Privacy policy
Data controller
The controller of your personal data is Seatarena Sp. z o.o., ul. Świętokrzyska 12/305-307, 30-015 Kraków, Poland, KRS 0001189117, NIP 6772529318, REGON 542470513. yay.gift is a brand of this company.
For matters concerning your personal data, contact us by e-mail at yay@yay.gift or by post at our registered address. You can submit data requests (access, correction, erasure and the other rights below) the same way.
What data we process
- Organizer account: email address and first name.
- Participants and guests: first name (and last name if the organizer adds it), email or phone number, message language.
- Secret Spin: chosen category, hints, suggested amount, hidden wish (encrypted) and riddle, draw result (visible only to the person who drew).
- Draw payments: amount, number of people, status and the gateway payment number. We don't receive card or bank account details - the payment gateway processes them.
- Wishlist: reservations, group gift participation, bank account or BLIK phone number of the person collecting money (encrypted, deleted after settlement).
- Technical data: IP address and request time (abuse limits, security), cookies described in the cookie policy.
Purposes and legal bases
- Running your account and events, sending codes, invitations, reminders and results - performance of a contract (Art. 6(1)(b) GDPR).
- Data of people added by an organizer - legitimate interest of the organizer and the controller in organizing a shared gift (Art. 6(1)(f) GDPR). Each such person can opt out with the "I'm not taking part" button.
- Security and abuse prevention - legitimate interest (Art. 6(1)(f) GDPR).
- Hidden wish and matching partner offers - consent (Art. 6(1)(a) GDPR), which you can withdraw; withdrawing deletes the wish.
- After-party survey (rating, "what I got", message) and the "what did you buy" answer - legitimate interest in improving the service (Art. 6(1)(f) GDPR); only the yay.gift team sees the answers, answering is optional.
- Waiting list for yay.gift on Discord (email address, confirmed by link) - consent (Art. 6(1)(a) GDPR); one launch email, unsubscribe via the link in the email.
- Draw payments and their accounting - performance of the contract and legal obligation (Art. 6(1)(b) and (c) GDPR).
- The ALTCHA captcha on sign-in, joining and the waitlist runs on our own server: your browser or the app solves a short task in the background, with no cookies, no images and no data shared with third parties - legitimate interest in protection against bots (Art. 6(1)(f) GDPR).
- Emails about campaigns, contests and promotions in partner shops - only with your consent given when creating an account, joining or in "My account" (Art. 6(1)(a) GDPR and Art. 398 of the Polish Electronic Communications Law). You can withdraw it at any time with one click from the link in the email footer or in your account settings; we keep the date and wording of the consent and your answer to the survey after unsubscribing.
- Measuring traffic and ad performance (Google Analytics, Google Ads, Meta Pixel) - consent given in the cookie banner (Art. 6(1)(a) GDPR and Art. 399 of the Polish Electronic Communications Law).
Recipients
- Our server provider in the European Union, email provider and SMS gateway - as processors acting on our behalf.
- Stripe Payments Europe Ltd. (Ireland) and ING Bank Śląski S.A. based in Katowice (ING Pay payment system) - processing draw payments: the organizer's e-mail, name and the amount.
- Anthropic (Claude AI model) - the text of a hidden wish when creating a riddle and grading guesses, without names or contacts.
- Google (Analytics, Ads) and Meta Platforms (Pixel) - only with your consent.
Anthropic, Stripe, Google and Meta may process data in the United States. Transfers are based on the European Commission's EU-US Data Privacy Framework decision or standard contractual clauses.
The system administrator may, in justified cases (e.g. an abuse report or an error), access event data. Every such access is logged with a reason.
How long we keep data
- Account and event data is kept for the duration of the contract (while you use yay.gift) and afterwards until claims become time-barred.
- Payment settlement data is kept for the period required by tax and accounting law (5 years from the end of the year of the payment).
- Data processed based on your consent is kept until you withdraw it.
- Bank account and BLIK numbers from group gifts are deleted after settlement. Message contents with codes and links are deleted right after sending. Data from analytics and marketing cookies is kept by Google and Meta under their own rules, at most until you withdraw consent.
- On request we delete data earlier unless the law requires us to keep it longer.
Your rights
At any time you have the right to access, rectify and erase your data ("right to be forgotten"), to restrict processing, to data portability, to object to processing based on legitimate interest and to withdraw consent at any time (without affecting earlier processing). Send requests by e-mail to yay@yay.gift. You can also lodge a complaint with the supervisory authority - the President of the Polish Personal Data Protection Office (UODO).
The draw and profiling
Pairs are drawn at random. The website doesn't use profiling and we don't make decisions about you based solely on automated processing that have legal effects. Exception: if you accept marketing cookies, Google and Meta may use them to tailor ads to you in their networks.