Data Protection Notice

CupyGift is established in Türkiye and offers personalised digital products to customers in the European Union.

• name, contact and billing details;
• order, transaction, delivery and support records;
• photos, video, audio, stories, dates, names and creative instructions;
• website, device, IP, security and diagnostic data;
• cookie, analytics, attribution and marketing preferences;
• communications and records of consent or contractual confirmations.

We do not deliberately ask for special categories of personal data within the meaning of Article 9 GDPR. A photo or a story may unintentionally contain sensitive details. Please avoid including sensitive information that is not needed for the order.

Most information is collected directly from the customer through order forms, uploads, the checkout process, email, WhatsApp and support. Technical information comes from the device and the website infrastructure. A customer may also provide information about a gift recipient or another person appearing in the creative material.

• hosting, storage, security and technical infrastructure providers;
• payment and fraud prevention providers;
• email, messaging and customer support providers;
• creative production contributors bound by confidentiality and access restrictions;
• Google services for consent-controlled analytics and measurement;
• Meta services for consent-controlled advertising measurement and WhatsApp communication;
• tax advisers, lawyers, auditors and other professional advisers;
• courts, supervisory authorities, tax authorities and law enforcement authorities where required by law.

CupyGift does not sell personal data to third parties. A current list of individual providers can be requested using the contact details below.

CupyGift is located in Türkiye. The information you submit is therefore processed in Türkiye and may also be processed in other countries where our service providers operate, including EU countries and the United States.

Where applicable, we base such transfers on appropriate safeguards under Article 46 GDPR, in particular the EU Standard Contractual Clauses. Further information can be requested through the contact details below.

• Order, invoice and transaction data: for the period required by applicable tax, commercial and consumer protection law.
• Creative source material and delivered files: for production, revisions, delivery and a limited support period, then deleted or restricted unless a dispute, a legal obligation or a separate consent requires longer storage.
• Support and complaint records: while the request is active and for a reasonable period afterwards for the defence of legal claims.
• Security logs: for the period needed to detect incidents, prevent abuse and investigate security events.
• Consent records: while the consent is relied on and afterwards for as long as is reasonably needed to demonstrate the choice.
• Optional analytics and advertising data: according to the choice made and the storage periods described in the Cookie Policy.

• the right to request access to the data processed about you (Article 15 GDPR);
• the right to request rectification of inaccurate data (Article 16 GDPR);
• the right to request erasure of your data where no legal retention obligation applies (Article 17 GDPR);
• the right to request restriction of processing (Article 18 GDPR);
• the right to receive a copy of the data you provided in a structured, commonly used format (Article 20 GDPR);
• the right to object at any time to processing based on a legitimate interest (Article 21 GDPR);
• the right to withdraw any consent you have given, at any time, with effect for the future (Article 7(3) GDPR);
• the right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR).

We may ask for information reasonably needed to verify your identity before acting on a request.

We aim to answer requests within one month in line with Article 12(3) GDPR. That period may be extended by a further two months for complex requests, and we will inform you if an extension is needed.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular the authority of the EU country where you live, where you work or where the alleged infringement took place. Contact details for the national authorities are published by the European Data Protection Board.

CupyGift does not currently take decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR. Analytics and advertising tools may group interactions for measurement, but CupyGift does not use them for such contractual decisions.

The service is intended for adults who can enter into a contract. We do not knowingly collect personal data from children and we do not knowingly invite children to place orders. If you provide a photo of, or information about, a child for a gift, you must be authorised to do so and should provide only what is needed.

This Notice may be updated when processing activities, service providers or legal requirements change. Material changes affecting a choice you have already made are communicated with a notice or, where required, a renewed request for consent.