Our Privacy Policy

Last Updated: 1 March 2021

The Company respects Your privacy and is committed to protecting Your personal data.

This privacy policy applies to the Site and the Apps, together with any social features or networking, or online services, provided by the Company through the Site and the Apps.

Purpose of This Privacy Policy

This privacy policy explains how the Company look after Your Personal Information whenever that information is provided to it. This includes when You request information from the Company, contact the Company (or the Company contacts You), buy products and services from the Company, use the Site services, or connect with the Company via social media or link to or from the Site.

It also tells You about Your privacy rights and how the law protects You. It has been updated to include additional data protection requirements for residents of the European Union (EU), United Kingdom, Liechtenstein, Switzerland, Norway, and Iceland under the General Data Protection Regulation (GDPR), and other relevant data protection laws, including the California Consumer Privacy Act (CCPA).

By accessing and otherwise using the Site, You agree to the collection, use, and disclosure of Your Personal Information as described in this privacy policy. If You do not agree, please do not access or use the Site or otherwise provide the Company with Your Personal Information.

1. IMPORTANT INFORMATION

Consumers residing in California have some additional rights with respect to their Personal Information under the CCPA. If You are a California resident, Paragraph 10 -- CALIFORNIA RESIDENTS -- PRIVACY NOTICE applies to You and supplements the other terms of this privacy policy. If You are a Nevada resident, Paragraph 11 -- NEVADA RESIDENT RIGHTS applies to You and supplements the other terms of this privacy policy.

The Site and the Apps are not intended for children, and the Company does not knowingly collect information from persons younger than the age of 18. The Company would ask parents to ensure that their children under the age of 18 do not provide the Company with Personal Information without parental permission. If the Company learns that it has inadvertently collected Personal Information from a person younger than the age of 18, the Company will take commercially reasonable efforts to delete that Personal Information from its databases.

Controller

The Company is the controller of Your Personal Information and responsible for the Site.

For individuals located in the United Kingdom, EU or European Economic Area (EEA), You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk (opens a new window)) or Wycliffe House, Water Lane, Wilmslow, SK9 5AF. The Company would, however, appreciate the chance to deal with Your concerns before You approach the ICO so please contact the Company in the first instance, using the contact details at the end of this Agreement.

Changes to the Privacy Policy and Your Duty to Inform the Company of Changes

This privacy policy was last updated on the date stated above. The Company may change this privacy policy at any time without notice to You by posting a revised version on the Site. Any changes will be effective immediately upon the posting of the revised privacy policy. However, unless You consent, the Company will not use Your Personal Information in a manner materially different than what was stated in the posted privacy policy at the time Your Personal Information was collected.

It is important that the Personal Information the Company holds about You is accurate and current. Please keep the Company informed if Your Personal Information changes during Your relationship with the Company.

2. THE DATA THE COMPANY COLLECTS ABOUT YOU

When You register as a Member, or make a purchase from the Site, You are invited to provide the Company with Your personal data or personal information, which is any information about an individual from which that person can be identified (Personal Information). It does not include data where the identity has been removed, deidentified, or made anonymous.

The Company may collect, use, store and transfer different kinds of Personal Information about You, which the Company groups together as follows:

• Identity Data includes first name, last name, username or similar identifier.

• Contact Data includes billing address, home address, email address and telephone numbers.

• Financial Data includes payment, credit or debit card details.

• Transaction Data includes details about products and services You have bought from the Company, and details about Your trading history, including payments received, and when You have requested information or raised queries, membership and Digital Product sending history, including Recipient Data and personal messages or sentiments that You enter for Digital Product sending.

• Technical Data includes internet protocol (IP) address, Your login data, browser type and version, browser plug-in types and versions, operating system and platform and other technology on the devices You use to access the Site and/or any Apps.

• Profile Data includes Your username and password, products and services bought by You, queries, feedback and survey responses.

• Recipient Data includes the first name, last name, email address, or significant dates (such as birthdays or anniversaries) that You provide for Digital Product sending.

• Usage Dataincludes information as to how You use the Site and/or any Apps.

