Gifta Privacy Policy

This Privacy Policy explains how Gifta (Pty) Ltd, registration number 2026/260556/07, trading as Gifta ("Gifta", "we", "us", or "our"), collects, uses, stores, shares, and protects personal information when you access or use the Gifta website, Dreamboard creation journey, account areas, communications, and related services (together, the "Platform").

Gifta is a Dreamboard and pooled-gifting platform. The current live Platform allows hosts to create Dreamboards, manage their Dreamboards, and share them with contributors. Public contribution pages are visible, but live guest checkout is enabled.

By accessing or using the Platform, you acknowledge that you have read this Privacy Policy.

This Privacy Policy applies to personal information processed by Gifta relating to:

• website visitors;
• account holders;
• Dreamboard hosts;
• people whose information is submitted by a host in connection with a Dreamboard, including children or other recipients;
• support contacts; and
• any other person whose personal information is submitted through the Platform.

Depending on how you use the Platform, we may collect the following personal information.

5.1 Information you provide directly

• full name;
• email address;
• mobile number or WhatsApp number;
• account profile details;
• identity-provider information needed to sign you in or link your account;
• child or recipient details submitted by a host, including name, age, photo, occasion details, and related messages;
• host payout details, including bank-account details or Karri card details where relevant; and
• support messages, notes, and other communications.

Gifta does not currently ask users to create and store a local password in the Platform. Authentication is handled through third-party identity-provider tooling.

5.2 Dreamboard and transaction-related information

• Dreamboard titles, descriptions, and goals;
• Dreamboard dates and status information;
• payout and settlement records connected to a Dreamboard;
• historical contribution, payment, refund, dispute, or reversal records where those exist in the Platform; and
• processor reference numbers and transaction metadata provided by service providers.

Gifta does not intentionally store full payment card numbers or CVV details. Card-based transactions are handled through Peach Payments's secure checkout surfaces and related payment infrastructure.

5.3 Information collected automatically

• IP address;
• browser type;
• operating system;
• device identifiers;
• pages viewed;
• links clicked;
• timestamps;
• referral URLs;
• approximate location inferred from technical data;
• cookie and similar-technology data; and
• usage, analytics, and diagnostic data.

5.4 Information from third parties

We may receive personal information from:

• identity and authentication providers;
• cloud hosting, analytics, communications, and support providers;
• anti-fraud, compliance, or verification providers;
• payment providers, including Peach Payments, where relevant; and
• other users who submit your information in connection with a Dreamboard.

We may process personal information to:

• create and manage user accounts;
• enable the creation and administration of Dreamboards;
• store and display Dreamboard information;
• support host payout setup and payout operations;
• provide confirmations, reminders, and support;
• maintain the safety, security, and integrity of the Platform;
• detect, investigate, and prevent fraud, abuse, prohibited conduct, and unauthorised activity;
• improve the Platform, analytics, operations, and user experience;
• communicate service-related notices;
• send marketing communications where lawful;
• comply with legal, regulatory, tax, accounting, audit, and law-enforcement obligations; and
• establish, exercise, or defend legal claims.

Where required, Gifta processes personal information on one or more lawful grounds, including:

• your consent;
• the conclusion or performance of a contract with you;
• compliance with a legal obligation;
• Gifta's legitimate interests, including fraud prevention, platform security, support, and service improvement;
• the protection of a legitimate interest of the data subject; or
• any other lawful ground recognised by POPIA.

If you provide personal information about another person, including a child, recipient, contact person, or contributor contact, you confirm that you are authorised to provide that information and that you have taken any steps required by law to inform that person.

Gifta's host flow can involve personal information relating to children, including child name, age, and photo.

If you submit information about a child, you confirm that you are the child's parent or legal guardian, or that you otherwise have lawful authority to provide that information for the relevant Dreamboard purpose.

Gifta may request further information or remove child-related information if Gifta reasonably believes that the information was submitted without lawful authority or in breach of applicable law.

Gifta uses cookies and similar technologies to:

• enable core platform functions;
• keep users signed in;
• remember user preferences;
• measure performance and usage;
• improve security; and
• support analytics and lawful marketing.

You can manage cookie preferences through your browser settings and, where implemented, through Gifta's cookie controls.

Gifta may share personal information with:

• identity and authentication providers;
• cloud hosting, storage, communications, analytics, and support providers;
• legal, accounting, audit, tax, and insurance advisers;
• regulators, courts, law enforcement, or competent authorities where required by law; and
• a purchaser, investor, funder, merger partner, or successor entity in connection with a financing, acquisition, restructuring, or sale of assets, subject to appropriate safeguards.

Where payment or payout functionality is enabled, Gifta may also share relevant information with payment processors, banks, card issuers, anti-fraud providers, or payout partners.

Gifta does not sell personal information.

Some of Gifta's service providers or partners may be located outside South Africa. Where personal information is transferred cross-border, Gifta will take reasonable steps to ensure that the transfer is lawful and that appropriate safeguards or adequate protections are in place.

Gifta takes reasonable technical and organisational measures to protect personal information against loss, misuse, unauthorised access, disclosure, alteration, and destruction.

No system is perfectly secure. You are responsible for protecting your account access methods and for notifying Gifta immediately of suspected unauthorised use of your account.

Gifta retains personal information only for as long as reasonably necessary for the purpose for which it was collected, including for:

• account management;
• Dreamboard administration;
• payout and transaction records;
• dispute, fraud, and security monitoring;
• legal and regulatory compliance; and
• enforcing Gifta's rights and agreements.

Gifta may retain de-identified or aggregated information for analytics and product improvement for longer periods.

Subject to applicable law, you may request:

• confirmation that Gifta holds personal information about you;
• access to your personal information;
• correction of inaccurate or incomplete personal information;
• deletion or destruction of unlawfully processed personal information;
• objection to certain processing;
• withdrawal of consent where processing is based on consent; and
• objection to direct marketing.

Requests may be sent to ryan@gifta.co.za.

Gifta may send marketing communications where lawful to do so. You may opt out of marketing communications at any time by using the unsubscribe functionality or by contacting ryan@gifta.co.za.

Service messages relating to your account, Dreamboards, security, or use of the Platform are not marketing and may still be sent where necessary.

If Gifta has reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person and notification is required by law, Gifta will take steps consistent with its legal obligations, including notifying affected persons and/or the Information Regulator where required.

The Platform may link to or integrate with third-party websites or services. Their privacy practices are governed by their own policies and notices, not this Privacy Policy.

Gifta may update this Privacy Policy from time to time. Updated versions will be posted on the Platform with a revised effective date. Material changes may also be communicated by email, in-product notice, or another appropriate method.

Privacy and data-protection queries may be directed to: