Privacy Policy

1. Who We Are

Kudos Cards Ltd provides a platform that enables businesses and organisations to manage contacts and events and create, personalise, schedule and send physical greeting cards.

Kudos Cards Ltd, United Kingdom. Registered office: Darlington DL1 1GB. Company number: 16349929. Privacy email: info@kudoscards.co.uk.

2. Our Data Protection Roles

Our role under data protection law depends upon why particular personal information is being processed.

When Kudos Cards is the controller

Kudos Cards will generally act as the data controller for information relating directly to our customers and users where we decide why and how that information is processed.

This includes information used for purposes such as:

• creating and administering accounts;
• managing subscriptions;
• taking payments;
• providing customer support;
• maintaining security;
• complying with our legal obligations; and
• communicating with our customers about the Kudos Cards service.

When Kudos Cards is the processor

Our customers may upload personal information about other people, such as their:

• customers;
• students;
• parents;
• employees;
• members;
• supporters; or
• other contacts.

The customer decides which individuals to add to Kudos Cards and why cards are being sent to them.

In these circumstances, the customer will generally be the data controller and Kudos Cards will act as a data processor, processing the information on the customer's instructions to provide the Kudos Cards service.

Questions from a recipient about why an organisation has uploaded their information should therefore normally be directed to that organisation.

3. Information We May Process

Account information

When you create or operate a Kudos Cards account, we may process information including:

• first name;
• last name;
• email address;
• telephone number;
• organisation details;
• billing information;
• shipping information;
• account credentials; and
• subscription information.

Recipient and contact information

Customers can add information about contacts individually or through bulk imports.

Depending upon the information supplied by the customer, this may include:

• first name;
• last name;
• date of birth;
• postal address;
• city;
• postcode;
• email address;
• contact status;
• associated events;
• card order information;
• dispatch dates; and
• previous card activity.

Order information

We may process:

• cards ordered;
• card designs;
• personalised messages;
• recipient information;
• quantities;
• delivery information;
• order status;
• dispatch information; and
• transaction information.

Support information

If you contact us for support, we may process your name, contact details and the contents of your request together with information needed to investigate the issue.

Technical information

When you use our website or platform, we may collect technical information such as:

• IP address;
• browser type;
• device information;
• login and activity information;
• security information; and
• cookies or similar technologies.

Further information about cookies may be provided through our Cookie Policy or cookie controls.

4. How We Receive Information

We may receive information:

• directly from you;
• from the organisation that created your account;
• from customers using the Kudos Cards platform;
• through contact imports;
• when orders are created;
• when you contact support;
• automatically when you use our website or platform; and
• from service providers involved in providing our services.

5. How We Use Personal Information

Where we act as controller, we may use personal information to:

• create and administer accounts;
• authenticate users;
• provide the Kudos Cards service;
• manage subscriptions;
• process payments;
• fulfil orders;
• communicate about accounts and orders;
• provide customer support;
• protect the security of the platform;
• detect misuse or fraud;
• improve and maintain our services;
• maintain appropriate business and financial records; and
• comply with legal and regulatory requirements.

6. Processing Recipient Information

A central part of Kudos Cards is allowing organisations to manage important dates and send personalised physical cards.

When a customer uploads recipient information, we may process it to:

• store and manage contacts;
• create birthday events from dates of birth;
• create other customer-defined events;
• calculate or manage dispatch dates;
• personalise cards;
• generate multiple personalised cards;
• address cards;
• create orders;
• arrange printing;
• arrange postage and delivery;
• maintain dispatch and order records; and
• provide the customer with relevant platform functionality.

We process this information to provide services to the customer and in accordance with the customer's instructions.

Kudos Cards does not obtain ownership of a customer's contact database.

7. Lawful Bases

Where Kudos Cards acts as controller, the lawful basis we rely upon will depend upon the processing concerned.

These may include:

Contract

Processing necessary to provide services requested by our customers, administer accounts, subscriptions and orders.

Legitimate interests

We may process information where necessary for legitimate business interests, including:

• maintaining and improving the service;
• securing our systems;
• preventing fraud and misuse;
• managing customer relationships; and
• operating our business effectively,

provided those interests are not overridden by the rights and interests of affected individuals.

Legal obligation

We may process information where necessary to comply with legal obligations, including accounting, taxation and regulatory requirements.

Consent

Where consent is required, we will request it appropriately and you may withdraw that consent.

Where we act purely as a processor for customer-uploaded recipient information, the customer is responsible for determining the appropriate lawful basis for that processing.

8. Dates of Birth

The Kudos Cards platform allows customers to record dates of birth so that birthday events and associated card activity can be managed.

A customer's decision to collect and upload an individual's date of birth is made by that customer.

Customers should only upload information that is necessary and lawful for their intended use of Kudos Cards.

9. Children's Information

Kudos Cards is a business service and is not intended to be used directly by children.

However, organisations using Kudos Cards may upload information relating to children or young people, for example where an educational organisation sends birthday or achievement cards to its students.

Where a customer uploads this information, the customer is responsible for ensuring that it has an appropriate lawful basis and has met its transparency and other data-protection obligations.

Kudos Cards processes such information on the customer's instructions for the purpose of providing the requested service.

Customers should avoid uploading unnecessary information about children.

