Effective Date: 13 October 2026

Website: https://giftlio.com/

Company: Lumeris Store Ltd

Company Number: 17410906

Registered Office: 2nd Floor College House, 17 King Edwards Road, Ruislip, London, United Kingdom, HA4 7AE

Contact Email: support@giftlio.com

1. Introduction

This Privacy Policy sets out how Lumeris Store Ltd (referred to as “Giftlio”, “the Company”, “we”, “our”, or “us”) collects, processes, uses, discloses, and safeguards personal information obtained through the website https://giftlio.com/ (the “Website”) and the digital products and services offered through it.

Giftlio operates an online retail platform providing digital gift cards, prepaid activation codes, gaming-related digital products, and other electronically delivered products for various third-party brands and services. In the course of operating the Website, processing customer purchases, delivering digital products, and providing customer assistance, certain personal information must be collected and processed.

We recognise that customers entrust us with information that requires responsible handling. We are committed to maintaining appropriate standards of privacy, confidentiality, and information security and to ensuring that personal data is processed lawfully, fairly, and transparently.

This Privacy Policy is intended to explain what information we collect, why we require it, how it is used, the circumstances in which it may be shared, and the rights available to individuals under relevant data protection laws.

Our processing activities are subject to applicable legislation, including the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (“PECR”). Where the EU General Data Protection Regulation applies to our activities, we also comply with its relevant requirements.

This Policy applies to individuals who browse the Website, register an account where available, purchase digital products, contact our support team, subscribe to marketing communications, or otherwise engage with Giftlio.

We encourage you to read this document alongside the Terms and Conditions, Cookie Policy, and Refund Policy published on the Website.

2. Company Information and Data Controller

Giftlio is operated by Lumeris Store Ltd, a private limited company registered in England and Wales.

Legal Entity: Lumeris Store Ltd

Company Registration Number: 17410906

Registered Office: 2nd Floor College House, 17 King Edwards Road, Ruislip, London, United Kingdom, HA4 7AE

Website: https://giftlio.com/

Email: support@giftlio.com

For the purposes of applicable data protection legislation, Lumeris Store Ltd is the data controller for personal information processed in connection with its own commercial activities.

This means that the Company determines the purposes and lawful grounds for collecting personal information, the methods of processing it, and the measures appropriate for protecting it.

Certain external organisations, including payment processors and other service providers, may independently determine how they use particular information when performing their own legal or regulatory responsibilities. In such circumstances, those organisations may act as separate data controllers rather than as processors acting solely on our instructions.

Customers may contact the Company at the email address above regarding privacy-related questions, personal data requests, or concerns about the handling of their information.

3. Application of This Privacy Policy

This Privacy Policy covers personal information processed in connection with the operation of Giftlio and the commercial relationship between the Company and its customers.

It applies to information collected during Website visits, account registration, checkout, payment authorisation, electronic product fulfilment, customer service communications, refund investigations, and other related activities.

Some products available through Giftlio are issued or supported by independent third-party brands. When a customer subsequently redeems a digital gift card or activation code on the relevant brand’s website or application, the issuing brand may collect information independently.

The handling of information by these external services is governed by their respective privacy notices and is not controlled by this Policy.

Likewise, this Policy does not extend to unrelated websites or external platforms accessible through links provided on Giftlio.

Information that has been irreversibly anonymised so that an individual can no longer reasonably be identified is not treated as personal data for the purposes of this Policy.

4. Categories of Personal Information Collected

The information processed by Giftlio varies according to the services requested and the manner in which a customer interacts with the Website.

Customer identification and contact details

We may collect information such as a customer’s full name, email address, telephone number, billing address, country of residence, and other details voluntarily supplied during checkout, account registration, or communication with the Company.

Where customer accounts are available, account-related information may include login identifiers, encrypted authentication credentials, account preferences, and associated purchase records.

Purchase and transaction details

When customers purchase products through Giftlio, we collect information necessary to maintain accurate transaction records. This may include purchased product descriptions, order identification numbers, prices, currencies, transaction dates, payment confirmation status, delivery status, refund information, and transaction references supplied by payment service providers.

Payment-related information

Payments are processed through external payment service providers. Depending on the payment integration, Giftlio may receive payment confirmation details, limited payment method identifiers, masked card information, payment status codes, and other transaction information needed for accounting, reconciliation, customer support, and fraud prevention.