• Marketing and Communications Data includes Your preferences as to whether You are happy to receive marketing from the Company.

• Location Data: includes Your current location disclosed by GPS technology.

Where You use the Apps, Personal Information may also include Location Data. The Company uses GPS technology to determine Your current location. Some of the Company's location-enabled services require Your Personal Information for the feature to work. If You wish to use the particular feature, You will be asked to consent to Your data being used for this purpose. You can withdraw such consent at any time by disabling Location Data in Your settings.

The Company also collects, uses and shares Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data could be derived from Personal Information but is not considered personal data in law as this data will not directly or indirectly reveal Your identity. For example, the Company may aggregate Your Usage Data to calculate the percentage of users accessing a specific website feature. However, if the Company combines or connects Aggregated Data with Your Personal Information so that it can directly or indirectly identify You, the Company treats the combined data as Personal Information which will be used in accordance with this privacy policy.

The Company does not collect any Special Categories of Personal Data about You (this includes details about race or ethnicity, religious or philosophical beliefs, sexual orientation, political opinions, trade union membership, information about Your health, and genetic and biometric data). Nor does the Company collect any information about criminal convictions and offences.

If You Do Not Provide Personal Information
Where the Company needs to collect Personal Information by law, or under the terms of a contract it has with You and You fail to provide that Personal Information when requested, the Company may not be able to perform that contract. In this case, the Company may have to cancel a contract, but it will notify You if this is the case at the time.

3. HOW IS YOUR PERSONAL INFORMATION COLLECTED?

The Company collects Personal Information from and about You in different ways, including through:

Your direct dealings with the Company. You may give the Company Your Identity Data, Contact Data and Financial Data by filling in forms or by corresponding with the Company by post, phone, email, via the Site, Apps or on social media, or otherwise. This includes Personal Information You provide when You:

• subscribe to the Company's newsletter and/or other publications;

• request promotional or marketing materials to be sent to You;

• register as a Member on the Site or through the Apps;

• buy products and/or services via the Site or through the Apps;

• enter a competition, promotion or survey;

• enter reminders in Your online address book (for significant dates of family and friends); or

• ask the Company for help, contact the Company or give the Company feedback.

Automated technologies or interactions. As You interact with the Site or Apps, the Company may automatically collect Profile Data and Technical Data about Your equipment, browsing actions and patterns. The Company collects this Personal Information by using cookies, server logs and other similar technologies. Please reference the Cookie Policy for further details.

Third Parties. Certain functions on the Site or Apps may permit interactions between the Site/Apps and a third-party website or interactive service (Social Features). If You choose to use Social Features (e.g., the "like button, share this card on Facebook"), certain information, which may include Your Personal Information, may be publicly displayed, and the third party website or interactive service used in connection with the Social Features (and its users) may have access to information about You and Your use of the Site/Apps.

Information You Provide About Third Parties. The Site and the Apps allows You to provide Personal Information about third parties (Recipient Data), such as mailing address, email addresses, or significant dates (such as birthdays or anniversaries). If You use the Site or Apps to send Digital Products, the Company collects certain Personal Information about the recipient (such as name, mailing address, and email address, as applicable). The Company may share the information regarding Your transaction with third parties as necessary to process that transaction (i.e., to create, send, or deliver the Digital Products). If You choose to provide Recipient Data, the Company will store that information only in connection with Your relationship with it. You confirm that providing such data is not in breach of law.

4. HOW THE COMPANY USES YOUR PERSONAL INFORMATION

The Company will only use Your Personal Information when the law allows it to. Most commonly, the Company will use Your Personal Information in the following circumstances:

• Where the Company needs to perform the contract it is about to enter into or has entered into with You;

• Where it is necessary for its legitimate interests (or those of a third party) and Your interests and fundamental rights do not override those interests;

• Where it needs to comply with a legal or regulatory obligation.

Generally the Company does not rely on consent as a legal basis for processing Your Personal Information other than in relation to sending direct marketing communications to You. You have the right to withdraw consent to marketing at any time by contacting the Company (see the Contact Details at the end of the privacy policy).

