This Privacy & Cookie Policy explains how Experiencegift B.V. handles personal data relating to buyers, recipients and users of its gift cards. It applies to Experiencegift, Flightgift, Hotelgift, Traingift and Activitygift, including their websites in every language, emails and customer service.
1. Who We Are and How to Reach Us
Experiencegift B.V., Concertgebouwplein 7, 1071 LL Amsterdam, the Netherlands (Dutch Chamber of Commerce no. 59310685), is the controller for the processing described in this policy. For all questions and requests about your personal data, and for questions about an order or booking, you can reach us 24/7 through our contact page.
If you buy a gift card on this website through Experiencegift Ltd (United Kingdom) or Experiencegift Inc (United States), acting as authorized reseller, that company is the controller for your purchase and payment. It shares your order data with Experiencegift B.V., the issuer of the gift card, which is the controller for everything else described in this policy. Experiencegift gift cards can be used on all websites of the Experiencegift group; Experiencegift B.V. is the controller on each of them.
This policy does not apply to the provider you book with using your gift card: the hotel, airline, carrier or activity provider. After booking, that provider processes your data under its own privacy policy.
2. What Data We Use and Why
Depending on the purpose, we process your data on the basis of our contract with you, a legal obligation, our legitimate interest or your consent. We rely on a legitimate interest only where your interests or fundamental rights and freedoms do not override it.
- Selling, delivering and redeeming gift cards. Name, email address, phone number (optional), billing and delivery address, country, language and currency, payment method and status, order and gift card numbers, your personal message and the recipient's details (section 3). Legal basis: contract.
- Booking with your gift card. Your card code, the booker's contact details, the names of travelers or guests (and, where the provider requires it, date of birth or travel document details), the chosen trip or activity, dates, special requests and any additional payment. Legal basis: contract; we act as an intermediary between you and the provider.
- Customer service. Your contact details, your message, order or booking references and our correspondence by email, chat or social media. Legal basis: contract and our legitimate interest in providing effective customer support.
- Security and fraud prevention. IP address, device and browser data, technical logs, risk signals from our payment providers and ordering patterns. An order that looks fraudulent may be paused or refused automatically; on request, a member of staff will review it. We make no other automated decisions with significant effects on you. Legal basis: our legitimate interest in protecting you and us against fraud and abuse.
- Service emails. Order and delivery confirmations, reminders, balance updates and changes to your booking. Legal basis: contract.
- Marketing emails. Email address, name, country, language, your purchases, and information about whether you open our emails or click links in them. Legal basis: consent when you sign up; for existing customers, our legitimate interest in telling you about similar products. Every email contains an unsubscribe link.
- Review invitation. After an order we share your name, email address and order reference with Trustpilot for a single invitation. Legal basis: our legitimate interest in learning how you experienced our service.
- Website statistics and advertising. Our use of cookies and your choices are explained in section 5. Where consent is required, we process this data on the basis of your consent.
- Business customers. Name and business contact details of the contact person, company details, invoices and order history. Legal basis: contract and our legitimate interest in managing the business relationship.
- Legal obligations and disputes. Order, invoice and payment data and correspondence about a claim. Legal basis: legal obligation (tax and accounting law) and our legitimate interest in handling claims.
3. If Someone Gives You a Gift Card
The buyer gives us your name, your email or postal address and a personal message so that we can deliver the gift. We use this data only to deliver the gift, help you redeem it and answer your questions. You will not receive marketing from us unless you sign up yourself. You have the same rights as the buyer (section 9). If you do not wish to receive the gift, we will delete your data on request.
4. Who We Share Your Data with
We share your data only where necessary for the purposes in section 2, and only with:
- the provider of your trip or activity and the booking platform we work with, to whom we provide the data needed for your booking;
- payment providers, to process your payment and check for fraud;
- service providers working on our behalf: delivery services, our email platform, the review platform, the tool that stores your cookie choice, hosting and security partners, the suppliers of our customer service, order and accounting systems, and AI tools that support our team with customer service and fraud checks. They process your data only on our instructions;
- analytics and advertising partners, in accordance with the cookie choices and consent requirements described in section 5;
- our accountants, lawyers and insurers where necessary, and government or law enforcement authorities where the law requires it;
- a buyer or successor if our company or one of our brands is sold or merges with another business. Your data will continue to receive the same protection.
We never sell your personal data.
5. Cookies
Cookies and similar technologies (local storage, pixels) are small files or codes on your device. We use three categories:
- Functional (always active). These cookies keep the website working by supporting the shopping cart, language and currency settings, secure checkout, protection against bots and fraud, and storage of your cookie choice. No consent is required.