The Company does not require customers to provide complete payment card details directly to its customer support team and does not intend to retain full card numbers or card verification codes within its ordinary business records.

Technical and device information

When accessing the Website, certain technical information may be generated automatically, including IP addresses, browser characteristics, operating systems, device types, language settings, approximate location inferred from network information, access timestamps, referral sources, and Website interaction records.

Such information may be used for maintaining functionality, diagnosing technical problems, detecting suspicious behaviour, and understanding Website performance.

Customer communications

We may retain information contained in emails, customer service enquiries, complaints, order-related correspondence, refund requests, and other messages submitted to the Company.

Verification and fraud-related information

In circumstances involving unusual transactions, suspected misuse, payment disputes, or legal compliance requirements, we may request additional information reasonably necessary to verify a transaction or establish the legitimacy of an order.

This may include supporting identification or billing documentation where appropriate and legally justified. Such information is not necessarily collected from every customer.

Marketing preferences

Where customers subscribe to marketing communications, we may maintain their email addresses, subscription records, consent status, communication preferences, and unsubscribe requests.

Giftlio does not intentionally seek to collect sensitive personal information unrelated to its commercial activities.

5. Sources of Personal Information

Personal information is obtained through several channels associated with the operation of the Website.

Information may be provided directly by customers during purchases, account registration, support enquiries, newsletter subscriptions, and requests concerning completed orders.

Other information is generated automatically when customers interact with the Website. Website logs, essential session technologies, security systems, and cookies may record certain technical details without requiring manual submission.

In addition, the Company may obtain relevant information from third-party providers involved in processing payments, delivering products, investigating suspected fraud, managing chargebacks, providing technical infrastructure, or supporting customer communications.

Where legally permitted and relevant to a specific investigation, information may also be obtained from competent authorities, payment networks, financial institutions, or legitimate fraud prevention resources.

Information received through these channels is processed only where an appropriate purpose and lawful basis exist.

6. Purposes and Lawful Grounds for Processing

Giftlio processes personal information for clearly defined commercial, operational, security, and legal purposes.

Under applicable data protection legislation, processing must be supported by an appropriate lawful basis.

Performance of a contract

Certain processing activities are necessary to fulfil purchases and provide services requested by customers. These include receiving and managing orders, verifying successful payment, delivering digital codes, providing order confirmations, maintaining account functionality, assisting customers, and resolving product delivery issues.

Compliance with legal obligations

The Company may process and retain information to satisfy applicable accounting requirements, tax obligations, consumer protection legislation, lawful regulatory requests, and other statutory responsibilities.

Legitimate business interests

Where permitted by law and after considering the interests and rights of affected individuals, Giftlio may process information to maintain the security and integrity of the Website, prevent payment abuse, investigate suspicious activity, improve Website reliability, administer business operations, manage disputes, and protect legal rights.

Consent

Where legally required, we obtain consent before undertaking certain processing activities, particularly those involving non-essential cookies or electronic marketing.

Customers may withdraw consent at any time through the available mechanisms. Withdrawal does not invalidate processing lawfully carried out before consent was withdrawn.

The applicable lawful basis depends on the specific processing activity, its necessity, and the circumstances in which information is collected.

7. Order Processing and Digital Product Delivery

Giftlio sells electronically delivered products, including digital gift cards, prepaid codes, and digital gaming products. Delivering these products requires the processing of certain customer and order information.

When an order is placed, the Company processes the information necessary to identify the purchased product, confirm the payment, generate or obtain the relevant digital code, and arrange delivery through the method displayed at checkout.

Digital products are generally delivered electronically, including through the email address supplied during the purchase process.

The Company may retain delivery-related information, including delivery status, order references, fulfilment confirmations, and relevant communication records, to investigate technical problems or resolve customer enquiries.

Some digital products are supplied through external distributors, product suppliers, or service platforms. Where necessary to complete an order, limited information may be transmitted to such parties.

Only information reasonably necessary for the relevant fulfilment or support purpose should be disclosed.

Customers should ensure that the contact information provided during checkout is accurate, as incorrect information may interfere with delivery or require additional support.

8. Payment Processing and Transaction Security

To accept payments for digital products, Giftlio uses third-party payment processing services.