Purposes for Which the Company Will Use Your Personal Information.
Set out below, in a table format, is a description of the ways the Company plans to use Your Personal Information, and which of the legal bases the Company relies on to do so. The Company also identifies what its legitimate interests are where appropriate.

Note that the Company may process Your Personal Information on more than one lawful ground depending on the specific purpose for which it is using Your Personal Information.

When the Company refers to legitimate interests it means its interest in conducting and managing its business to enable it to give You good quality services and products. The Company makes sure it considers and balances any potential impact on You (both positive and negative) and Your rights before it processes Your Personal Information for its legitimate interests. The Company will not use Your Personal Information for activities where its interests are overridden by the impact on You (unless it has Your consent or is otherwise required or permitted to by law).

5. DISCLOSURES OF YOUR PERSONAL INFORMATION

The Company does not rent, lease or sell Your Personal Information to third parties for money or their direct marketing purposes.

The Company may share Your Personal Information with the categories of parties set out below for the purposes set out in the table in Paragraph 4 -- HOW THE COMPANY USES YOUR PERSONAL INFORMATION above.

• its parent company, American Greetings Corporation and other companies in the American Greetings group of companies;

• Credit card companies and other payment processors;

• Business partners, suppliers and sub-contractors for the performance of any contract we enter in to with them or you; and third-party service providers who perform services for us or on our behalf; and in some instances, our service providers may collect information from you directly. Such services may include, for example, hosting or maintaining the Website, providing customer support, monitoring the Website, data storage or warehouse, sending email, direct mail or other communications, fulfilling orders, mailing paper cards or sending gift cards, providing marketing assistance, research or business intelligence services, providing analytics services product safety or testing, processing payments or transactions, printing services, or performing other administrative services.

• Analytics and search engine providers that assist the Company in the improvement and optimisation of its services (including Apps) and the Site;

• Professional advisers, including lawyers, banks, auditors and insurers;

• HM Revenue and Customs, regulators and other authorities;

• Third parties to whom it may choose to sell, transfer, or merge parts of its business or assets. Alternatively, the Company may seek to acquire other businesses or parts of them or merge with them. If a change happens to the Company's business, then the new owners may use Your Personal Information in the same way as set out in this privacy policy.

When the Company discloses Personal Information for a business purpose, it enters into a contract that describes the purpose and requires the recipient to both keep that Personal Information confidential and not use it for any purpose except performing the contract or complying with legal requirements.

Where these third parties are the Company's processors, the Company requires them to respect the security of Your Personal Information and to treat it in accordance with the law. The Company does not allow its third-party processors to use Your Personal Information for their own purposes and only permits them to process Your Personal Information for specified purposes and in accordance with its instructions. Some of the third parties mentioned above, for example many professional advisers and HM Revenue and Customs, are controllers who, like the Company, are subject to specific obligations under data protection law, and who will have their own privacy notices setting out how they deal with Personal Information.

6. INTERNATIONAL TRANSFERS

American Greetings Corporation and other companies in the American Greetings group of companies are located in the USA. In addition, some of the external third parties the Company deals with are based outside the UK or the EEA or process Personal Information outside UK or the EEA, so their processing of Your Personal Information will involve a transfer of data outside the UK or the EEA. Whenever the Company transfers Your Personal Information out of the EEA, it will look to ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

• Transferring Your Personal Information to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission.

• Where the Company transfers data to American Greetings Corporation or other members of the American Greetings group of Companies, and when it uses certain service providers, it may use specific contracts approved by the European Commission which give personal data the same protection it has in Europe.

7. DATA SECURITY

The Company has put in place appropriate security measures to prevent Your Personal Information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, the Company limits access to Your Personal Information to those employees, agents, contractors and other third parties who have a business need to know. Processors the Company appoints will only process Your Personal Information on its instructions and where they are subject to a duty of confidentiality.

You should be aware, however, that transmission of information via the internet is not completely secure.

The Company has put in place procedures to deal with any suspected personal data breach (as defined in the GDPR) and will notify You and any applicable regulator of a breach where it is legally required to do so.

