Who we are
Cadeau By Fafa Ltd, trading as Cadeau by Fafa, is responsible for the personal information described in this notice. We are the data controller for our website enquiries and our own customer and business records.
Company number: 17476683
Registered office: 1 Bridge Lane, London, NW11 0EA
Email: [email protected]
You can use these details for privacy questions, requests or complaints. This notice covers people who visit our website, enquire about or book our services, and recipients whose details are supplied for a gift commission.
Information we collect
Depending on how you use our services, we collect:
- Enquiry information: your name, email, chosen service, approximate number of gifts and your brief; and any company name, required date, postcode, budget or referral source you choose to provide.
- Booking information: agreed instructions, gift descriptions, names and messages for personalisation, correspondence, approvals, collection and delivery details, and contact numbers where supplied.
- Recipient information: names, addresses, delivery contact details and gift messages supplied by the person or business arranging a gift.
- Transaction records: quotations, invoices, payment status, bank-transfer references and refund records. Payments are currently made by BACS bank transfer; we may receive the payer's name and payment details shown by our bank. Our website enquiry form does not collect card details or banking credentials.
- Photographs and preferences: reference images you choose to send us, photographs of the wrapping and presentation we create, and any instructions you give us about photographing or sharing that wrapping. We ask for your specific permission before photographing or featuring the actual gift items.
- Technical information: information needed to serve and protect the website, which may include IP address, browser/device information, requested pages, request times and security events. Form submissions have a reference to help prevent duplicate delivery. A temporary identifier derived from an IP address is used to limit repeated submissions.
Most information comes directly from you. Recipient details may come from the gift sender, your employer or another person arranging the commission. Our website and email providers also process technical and delivery information.
Please do not send card details, identity documents or sensitive personal information in an enquiry or gift message. Fields marked as required are needed to handle the form enquiry. If necessary booking or delivery information is not supplied, we may be unable to provide the requested service; optional fields can be left blank.
How and why we use it
| Purpose | Legal basis |
|---|---|
| Discuss an individual's request, prepare a quotation and carry out their booking | Taking steps at your request before a contract, and performing our contract with you |
| Communicate with someone acting for a business customer | Our legitimate interest in managing business enquiries and commissions |
| Personalise, prepare and arrange delivery of gifts to recipients who are not our contracting customer | Our legitimate interest, and the sender's interest, in fulfilling the requested gift service with the necessary recipient details |
| Operate and secure the website and email, prevent spam and duplicate submissions, and investigate technical problems | Our legitimate interest in providing a reliable and secure service |
| Keep accounting records and respond to legally required requests | Compliance with our legal obligations |
| Handle service complaints, establish what was agreed, and resolve or defend claims | Our legitimate interest in fair complaint handling and protecting legal rights; legal obligation where applicable |
| Manage photographs of our wrapping and customers' photo-use preferences, where these records relate to an identifiable person | Our legitimate interest in showing our craftsmanship while keeping customers' details private and respecting objections |
| Use photographs featuring gift items with your specific permission, where they contain personal information | Consent, which you can withdraw at any time |
| Send optional promotional emails if offered | Consent, which you can withdraw at any time |
Where we rely on legitimate interests, we consider the effect on your rights and use only information reasonably needed for that purpose. You may object to this processing.
Submitting an enquiry does not subscribe you to a mailing list. We do not sell your personal information. We do not make solely automated decisions about you that produce legal or similarly significant effects.
Photographs of our wrapping
We may use photographs of the wrapping and presentation we create on our website, social media, portfolio and other marketing materials unless you tell us otherwise. Our usual content shows only the wrapping and presentation. If we would like to photograph or feature the actual gift items, we will ask for your specific permission first. Images used as content will not show names, addresses, personal messages, client branding or other identifying or confidential details. Reference images you send us are used to understand your brief, not published as marketing content.
If you do not want your wrapping photographed or shared, please tell us when booking or before handing over your gifts, or email [email protected]. Opting out does not affect your service. You can also contact us later to stop future use and request removal from channels we control; we will action this within a reasonable time. We record your preference so that we can respect it. We do not treat a failure to opt out as consent to publish personal information.