10. Sharing Personal Information

We may share information with trusted service providers where necessary to operate Kudos Cards.

Depending upon the service being provided, these may include providers of:

• cloud hosting and database infrastructure;
• authentication and platform infrastructure;
• payment processing;
• printing and fulfilment;
• postal and delivery services;
• email and communications;
• customer support;
• analytics and monitoring; and
• professional services.

We only provide information reasonably necessary for the relevant service.

We may also disclose information where required by law, regulation, court order or another lawful authority.

11. Printing and Postal Fulfilment

Recipient names, addresses, card content and other necessary order information may be provided to printing, fulfilment or postal providers where required to produce and deliver cards.

Only information required to fulfil the relevant order should be provided.

12. Payment Information

Payments may be handled by third-party payment providers.

Payment providers may process payment-card and transaction information under their own privacy arrangements.

Kudos Cards does not need to store complete card details where payment information is handled directly by the payment provider.

13. Sub-Processors

Where Kudos Cards acts as a processor, we may use third-party providers to help deliver the service.

These providers may act as sub-processors.

We will take appropriate steps to ensure that sub-processors handling personal information are subject to appropriate contractual and data-protection requirements.

Where required, further information about our sub-processors can be made available to business customers.

14. International Transfers

Some technology providers may process or store information outside the United Kingdom.

Where personal information is transferred internationally, we will take appropriate measures required by applicable data-protection law to protect that information.

These may include recognised adequacy arrangements or appropriate contractual safeguards.

15. How Long We Keep Information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected and to satisfy applicable legal, accounting, contractual and regulatory requirements.

Retention periods vary according to the type of information and why it is being processed.

Customer-uploaded contact information will generally be retained while required to provide the customer's service and dealt with in accordance with our contractual obligations when the service ends.

Certain records, including transaction and accounting records, may need to be retained for longer periods where required by law.

Temporary files generated by some platform functions may be automatically deleted after a defined period.

16. Security

We take appropriate technical and organisational measures designed to protect personal information against:

• unauthorised access;
• accidental loss;
• destruction;
• alteration;
• disclosure; and
• misuse.

Measures may include appropriate access controls, authentication, encryption, monitoring, backups and restrictions on access to personal information.

No internet-based system can guarantee absolute security, but we continually seek to maintain security appropriate to the nature of the information being processed.

17. Personal Data Breaches

We maintain procedures for responding to suspected personal-data breaches.

Where Kudos Cards acts as a processor and becomes aware of a personal-data breach affecting customer-controlled information, we will notify the relevant customer without undue delay in accordance with our legal and contractual obligations.

18. Your Data Protection Rights

Depending upon the circumstances, individuals may have rights including:

• access to their personal information;
• correction of inaccurate information;
• deletion of information;
• restriction of processing;
• objection to certain processing; and
• data portability.

These rights are subject to applicable legal conditions and exemptions.

If you are a Kudos Cards customer or user

You can contact us using the details below.

If your information was uploaded by one of our customers

The organisation that uploaded your information will generally be the controller.

You should normally contact that organisation first regarding your data-protection rights.

We will provide reasonable assistance to our customer where necessary for it to respond to your request.

19. Deleting or Updating Contact Information

Customers can manage information held within their Kudos Cards accounts, including updating or deleting contacts where platform functionality permits.

Deleting a contact may also remove or affect associated birthday and event information.

Some information may remain in backups or records for a limited period where technically or legally necessary.

20. Marketing Communications

Where permitted by law, we may contact our customers and prospective customers about Kudos Cards services.

You can unsubscribe from marketing communications using the unsubscribe mechanism provided or by contacting us.

Service messages concerning your account, orders, security or subscription are not marketing communications and may still be sent where necessary.

21. Cookies

Our website and platform may use cookies and similar technologies for purposes such as:

• maintaining sessions;
• authentication;
• security;
• remembering preferences;
• measuring platform performance; and
• understanding website usage.

The first five of those are strictly necessary: without them you could not log in or stay logged in, and we do not ask for consent to set them.

To understand website usage we use Google Analytics, which is not strictly necessary. It is switched off until you agree. On your first visit we ask, and nothing is stored for analytics unless you choose Accept — choosing Reject is one click, exactly as Accept is. Your choice is remembered in your browser, and you can change it by clearing your browser storage for this site, which makes us ask again.

Google Analytics sets cookies in your browser and processes usage data on our behalf, including a truncated record of your IP address. It tells us things like which pages are visited and which cards are viewed. It does not tell us who you are, and we do not use it to advertise to you.

22. Third-Party Websites

Our website or platform may contain links to third-party websites.

We are not responsible for the privacy practices of websites operated independently from Kudos Cards.

You should review the privacy information provided by those organisations.

23. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our services, technology, business practices or legal requirements.

The latest version will be published on our website or platform.

Where appropriate, we may notify users of significant changes.

24. Contact Us

Questions about privacy or the way we handle personal information can be sent to:

Kudos Cards Ltd. Email: info@kudoscards.co.uk. Registered office: Darlington DL1 1GB. Company number: 16349929.

25. Complaints

If you have concerns about how Kudos Cards has handled personal information, please contact us first so that we can investigate.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data-protection regulator.

Further information is available from the ICO at ico.org.uk.