8. DATA RETENTION

The Company will only retain Your Personal Information for as long as necessary to fulfil the purposes it collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. The Company may retain Your Personal Information for a longer period in the event of a complaint or if it reasonably believes there is a prospect of a dispute in respect of its relationship to You.

To determine the appropriate retention period for Personal Information, the Company considers the amount, nature, and sensitivity of the Personal Information, the potential risk of harm from unauthorised use or disclosure of Your Personal Information, the purposes for which it processes Your Personal Information and whether it can achieve those purposes through other means, and the applicable legal requirements.

In some circumstances You can ask the Company to delete Your Personal Information by following the Request erasure right as outlined in Paragraph 9 -- YOUR LEGAL RIGHTS.

In some circumstances the Company may anonymise Your Personal Information (so that it can no longer be associated with You) for research or statistical purposes in which case the Company may use this information indefinitely without further notice to You.

9. YOUR LEGAL RIGHTS

You have rights under data protection laws in relation to Your Personal Information, including:

• Request access to Your Personal Information (commonly known as a "data subject access request"). This enables You to receive a copy of the Personal Information the Company holds about You and to check that the Company is lawfully processing it.

• Request correction of the Personal Information that the Company holds about You. This enables You to have any incomplete or inaccurate data the Company holds about You corrected, though the Company may need to verify the accuracy of the new data You provide to it.

• Request erasure of Your Personal Information. This enables You to ask the Company to delete or remove Personal Information where there is no good reason for the Company continuing to process it. You also have the right to ask the Company to delete or remove Your Personal Information where You have successfully exercised Your right to object to processing (see below), where the Company may have processed Your information unlawfully, or where the Company is required to erase Your Personal Information to comply with local law. If the Company is not able to comply with Your request for erasure for specific legal reasons, the Company will tell You at the time of Your request.

• Object to processing of Your Personal Information where the Company is relying on a legitimate interest (or that of a third party) and there is something about Your particular situation which makes You want to object to processing on this ground as You feel it impacts on Your fundamental rights and freedoms. In some cases, the Company may demonstrate that it has compelling legitimate grounds to process Your Personal Information, which override Your rights and freedoms. You also have the right to object where the Company is processing Your Personal Information for direct marketing purposes.

• Request restriction of processing of Your Personal Information. This enables You to ask the Company to suspend the processing of Your Personal Information in the following situations: (a) if You want the Company to establish the data's accuracy; (b) where its use of the data is unlawful but You do not want the Company to erase it; (c) where You need the Company to hold the data even if the Company no longer requires it as You need it to establish, exercise or defend legal claims; or (d) You have objected to its use of Your Personal Information but the Company needs to verify whether it has overriding legitimate grounds to use it.

• Request the transfer of Your Personal Information to You or to a third party. The Company will provide to You, or a third party You have chosen, Your Personal Information in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which You initially provided consent for the Company to use or where the Company used Your Personal Information to perform a contract with You.

• Withdraw consent at any time where the Company is relying on consent to process Your Personal Information. However, this will not affect the lawfulness of any processing carried out before You withdraw Your consent. If You withdraw Your consent, the Company may not be able to provide certain products or services to You. The Company will advise You if this is the case at the time You withdraw Your consent.

If You wish to exercise any of the rights set out above, please Contact us.

You will not have to pay a fee to access Your Personal Information (or to exercise any of the other rights). However, the Company may charge a reasonable fee if Your request is clearly unfounded, repetitive or excessive. Alternatively, the Company may refuse to comply with Your request in these circumstances.

The Company may need to request specific information from You to help the Company confirm Your identity and ensure Your right to access Your Personal Information (or to exercise any of Your other rights). This is a security measure to ensure that Your Personal Information is not disclosed to any person who has no right to receive it. The Company may also contact You to ask You for further information in relation to Your request to enable it to deal with Your request or to speed up its response.

The Company tries to respond to all legitimate requests within one month. Occasionally it may take longer than a month if Your request is particularly complex or the Company has received a number of requests. In this case, the Company will notify You and keep You updated.

10. CALIFORNIA RESIDENTS -- PRIVACY NOTICE