Privacy Notice

1. Welcome

This Privacy Notice explains how Shagun Direct collects, uses, stores, shares and protects personal information when you use our website, event pages and related services (the "Platform"). It should be read together with our Terms & Conditions.

2. About Shagun Direct

Shagun Direct is a digital gifting platform. Couples create event pages, and Guests use them to send monetary gifts, greeting messages and optional wishing cards or video greetings.

Payments are processed by our payment partner, Stripe. Each Couple has their own Stripe account, in which Stripe holds the Couple's gifts until they are paid out to the Couple's bank account. Shagun Direct is a technology platform only. We do not hold or receive gift funds, operate bank accounts or provide financial services.

3. Who We Are

Shagun Direct Limited is the data controller for the personal information described in this notice, except where we say that Stripe acts as a separate controller (see section 10).

• Company number: 16753269
• Registered office: 167-169 Great Portland Street, London, England W1W 5PF
• Email: info@shagundirect.com

4. Who This Notice Applies To

• Couples: people who create an account and event page to receive gifts.
• Guests: people who open a Couple's event link or QR code and send a gift, without creating an account.
• Website visitors: people who browse our website or contact us.

Our authorised staff ("Admins") manage and support the Platform. Their access is described in section 12.

5. Information We Collect

5.1 Couples

• Account details: full name, partner's name, event date, email address, mobile number, password (stored in protected form) and email verification codes.
• Profile photograph, if uploaded.
• Stripe account information that Stripe shares with us: Stripe account ID, verification and onboarding status, whether payouts are enabled, and payout status.
• Records of gifts received, payouts, support conversations and account activity.

We do not collect or store Couples' identity documents, dates of birth or full bank account details. These are given directly to Stripe during onboarding (see section 10).

5.2 Guests

• Full name, email address and mobile number, entered on the guest details screen.
• Gift amount and greeting message.
• Wishing card selection, or an uploaded video greeting (optional).
• Payment confirmation and transaction details from Stripe, such as the payment ID, status, amounts and fees.

We never receive or store Guests' card details. Card numbers, expiry dates and CVC codes are entered directly into Stripe's secure card form and go only to Stripe.

5.3 Website visitors who contact us

If you use the contact form on our website, we collect your name, email address, the topic you choose and your message. We use these only to reply to you.

5.4 Automatically collected information

IP address, browser type, device type, operating system, date and time of access, security logs and error logs.

We do not use advertising cookies, behavioural tracking or website analytics.

6. How We Collect Information

• Directly from you: when you register, complete your profile, upload a photo, enter your details as a Guest, send a gift, upload a video, write a message or contact us.
• Through your use of the Platform: transaction records, download history, account activity, security logs and fraud-prevention records.
• From Stripe: onboarding and verification status for Couples, and payment, payout, refund and dispute status for transactions.

7. Why We Use Your Information and Our Lawful Bases

• Performance of a contract: creating and managing accounts and event pages; processing gifts, fees, wishing cards and video greetings through Stripe; showing Guests' names, messages and gifts to the Couple; sending receipts and confirmations; handling refund requests; and providing support.
• Legal obligation: keeping financial and tax records, and responding to lawful requests from authorities.
• Legitimate interests: preventing fraud and misuse, keeping the Platform secure, investigating suspicious activity, handling disputes, improving reliability and replying to messages sent through our contact form. We balance these interests against your rights.
• Consent: any future marketing. You would be able to withdraw consent at any time.

Guests' mobile numbers are used to help prevent fraud (they are shared with Stripe for this purpose) and to contact the Guest about their gift or a refund. They are not used for marketing.

We will never sell your personal information.

8. What the Couple Can See About Guests

The Couple can see each Guest's name, greeting message, gift amount, date and time, and any wishing card or video greeting. Couples can download this as a transaction history and receipts.

The Couple cannot see a Guest's email address or mobile number.

9. Wishing Cards and Video Greetings

Video greetings are shared only with the Couple. They are stored securely for up to 60 days and then automatically deleted, unless the law requires us to keep them longer. Couples should download any videos they wish to keep within that period.

10. Payments and Stripe

Payments are processed by Stripe. Guests enter their card details directly into Stripe's secure card form on our payment screen.

When a Couple connects a Stripe account, Stripe collects identity and bank information, such as legal name, date of birth, address, identity documents and bank account details, directly from the Couple. Stripe uses this information to verify identity, meet its legal obligations (including anti-money-laundering rules) and make payouts.

For this processing, Stripe acts as an independent data controller, and its use of your information is governed by the Stripe Privacy Policy. Couples' use of Stripe is also governed by the Stripe Services Agreement and the Stripe Connected Account Agreement.

We share with Stripe the information needed to process each payment and to help prevent fraud: the amounts and fees, the Guest's name, email address and mobile number, and the Couple's Stripe account ID. Stripe also uses its own fraud-prevention tools when processing payments.