During checkout, personal and payment-related information may be transmitted to the relevant payment provider for authorisation, verification, transaction processing, fraud screening, and payment confirmation.

Depending on the payment method and provider, this information may include customer identification details, billing information, purchase amounts, currencies, IP addresses, device information, and transaction identifiers.

Payment providers may be required to apply their own authentication, anti-fraud, regulatory compliance, and information security procedures.

Giftlio seeks to use payment arrangements designed to protect sensitive cardholder information and minimise unnecessary exposure of payment credentials.

Where card information is entered directly into secure payment interfaces operated by external providers, those providers are responsible for processing such information in accordance with their applicable security and data protection obligations, including relevant PCI DSS requirements.

The Company may retain limited payment and transaction records to support reconciliation, accounting, refunds, disputes, fraud investigations, and legal compliance.

Payment service providers may also act as independent data controllers in relation to information processed for their own regulatory or operational purposes.

9. Fraud Prevention and Transaction Verification

The sale of electronically delivered products can involve particular fraud and payment security risks because digital codes may be transferred or redeemed shortly after purchase.

Giftlio may therefore process relevant personal information to identify suspicious orders, reduce unauthorised payment activity, prevent misuse of promotional offers, investigate chargebacks, and protect legitimate customers.

Transaction security procedures may consider factors such as transaction values, purchase frequency, payment authorisation outcomes, IP addresses, device information, geographical inconsistencies, and unusual ordering patterns.

Where reasonably necessary, transactions may be referred for additional verification or manual review.

A customer may be asked to provide further information to establish their identity, confirm billing details, or resolve a payment-related concern. Such requests will be limited to information relevant to the issue under investigation.

Giftlio may cooperate with payment providers, fraud prevention specialists, and competent authorities where there is a lawful basis to do so.

Where an order cannot be adequately verified, delivery may be delayed or the transaction may be declined or cancelled in accordance with the Company’s Terms and Conditions and applicable law.

Verification records are retained only to the extent reasonably necessary for legitimate security, dispute resolution, or compliance purposes.

10. Cookies and Website Technologies

Giftlio may use cookies and related technologies to provide essential Website features, maintain secure browsing sessions, remember user preferences, and evaluate Website functionality.

Cookies are small data files stored on a visitor’s device by websites or associated service providers.

Some cookies are necessary for essential operations, including shopping cart functionality, checkout sessions, Website security, and the maintenance of user preferences.

Other technologies may be used, where implemented, for performance measurement, statistical analysis, or marketing-related purposes.

Non-essential cookies and similar technologies are used only where an appropriate lawful basis exists and any legally required consent has been obtained.

Customers may control certain cookies through the Website’s available preference mechanisms and their browser settings.

Disabling essential technologies may prevent some Website functions from operating correctly.

Further details concerning the categories of cookies used, their purposes, and the choices available to visitors should be provided in Giftlio’s separate Cookie Policy.

11. Sharing Personal Information with Third Parties

Giftlio does not sell customer personal information as an independent commercial product.

However, the operation of an online digital retail business requires cooperation with certain external service providers.

Personal data may be disclosed to payment processing companies, financial institutions, hosting and infrastructure providers, digital product suppliers, customer communication services, security specialists, fraud prevention providers, and professional advisers where such disclosure is necessary and lawful.

Payment providers may receive information necessary to authorise transactions, confirm payment, process refunds, and investigate disputes.

Digital product suppliers and fulfilment services may receive relevant order information required for the provision, delivery, or investigation of a purchased product.

Technology and hosting providers may process limited information to operate, maintain, support, or secure the Website and its supporting infrastructure.

Customer communication providers may process relevant contact details and messages to support order confirmations, customer assistance, and other authorised communications.

Professional advisers and competent authorities may receive information where reasonably required for accounting, legal advice, regulatory compliance, formal investigations, or the establishment or defence of legal claims.

In the event of a lawful corporate reorganisation, merger, acquisition, or transfer of business assets, relevant information may be disclosed or transferred subject to applicable confidentiality and data protection requirements.

Where third parties act as processors on behalf of Giftlio, appropriate contractual arrangements will be established as required by law.

12. International Processing and Data Transfers

Certain external service providers used in operating Giftlio may maintain infrastructure, personnel, or processing facilities outside the United Kingdom.

As a result, customer information may be transferred internationally or accessed from jurisdictions with different data protection frameworks.