- Statistics. These cookies show us how the website is used and where visitors get stuck: pages viewed, clicks, device, browser, approximate location and recordings of how you navigate the site, with your form input masked. We use Google Analytics and tools for session recording and error reporting, among others. The data is pseudonymized: it is linked to a browser identifier rather than your name. This does not make it anonymous.
- Marketing. We use cookies from our advertising partners to show you relevant ads on other websites and in apps, measure whether our ads work, limit how often you see the same ad and build audiences with similar interests (profiling for advertising). Partners receive your cookie or device ID, the pages and products you view, the ads you click and your purchases. After a purchase we also share a hashed version of your email address and phone number so the partner can link the purchase to an ad. Some of this data is sent through our own measurement server on a subdomain of this website; your choice applies there too. The partners also use this data for their own purposes under their own privacy policies. Our email platform uses a marketing cookie to recognize you when you arrive through one of our emails, so that we can personalize emails and forms.
Your choice. If you visit us from the European Economic Area, the United Kingdom or Switzerland, we show a cookie banner on your first visit before any optional cookies are loaded. You can accept all, reject optional cookies or set your preferences per category. Until you make a choice, we use functional cookies only. If you reject statistics or marketing cookies, Google and Microsoft set no cookies but receive cookieless signals (for example that a page was viewed) to estimate aggregate figures.
We store your choice on your device for 30 days, after which we ask again. We also keep a record of your choice (consent ID, choice, date, country and page) for 12 months as proof that we asked for consent.
Outside the European Economic Area, the United Kingdom and Switzerland, statistics and marketing cookies are on by default; you can switch them off at any time.
Changing your preferences or withdrawing consent. You can change your cookie preferences or withdraw your consent at any time using the cookie settings on our website. You can also block and delete cookies in your browser. Withdrawing consent does not affect the lawfulness of processing carried out with your consent before withdrawal. If you block functional cookies, the shopping cart and checkout will not work.
Emails. Our emails contain a tracking pixel and trackable links that help us measure email opens and link clicks. Blocking external images in your email client can limit tracking of email opens, but does not prevent tracking when you click a link. You can unsubscribe from marketing emails using the unsubscribe link.
6. Data Outside the European Economic Area
Most of our data processing takes place in the EU. For partners in the United Kingdom, we rely on the European Commission’s adequacy decision.
For US partners, we rely on the EU-US Data Privacy Framework where they are certified under it, including Google, Meta and Microsoft. If a US partner is not certified, or a partner is in another country outside the EEA, we rely on the European Commission’s standard contractual clauses with additional safeguards. You can request a copy of these safeguards through our contact page.
7. How Long We Keep Your Data
- Orders, invoices, payments and bookings: at least 7 years after the end of the financial year, as tax and accounting law requires, and longer where needed for claims, disputes or fraud prevention.
- Gift card data: for as long as the card has a balance, and afterward for as long as we need it for claims, disputes and our accounting.
- Customer service correspondence: for as long as needed to handle your request and any follow-up, claim or dispute.
- Marketing profile: until you unsubscribe or have not interacted with our messages for a considerable period.
- Fraud prevention data: for as long as needed to protect our websites, customers and partners against fraud.
- Technical logs and session recordings: for a limited period, as needed for security, diagnostics and debugging.
We delete or anonymize data once it is no longer needed for these purposes.
8. Security
All traffic to and from our websites is encrypted. Payments are handled by PCI DSS-certified providers; your full payment card number never reaches our systems. Access to customer data is limited to staff who need it for their work, and our systems are monitored for unusual activity. If a data breach affects you, we will inform you as required by law.
9. Your Rights
You have the right to access your personal data and receive a copy, request its correction or deletion, restrict its processing and request its portability. You may object to processing based on our legitimate interest, and you may always object to direct marketing. You can also ask a member of staff to review an automated decision. You may withdraw consent at any time; this does not affect the lawfulness of processing based on that consent before it was withdrawn.
Submit your request through our contact page. We may ask you to confirm your identity and will respond within one month; for complex requests this may be extended by two months, in which case we will let you know. You can also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the supervisory authority in your own country.
10. Your Privacy Choices
You can opt out of targeted advertising using the cookie settings on our website. We do not sell your personal data. Exercising your privacy rights does not affect the service we provide.
11. Changes to This Policy
We update this policy when our services, partners or the law change. If a change materially affects how we use your data, we will inform you in advance through the website or by email.