Privacy policy
Data controller
The controller of your personal data is Seatarena Sp. z o.o., ul. Świętokrzyska 12/305-307, 30-015 Kraków, Poland, KRS 0001189117, NIP 6772529318, REGON 542470513. yay.gift is a brand of this company.
For data protection matters, write to our registered address or to hello@yay.gift.
What data we process
- Organizer account: email address and first name.
- Participants and guests: first name (and last name if the organizer adds it), email or phone number, message language.
- Secret Spin: chosen category, hints, suggested amount, hidden wish (encrypted) and riddle, draw result (visible only to the person who drew).
- Draw payments: amount, number of people, status and the gateway payment number. We don't receive card or bank account details - the payment gateway processes them.
- Wishlist: reservations, group gift participation, bank account or BLIK phone number of the person collecting money (encrypted, deleted after settlement).
- Technical data: IP address and request time (abuse limits, security), cookies described in the cookie policy.
Purposes and legal bases
- Running your account and events, sending codes, invitations, reminders and results - performance of a contract (Art. 6(1)(b) GDPR).
- Data of people added by an organizer - legitimate interest of the organizer and the controller in organizing a shared gift (Art. 6(1)(f) GDPR). Each such person can opt out with the "I'm not taking part" button.
- Security and abuse prevention - legitimate interest (Art. 6(1)(f) GDPR).
- Hidden wish and matching partner offers - consent (Art. 6(1)(a) GDPR), which you can withdraw; withdrawing deletes the wish.
- After-party survey (rating, "what I got", message) and the "what did you buy" answer - legitimate interest in improving the service (Art. 6(1)(f) GDPR); only the yay.gift team sees the answers, answering is optional.
- Waiting list for yay.gift on Discord (email address, confirmed by link) - consent (Art. 6(1)(a) GDPR); one launch email, unsubscribe via the link in the email.
- Draw payments and their accounting - performance of the contract and legal obligation (Art. 6(1)(b) and (c) GDPR).
- The ALTCHA captcha on sign-in, joining and the waitlist runs on our own server: your browser or the app solves a short task in the background, with no cookies, no images and no data shared with third parties - legitimate interest in protection against bots (Art. 6(1)(f) GDPR).
- Emails about campaigns, contests and promotions in partner shops - only with your consent given when creating an account, joining or in "My account" (Art. 6(1)(a) GDPR and Art. 398 of the Polish Electronic Communications Law). You can withdraw it at any time with one click from the link in the email footer or in your account settings; we keep the date and wording of the consent and your answer to the survey after unsubscribing.
- Measuring traffic and ad performance (Google Analytics, Google Ads, Meta Pixel) - consent given in the cookie banner (Art. 6(1)(a) GDPR and Art. 399 of the Polish Electronic Communications Law).
Recipients
- Our server provider in the European Union, email provider and SMS gateway - as processors acting on our behalf.
- Stripe Payments Europe Ltd. (Ireland) and ING Bank Śląski S.A. (imoje gateway) - processing draw payments: the organizer's e-mail, name and the amount.
- Anthropic (Claude AI model) - the text of a hidden wish when creating a riddle and grading guesses, without names or contacts.
- Google (Analytics, Ads) and Meta Platforms (Pixel) - only with your consent.
Anthropic, Stripe, Google and Meta may process data in the United States. Transfers are based on the European Commission's EU-US Data Privacy Framework decision or standard contractual clauses.
The system administrator may, in justified cases (e.g. an abuse report or an error), access event data. Every such access is logged with a reason.
How long we keep data
[OKRES RETENCJI] Bank account and BLIK numbers from group gifts are deleted after settlement. Data from analytics and marketing cookies is kept by Google and Meta under their own rules, at most until you withdraw consent.
Your rights
You have the right to access, rectify and erase your data, to restrict processing, to data portability, to object to processing based on legitimate interest and to withdraw consent at any time (without affecting earlier processing). You can lodge a complaint with the President of the Polish Personal Data Protection Office (UODO).
The draw and profiling
Pairs are drawn at random. We don't make decisions about you based solely on automated processing that have legal effects.