Who receives information
We share information where needed with:
- Cloudflare, for website hosting, form processing and security.
- Resend, for sending website enquiries to our business inbox.
- Google Workspace, for business email and related correspondence.
- Couriers or delivery providers, where delivery is agreed, using the details needed to complete it.
- Our bank, accountants, insurers or professional advisers, where needed for a payment, record-keeping, advice or a claim.
- Authorities, where disclosure is required by law.
Access within the business is limited to people who need information for their work. Providers acting on our instructions must protect the information under appropriate contractual terms. Some providers, such as banks or couriers, may also act as independent controllers for their own legal or operational purposes.
For a corporate commission where we process a recipient list solely on the client's documented instructions, we may instead act as its processor for that activity. The client's privacy information and the agreed processing arrangements also apply. We remain responsible for our own customer and business records.
Processing outside the UK
Our technology providers operate internationally, so information may be processed outside the UK, including in the United States. Selecting a European email-sending region does not guarantee that all processing takes place in Europe.
Where a restricted international transfer occurs, an applicable UK adequacy arrangement or appropriate contractual safeguards must cover it. Our providers' data-processing terms include transfer provisions, such as standard contractual clauses with the UK Addendum, where applicable. You can contact us for information about the safeguards relevant to your information and how to obtain a copy.
How long we keep information
We keep information only for the purpose for which it is needed, using the following retention approach:
| Record | Retention approach |
|---|---|
| Enquiries that do not become bookings | Up to 12 months after the last substantive contact, then deletion unless a continuing enquiry or dispute justifies retention |
| Essential booking agreements, approvals and completion records | Normally up to six years after completion or cancellation to deal with contractual queries and claims |
| Invoices and accounting records | For the statutory accounting/tax retention period; normally six years from the end of the relevant company financial year, or longer where legally required |
| Working recipient lists, gift messages and extra reference photographs | Normally deleted within 90 days after fulfilment and resolution of delivery issues; only necessary evidence is kept longer with the booking record |
| Wrapping photographs, permitted gift-item photographs and photo-use preferences | Reviewed regularly and retained only while needed for the agreed use and to honour your preferences. We stop future use if you opt out of wrapping content or withdraw permission for gift-item content, and keep only the necessary record of your preference |
| Optional email marketing permissions | While used for the agreed purpose, subject to review and withdrawal of consent; a minimal record of a withdrawal may be retained to respect it |
| Security and email-delivery records | As needed to deliver messages, prevent abuse and investigate incidents, taking account of provider retention settings |
If a complaint, legal claim or legal obligation requires longer retention, we keep only the relevant information until that need ends. Deleted information may remain temporarily in protected backups until those backups expire; it is not used for routine business purposes.
Cookies and website technology
Our enquiry form uses technology needed to send your message and protect the service. The current website code does not include advertising pixels or optional analytics scripts. Hosting or security services may use necessary cookies or similar technologies to operate and protect the website.
If we introduce optional storage or tracking, we will explain its purpose and provide consent or objection controls as required before using it. You can also manage cookies through your browser settings; blocking necessary technologies may affect website functions. External links, such as Instagram, take you to services with their own privacy information.
Your rights
Depending on the circumstances, you can ask to access your information, correct inaccurate details, delete it, restrict its use or receive a portable copy. You can object to processing based on legitimate interests and to direct marketing. Where we use consent, you can withdraw it without affecting processing that was lawful before withdrawal.
Contact us using the details above. We may need enough information to verify your identity and locate the records. Rights are subject to the applicable legal conditions; for example, some accounting records must be retained. We normally respond within one month and will explain if a lawful extension or exception applies.
Privacy complaints
You can make a data protection complaint by email or post using the contact details above. Please explain what happened and the outcome you are seeking. We will acknowledge it within 30 days, investigate without undue delay, keep you informed and explain the outcome.
You can also complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint. You do not have to give up that right by contacting us first.
Changes to this notice
We will update this notice if our services or use of personal information changes. The date at the top identifies the latest version. Where required, we will bring significant changes to your attention before using information for a new purpose.