• the user’s name in the title “{name}’s wishlist”;
• the wishes and the information added to them.

The email address, password, authentication information, and other non-public data are not displayed.

Anyone with the public link can open the page and share the link with other people. The user should not add information they do not want to make visible in this way.

5. Service providers

To operate Gift Box, we use:

• Supabase - for authentication and the database. The MVP project is in the Frankfurt, Germany region;
• Vercel - for hosting the web application;
• Resend - for sending system emails related to registration, email verification, and managing account access.

These providers may process data to the extent necessary to provide and protect the services we use.

6. Retention period

Data is retained for the period necessary to provide the service and handle user requests, in accordance with applicable legal requirements.

The user may request deletion of their account and associated data through the official Gift Box contact email address.

7. Essential technologies

Gift Box uses only the technologies necessary for registration, sign-in, security, and maintaining the user session.

For the MVP, we do not use analytics, advertising tracking, or marketing tracking.

8. User rights

The user has the following rights:

• access to their personal data;
• correction of inaccurate data;
• deletion of the data;
• restriction of processing;
• receipt of the data they have provided, where this right applies;
• objection to processing based on a legitimate interest.

Requests should be sent to the official Gift Box contact email address. Before fulfilling them, we may ask for the information necessary to verify the requester’s identity.

The user has the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection or another competent supervisory authority.

9. Changes to this policy

This policy may be updated when the service or applicable requirements change. The date of the latest update is stated at the beginning of this document.