Privacy Policy
A clear overview of how CupyGift processes personal data across the website, customer support and personalised digital gift services.
Last updated · 1 August 2026This Privacy Policy applies to visitors and customers located in the European Union. It should be read together with our Data Protection Notice and Cookie Policy.
CupyGift is operated from Türkiye. The personal data of customers in the EU is processed in line with the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”).
Controller
Netgrap Bilişim Hizmetleri Ticaret Limited Şirketi operates CupyGift and is the controller for the processing activities described in this Policy, within the meaning of Article 4(7) GDPR.
Data we process
- Identity and contact data: name, email address, phone number and billing details.
- Order data: selected product, personalisation details, order number, price, payment status and delivery history.
- Creative material: photos, video, audio, names, dates, stories, messages and production instructions.
- Payment data: payment status, transaction references and limited billing details. Full card details are handled by the payment provider and are not stored by CupyGift.
- Support data: emails, WhatsApp messages, revision requests, complaints and other correspondence.
- Technical data: IP address, device and browser information, security logs, pages visited and referral information.
- Preference data: language, cart contents, cookie choices, marketing consents and portfolio permissions.
Purposes and legal bases
| Purpose | Typical data | Legal basis (Article 6(1) GDPR) |
|---|---|---|
| Creating and delivering an order | Contact, order and creative data | (b) performance of the contract |
| Payment, invoicing and accounting | Order, invoice and transaction data | (b) and (c) performance of the contract and compliance with legal obligations |
| Customer support and revision requests | Contact and communication data | (b) and (f) performance of the contract and our legitimate interest in providing good support |
| Security, fraud prevention and legal claims | Technical, transaction and communication data | (f) our legitimate interest in a safe and lawful service |
| Advertising measurement | Campaign identifiers and attribution data | (f) our legitimate interest in measuring which advertising produces orders |
| Optional analytics | Device and usage data | (a) your consent, given through the cookie banner |
| Marketing communications | Contact data and channel preferences | (a) your opt-in consent |
| Portfolio or promotional use of customer work | Finished work, review or reaction content | (a) your separate, optional consent |
Personalised content
Creative material is used to fulfil the specific order, carry out requested revisions, deliver the finished digital product and provide support. It is not published as a sample, advertisement or social media content unless separate, optional consent has been obtained.
If you submit information about another person, you must have a legal basis and the authority to do so. Anyone who believes their material was submitted without authority can contact us to request review, restriction or erasure.
Sharing and service providers
Information is shared only to the extent necessary with hosting and infrastructure providers, payment providers, email and communication providers, analytics and advertising providers (consent only), professional advisers and competent authorities. To prepare personalised products, we may use video, image, audio, music, animation, file storage, file transfer, rendering or AI-assisted production services.
We do not sell your personal data and we do not share it for third-party behavioural advertising, other than through the consent-based analytics and advertising measurement tools described in our Cookie Policy.
Transfers outside the EEA
Because the controller is established in Türkiye, the data you submit is processed in Türkiye, which is a third country under the GDPR and is not covered by an adequacy decision of the European Commission. Individual service providers (hosting, payment, analytics and communication) may also process data in Türkiye, the United States, within the EU or in other countries.
Where applicable, we aim to base such transfers on appropriate safeguards under Article 46 GDPR, in particular EU Standard Contractual Clauses with our service providers. Further information about a specific transfer can be requested through the contact details below.
Retention and security
Data is kept only for as long as it is needed for the relevant purpose. Order and accounting records are kept for the retention periods required by applicable tax, commercial and consumer law. Creative material is kept for production, revisions, delivery and a limited support period, and is then deleted or its processing restricted, unless a dispute, a legal obligation or a separate portfolio consent requires longer storage.
We use access controls, restricted administrative access, transport encryption, logging and other appropriate technical and organisational measures under Article 32 GDPR. No internet service can guarantee absolute security.
Your rights
- access to the data processed about you (Article 15 GDPR);
- rectification of inaccurate data (Article 16 GDPR);
- erasure of your data where no legal retention obligation applies (Article 17 GDPR);
- restriction of processing (Article 18 GDPR);
- portability of data processed on the basis of consent or a contract (Article 20 GDPR);
- objection to processing based on a legitimate interest (Article 21 GDPR);
- withdrawal of any consent you have given, at any time, with effect for the future (Article 7(3) GDPR);
- lodging a complaint with a data protection supervisory authority (Article 77 GDPR).
Detailed information, including how to reach a supervisory authority, is provided in our Data Protection Notice.
Contact and changes
We may update this Policy when our services, providers or legal requirements change. Material changes are announced with a notice or, where required, a renewed request for consent.