11. Who We Share Information With

We share information only where necessary to run the Platform or where required by law:

• Stripe: payment processing, fraud prevention, Couple onboarding and verification, payouts, refunds and disputes.
• IONOS: website and data hosting in Europe.
• Email service providers: sending verification codes, receipts and service messages on our behalf.
• Web3Forms: delivering messages sent through our website's contact form to our inbox.
• The Couple: Guest information as described in section 8.
• Professional advisers: accountants, auditors and legal advisers.
• Regulators, law enforcement and public authorities: where required by law or a court order.

Our service providers act on our instructions and must keep your information secure.

12. Admin Access

Only authorised Shagun Direct staff can use admin tools. Admins can view account, event and transaction information, including Guests' contact details, where needed for support, refunds, security, fraud prevention and legal compliance.

Admins cannot see card details or Couples' identity documents or full bank details. They cannot withdraw or redirect funds held in Stripe accounts. They can only trigger payouts to the Couple's own bank account and process refunds under our Terms & Conditions.

13. International Transfers

Couples must be based in the United Kingdom, and Guests may send Gifts from anywhere in the world. Our main hosting is in Europe. Stripe and some service providers may process information outside the UK, including in the United States. Where this happens, we make sure appropriate safeguards are in place as required by UK data protection law, such as UK adequacy regulations, the UK International Data Transfer Agreement or Addendum, or the UK Extension to the EU-US Data Privacy Framework.

14. Keeping Your Information Secure

We use technical and organisational measures including HTTPS encryption, protected storage where appropriate, secure authentication, restricted admin access, Stripe's secure card form and monitoring for suspicious activity. No online platform can guarantee complete security, so please keep your password and devices secure.

15. Account Deactivation and Deletion

• A Couple account is automatically deactivated 60 days after it was created. If a payout is made in the 7 days before deactivation is due, the account stays active until 7 days after that payout.
• We notify the Couple before deactivation. The Couple can email us to extend the account by 7 days.
• When an account is deactivated, the event link stops working and the Couple can no longer log in. The data is kept so that the Couple can ask us to reactivate the account.
• 12 months after deactivation, the account and its data are permanently deleted, except transaction records, which we must keep for 6 years.
• A Couple can ask us to delete their account earlier (see section 17).

Deactivating or deleting a Shagun Direct account does not close the Couple's Stripe account or delete the information Stripe holds.

16. How Long We Keep Information

Stripe keeps the information it collects in line with the Stripe Privacy Policy.

17. Your Rights Under UK GDPR

You have the right to:

• access a copy of your personal information;
• correct inaccurate or incomplete information;
• delete your information, where applicable. This right is not absolute: we must keep transaction records for 6 years and may need to keep fraud-prevention records;
• restrict how we use your information in certain situations;
• object to processing based on our legitimate interests;
• data portability: receive your information in a common electronic format. Couples can already download transaction history and receipts from the dashboard; and
• withdraw consent at any time, where we rely on consent.

To exercise your rights, email info@shagundirect.com. Couples can also use the dashboard support feature. We will respond within one month. For information held by Stripe, please contact Stripe directly.

18. Account Suspension and Removal

We may suspend, restrict or remove accounts where there is reasonable evidence of fraud, suspicious payment behaviour, platform abuse, false information, illegal activity or a breach of our Terms & Conditions.

19. Communications

We send service messages such as verification codes, password resets, payment confirmations, receipts, deactivation notices, security alerts and support replies. These cannot be switched off while an account is active. We do not send marketing emails or texts. If we do in future, we will only do so with your consent and will always include a way to unsubscribe.

20. Children

The Platform is only for people aged 18 and over. We do not knowingly collect information from anyone under 18. If we find that we have, we will delete it as soon as practicable. Parents or guardians who have concerns should contact us.

21. Cookies

We use only essential cookies, which are needed to keep sessions secure, authenticate signed-in users, protect against fraud and remember basic preferences. These cannot be disabled through the website. Stripe's card form may set its own cookies for fraud prevention, as described in the Stripe Privacy Policy. We do not use advertising, marketing, social media or analytics cookies. If this changes, we will ask for your consent first.

22. Links to Other Websites

The Platform contains links to other websites, including Stripe and our pages on Instagram, TikTok, Facebook and LinkedIn. These are plain links: no social media content or tracking is loaded on our website. We are not responsible for the privacy practices of other websites, so please read their privacy notices.

23. Changes to This Notice

We may update this notice to reflect changes to our services or legal requirements. The "Last updated" date shows the latest version. We will notify you of significant changes by email or through the Platform.

24. Contact Us

Shagun Direct Limited, 167-169 Great Portland Street, London, England W1W 5PF

Email: info@shagundirect.com

25. Complaints

Please contact us first so we can try to help. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator, at ico.org.uk.