Privacy Policy

Information about our privacy practices and how we protect your personal data.

1. Introduction

Welcome to our platform. We are committed to protecting your privacy and ensuring that your personal data is handled in a safe and responsible manner. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform to purchase, send, or redeem digital gift vouchers.


2. Information We Collect

We collect and process only the minimum personal data necessary for the purchase, delivery, and redemption of gift vouchers and do not use this data for unrelated purposes.

2.1 Personal Data

We collect the following personal data when you create an account and complete your profile:

First and last name, email address, country of residence.

2.2 Recipient Information

When you purchase a gift voucher, we collect the recipient’s name or alias, and email address to send them the voucher link.

2.3 Usage Data

We track (but do not collect or store) your IP address solely to determine your country of origin and apply the correct currency to prices displayed on our platform.


3. How We Use Your Information

  • - Account Management: Create and manage your account, process purchases, provide customer support.

  • - Voucher Delivery & Redemption:

    • Use your details to issue and manage vouchers you purchase.
    • Use recipient email addresses to send voucher links and enable voucher preview and redemption workflows.
    • Where redemption requires it, share limited recipient/voucher data with the relevant redemption partner so they can validate the voucher and fulfill the offering (see Section 4).

  • - Currency Determination: Use IP-derived country detection to display the correct currency.

  • - Transactional Communications (no marketing consent required): Send emails necessary to provide the service (e.g., purchase confirmations, voucher delivery, security notices).

  • - Marketing Communications (consent-based): Send promotional emails only if you opt in (see Section 6).


4. Data Sharing and Disclosure

  • We do not sell or rent your personal data to third parties.

  • - Service Providers: We may share data with trusted vendors who help operate the platform (e.g., email delivery, payment processing, infrastructure). They are authorized to process data only as needed to provide services to us and must protect it.

  • - Redemption Partners (recipient data): To enable voucher redemption and fulfillment, we may share the minimum necessary data with the merchant/partner responsible for the offering. This may include:

    • Recipient email address (or an equivalent identifier),
    • Voucher identifier / redemption token,
    • Redemption status (e.g., redeemed/not redeemed),
    • Offering details needed to fulfill the voucher. Our partners are required to be GDPR-compliant and process personal data under a data processing agreement (DPA) or equivalent contractual safeguards.

  • - Legal Requirements: We may disclose information if required by law or in response to valid requests by public authorities.


5. Data Retention

  • We retain personal data only as long as necessary for the purposes described in this policy, including legal, accounting, or compliance obligations.
  • - Account data: Kept for 12 months after the account becomes inactive, unless a longer period is required by law.
  • - Recipient data: Retained as long as needed to deliver the voucher and support redemption, dispute handling, fraud prevention, and compliance obligations.
  • - Deletion requests: You can request deletion at any time (see below). We may retain limited information where required for legal compliance, fraud prevention, security, or financial recordkeeping.

6. Legal Bases for Processing Personal Data (GDPR)

We process personal data in accordance with the General Data Protection Regulation (GDPR) and rely on the following legal bases:

  • - Performance of a Contract (Article 6(1)(b)) We process personal data where necessary to perform a contract with you, including creating and managing accounts, processing payments, delivering digital gift vouchers, and enabling voucher redemption.

  • - Legitimate Interests (Article 6(1)(f)) We may process limited personal data where it is necessary for our legitimate interests, such as fraud prevention, platform security, customer support, service improvement, and ensuring the correct functioning of voucher delivery and redemption. These interests are balanced against your rights and freedoms.

  • - Consent (Article 6(1)(a)) We process personal data for marketing communications only where you have given explicit, informed, and freely given consent. You may withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

  • - Legal Obligations (Article 6(1)(c)) We may process and retain personal data where necessary to comply with applicable legal obligations, such as accounting, tax, and regulatory requirements.

Recipient personal data is processed solely for voucher delivery and redemption purposes and is not used for marketing unless the recipient has provided separate and explicit consent.


7. Your Rights & Choices

  • - Access, correction, deletion: You can request access to, correction of, or deletion of your personal data by emailing hey [@] bonte.app.

  • - Marketing opt-in / opt-out (Explicit Consent):

    • If you opt in, we may send marketing emails about offers, product updates, and promotions.
    • You can opt out at any time by using the unsubscribe link in marketing emails or by contacting hey [@] bonte.app.
    • Opting out of marketing does not affect transactional emails needed to provide voucher delivery, redemption, or account/security communications.

  • - Recipient communications: Recipient emails are used to deliver vouchers and support redemption; they are not used for marketing unless the recipient separately and explicitly consents.


8. Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized or unlawful processing and against accidental loss, destruction, or damage. Security measures include encryption in transit, access controls, and the use of PCI-DSS-compliant payment providers (stripe) where applicable.


9. Third-Party Links

Our platform may contain links to other websites. We are not responsible for the privacy practices or content of those sites. We encourage you to read their privacy policies.


10. Children’s Privacy

Our platform is not intended for children under the age of 16. We do not knowingly collect personal data from children under 16.


11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes by posting the new policy on our platform.


12. Contact Us

For questions, please contact us at hey [@] bonte.app.


Last updated: Jan 22, 2026