Where international transfers are subject to legal restrictions, the Company will use an appropriate transfer mechanism recognised by applicable law.

Depending on the destination and circumstances, this may involve an applicable adequacy decision, the UK International Data Transfer Agreement, the UK Addendum to the European Commission’s Standard Contractual Clauses, or another legally recognised arrangement.

Where the EU GDPR applies, relevant EU international transfer rules will also be considered.

The Company will take appropriate steps to ensure that international processing arrangements provide the protections required by law.

Customers may contact Giftlio to request further information about the international transfer safeguards relevant to their personal information.

13. Retention of Personal Information

Giftlio retains personal information for periods that are necessary and proportionate to the purposes for which it was obtained.

Different categories of information may be subject to different retention requirements.

Order histories, invoices, and related financial information may need to be retained for accounting, taxation, audit, and statutory recordkeeping purposes.

Customer service correspondence may be retained for a reasonable period to assist with subsequent enquiries, complaints, refunds, or disputes.

Technical and security records may be retained for periods determined by their operational usefulness, security significance, and any applicable legal requirements.

Where customers maintain registered accounts, relevant profile information may be held while those accounts remain active. Certain associated records may continue to be retained after account closure where legally justified.

In determining appropriate retention periods, the Company considers the nature of the information, the original processing purpose, legal requirements, potential disputes, applicable limitation periods, and the risks associated with continued storage.

When personal data is no longer necessary and there is no lawful justification for retaining it, the Company will arrange for its deletion, anonymisation, or secure disposal.

Information held in restricted backups or archives will be handled under applicable retention and security procedures.

14. Measures for Protecting Personal Data

The Company recognises that protecting customer information is essential to maintaining a trustworthy online purchasing environment.

Giftlio will implement technical and organisational measures appropriate to the nature of the personal data processed and the risks associated with its operations.

Depending on the relevant systems and circumstances, such measures may include secure communications, restricted administrative access, access authentication, confidentiality obligations, protected hosting environments, security updates, activity monitoring, backup procedures, and controls over external service providers.

Access to personal information should be limited to authorised individuals who require it for legitimate business activities.

Where external providers process information on our behalf, we seek to establish suitable data protection and confidentiality requirements.

Security procedures are reviewed and adjusted where necessary to address changes in technology, operational practices, legal requirements, and identified threats.

Although reasonable efforts are made to safeguard information, no internet-based service or electronic storage method can be guaranteed to be completely free from risk.

In the event of a personal data breach, the Company will investigate the circumstances, take appropriate remedial measures, and make any notifications required under applicable legislation.

15. Rights of Individuals

Individuals whose personal information is processed by Giftlio may have rights under the UK GDPR or other applicable data protection legislation.

These rights are subject to relevant legal conditions, limitations, and exemptions.

Right of access

You may request information about whether we process your personal data and, where applicable, obtain a copy of that information together with the supplementary details required by law.

Right to rectification

If information held about you is incorrect or incomplete, you may request that it be corrected or completed.

Right to erasure

In certain circumstances, you may request the deletion of personal information. This right is not absolute, and information may continue to be retained where necessary to comply with legal obligations or for other lawful purposes.

Right to restrict processing

You may request restrictions on how personal information is processed in circumstances specified by applicable legislation.

Right to data portability

Where the relevant legal conditions are met, you may request to receive certain information in a structured, commonly used, machine-readable format or have it transmitted to another controller where technically feasible.

Right to object

You may object to certain processing activities carried out on the basis of legitimate interests. You also have the right to object to processing for direct marketing at any time.

Right to withdraw consent

Where processing relies on consent, you may withdraw that consent without affecting the lawfulness of previous processing.

Rights concerning automated decisions

Where applicable, you may have rights relating to decisions based solely on automated processing that produce legal or similarly significant effects.

To exercise any of these rights, please contact support@giftlio.com.

The Company may request reasonable additional information to verify the identity of the person making the request before disclosing, modifying, or deleting personal information.

Requests will be reviewed and answered within the periods required under applicable law, generally within one month, subject to permitted extensions and exceptions.

16. Automated Processing and Risk Assessments

Certain systems used in online retail and electronic payment processing may involve automated evaluations intended to identify potentially unauthorised or fraudulent activity.

These assessments may use relevant technical or transaction-related information to detect unusual behaviour and support payment security.

