Privacy Notice

1. Who is responsible

Insignia Creative Ltd, trading as Your Bit of Space, is the controller of the personal information used for this gift service. Our business and correspondence address is Unit 2 Marble Court Business Park, Lymington Road, Torquay, Devon TQ1 4FB. Company number: 04693927. Email comms@yourbitofspace.com for privacy enquiries or to exercise your rights. This notice covers buyers, gift recipients, website visitors and people contacting support.

2. Information we use and where it comes from

Buyers provide the certificate name, chosen Space Date, destination, buyer email address, optional recipient email address and optional personal message. We also keep the order reference, payment status, Stripe checkout reference, delivery status, generated PDF and the checkout confirmations, including the terms version and immediate-supply consent. A Space Date need not be a date of birth; please do not supply unnecessary sensitive information.

If you receive a gift, the buyer supplied your name, email address, date and any message. We use those details to personalise and send the gift, not to enrol you in marketing. We also receive delivery information from our email provider and payment confirmations from Stripe. Support correspondence comes from you or someone acting for you.

The hosting service processes technical information such as IP addresses, browser/request information and security logs to operate and protect the website. Guest orders use a browser cookie and a derived identifier. Older signed-in orders may be linked to the account identifier used when ordering. We do not receive or store your full payment card details.

3. Purposes and lawful bases

Contract: we use buyer details and order information to take steps you request before purchase, fulfil your order, provide the PDF, confirm payment and deal with contractual support or remedies.

Legitimate interests: we use recipient information to fulfil the buyer’s requested gift delivery. Our interest, shared with the buyer, is providing the requested personal gift while using only the information needed. We also rely on legitimate interests to protect the website, prevent misuse, investigate delivery failures, respond to enquiries and establish or defend legal claims. You may object to processing based on legitimate interests.

Legal obligation: we keep records needed for tax and accounting and respond to lawful requests from authorities. We use immediate-supply consent to record your consumer-law checkout choice; it is not consent to marketing.

Providing the required order fields is necessary to create and deliver a gift. The recipient email is needed only for direct delivery and the personal message is optional. We do not use this gift flow for advertising profiling, marketing mailing lists or solely automated decisions producing legal or similarly significant effects. Wildcard selection is an automated random gift choice.

4. Who receives the information

We use OpenAI Sites and its Cloudflare hosting, database and file-storage infrastructure to run the website and store orders and PDFs. Stripe handles checkout and payment processing under its own privacy information. Resend processes email addresses, message content, attachments and delivery information to send the gift emails. Our business email service, provided through 20i, handles correspondence sent to our support inbox.

The buyer receives a certificate copy. If direct delivery is selected, the specified recipient receives the gift certificate and personal message. Check addresses carefully because sending to an incorrect address can disclose the gift details to someone else. The recipient gift email does not show the purchase price or buyer payment information.

We may share relevant records with professional advisers or public authorities where needed for accounting, legal obligations or claims. We do not sell personal information. Service providers receive information relevant to their role and may also process some information for their own security or regulatory purposes.

5. Processing outside the UK

Our technology and payment providers operate internationally, including in the United States. Your information may be processed outside the UK; the service is not restricted to UK-only hosting. Where we are responsible for a restricted transfer, UK data protection law requires an applicable adequacy arrangement or appropriate safeguards, such as approved contractual clauses with the UK Addendum or an International Data Transfer Agreement, unless a permitted exception applies. Contact us to request details of the safeguards relevant to your information. Resend’s Data Processing Addendum includes UK transfer provisions. Provider privacy information is linked below.

6. How long information is kept

Financial and accounting records are generally kept for six years from the end of the company financial year to which they relate, or longer where a tax enquiry or another legal requirement makes that necessary.

For certificate files, personalisation, messages, delivery records and support correspondence, retention depends on whether they are still needed to deliver or recover the gift, resolve an open complaint, investigate misuse or establish, exercise or defend legal claims. We consider whether the order is complete, any outstanding issue, the relevant legal time limits and whether a reduced record would suffice. When information is no longer needed for those purposes, we delete or anonymise it. Financial retention does not mean every message or certificate needs to be kept for that whole period. Contact us to request deletion or details of the retention decision for your order.

We do not promise an indefinite certificate archive. Keep your own PDF copy. Technical logs are subject to the hosting provider’s applicable retention arrangements; essential browser storage is described below.

7. Essential cookies and browser storage

The gift journey uses an essential secure cookie named __Host-ybos-guest to recognise the browser that placed a guest order. It lasts up to 30 days, is sent only over HTTPS and cannot be read by website JavaScript. Our order records contain a derived identifier rather than the raw cookie value. Clearing the cookie or changing browsers can remove order-page access.

Session storage named ybos-draft keeps unfinished gift details in the current browser tab and ybos-order-key helps prevent duplicate order creation. Session storage normally lasts for the tab’s browsing session and may be restored by your browser. You can clear it through your browser settings. Avoid entering personal details on a shared device.

We have not added advertising or analytics cookies to this gift journey. Stripe and the hosting service may use their own essential security or checkout storage when you use their services. Blocking essential cookies may stop checkout or order access working. If optional tracking is introduced, we will provide the appropriate information and choices before using it.

8. Your rights and complaints

Depending on the circumstances, you can request access, correction, erasure, restriction or portability of your information and object to processing based on legitimate interests. These rights have legal conditions and exceptions, for example where records must be retained by law. Where processing relies on consent, you can withdraw it without affecting earlier lawful processing.

Email comms@yourbitofspace.com with enough information to locate your records. We may need to verify your identity. We normally respond within one month, subject to lawful extensions, and normally do not charge a fee. Gift recipients can contact us directly even though the buyer supplied their details.

You can complain to the Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/. We would welcome the opportunity to address your concern first, but this does not limit your right to contact the ICO. The purchase policy on correcting certificate details does not remove your data protection rights.

9. Changes and test environments

We update this notice when the service or its data use changes. The date above identifies this version. Information entered into any separately identified test environment is also processed as described here; please use fictional recipient details when testing.