Automated risk indicators may result in additional authentication requirements, temporary transaction restrictions, or the referral of an order for further investigation.

Where Giftlio undertakes processing involving solely automated decisions that produce legal or similarly significant effects, it will comply with the applicable requirements governing such processing, including safeguards and individual rights where required.

Not every automated security assessment constitutes solely automated decision-making within the meaning of data protection legislation.

17. Marketing and Promotional Communications

Giftlio may offer customers the opportunity to subscribe to newsletters, product updates, special offers, promotional campaigns, and other commercial communications.

Where legally required, marketing messages will be sent only after the customer has provided valid consent.

In circumstances where electronic marketing is otherwise permitted by applicable legislation, the Company may rely on the relevant legal exception or permitted basis, subject to the applicable conditions and opt-out requirements.

Contact details and subscription preferences may be processed to manage communication lists, maintain records of permissions, and respect withdrawal requests.

Recipients may opt out of marketing communications by using the unsubscribe mechanism included in relevant messages or by contacting support@giftlio.com.

Opting out of promotional correspondence will not prevent the Company from sending necessary transactional or administrative messages, including purchase confirmations, digital product delivery notices, important security updates, and responses to customer support enquiries.

18. Privacy of Children

Giftlio’s commercial services are intended for persons who have the legal capacity to make purchases and enter into binding agreements under the laws applicable to them.

The Website is not specifically designed to collect personal information from children.

The Company does not knowingly seek to collect children’s personal information for independent marketing purposes or otherwise process such information without an appropriate lawful basis.

Where we become aware that personal data has been collected from a child in circumstances that do not comply with applicable law, we will investigate and take reasonable corrective action, including deletion where required.

Parents or legal guardians who believe a child has submitted personal information improperly may contact support@giftlio.com.

19. External Brands, Platforms, and Websites

Products sold through Giftlio may be associated with external entertainment services, gaming platforms, online retailers, software providers, and other independent brands.

References to such services are provided to identify available digital products and explain their relevant redemption conditions.

Customers may be directed to external platforms to activate, redeem, or use purchased products.

These platforms may collect and process information independently according to their own privacy policies, account terms, and security procedures.

Giftlio is not responsible for independently determined processing practices carried out by third-party organisations.

Customers should review the privacy information provided by relevant issuing brands, payment providers, and other external services before submitting personal information directly to them.

20. Complaints and Regulatory Rights

Giftlio aims to address privacy-related questions and concerns in a timely and appropriate manner.

If you believe that your personal information has been processed incorrectly, or if you are dissatisfied with the Company’s response to a privacy request, you may contact us to explain your concern.

We will review the circumstances and respond in accordance with applicable data protection obligations.

You may also have the right to submit a complaint to the Information Commissioner’s Office (“ICO”), the United Kingdom’s independent data protection supervisory authority.

The ICO can be contacted through its official website at https://ico.org.uk/.

Where another supervisory authority has jurisdiction under applicable data protection legislation, you may also be entitled to contact that authority.

The right to lodge a regulatory complaint does not prevent you from exercising other legal rights available under applicable law.

21. Changes to This Privacy Policy

Giftlio may revise this Privacy Policy periodically to reflect changes in its commercial activities, Website functionality, technology systems, regulatory requirements, or personal data processing practices.

An updated version will be published on the Website with an appropriate effective or revision date.

Where a change materially affects how personal information is processed, or where applicable law requires additional notification, the Company will take appropriate steps to inform affected individuals.

Any processing activity requiring new consent will be subject to the applicable consent requirements.

Customers are encouraged to review this Policy periodically to remain informed about the Company’s privacy practices.

22. Contact Information

Questions regarding this Privacy Policy, requests relating to personal information, and concerns about data protection may be submitted to the Company using the following contact details:

Lumeris Store Ltd

Company Number: 17410906

Registered Office: 2nd Floor College House, 17 King Edwards Road, Ruislip, London, United Kingdom, HA4 7AE

Website: https://giftlio.com/

Email: support@giftlio.com

Please include sufficient information to explain the nature of your enquiry so that we can identify the relevant records and provide an appropriate response.

Where necessary, we may request identity verification information before fulfilling a request involving the disclosure or alteration of personal data.

We will handle all enquiries and requests in accordance with applicable data protection legislation.

Last Updated: 13 October 2026