Privacy notice

Last updated 5 November 2026

1. Who we are

Boifren is a trading name of [YOUR FULL NAME], a sole trader registered in the United Kingdom at [YOUR TRADING ADDRESS]. For anything to do with your data, write to [email protected].

We are the data controller for everything described here, under the UK General Data Protection Regulation and the Data Protection Act 2018.

2. If you join the waiting list

We collect:

• Your email address.
• Whether you ticked interest in a personalised video.
• The date and time you gave consent, and which form you used.
• The country your request came from, as reported by our hosting provider.

We use it to tell you when the edition opens and to send you the reveal. Our lawful basis is your consent, given by ticking the box. You can withdraw it at any time and we stop immediately — every email carries a one-click unsubscribe link.

There are no advertising or analytics cookies on this site, and we don’t track you across other sites.

3. If you place an order

We collect, in addition to the above:

• Your name, delivery address and email address.
• What you ordered, and the reference number.
• A record that payment succeeded. We never see or store your card details — those go directly to Stripe.

Our lawful basis is performance of our contract with you. We also keep order and payment records for six years because tax law requires it, which is a legal obligation.

4. Information about the person you’re sending to

This is the unusual part, so we want to be plain about it. To deliver a gift on your behalf we need information about someone who hasn’t visited this site and hasn’t dealt with us directly. Specifically:

• Her first name and her email address, so we can send her your card.
• The message you wrote for her.
• What you tell us about her tastes — what she likes, what she already has, and anything to avoid.

Our lawful basis is our legitimate interests in fulfilling the order you placed. We’ve weighed that against her interests and kept the processing as narrow as we can: we use it only to put your order together and deliver it.

What we never do with it

• We never add her to a mailing list.
• We never market to her.
• We never sell or share it, beyond the delivery and email providers listed in section 5.
• We send her exactly one email — your card — and nothing else.

Please don’t send us medical information

When you tell us what to avoid, keep it to preferences: “nothing with nuts”, “no strong scents”. Please don’t describe allergies, conditions or any other health detail. Health information is a special category under data protection law and needs a stronger legal basis than a gift order can provide, so we would rather not hold it at all. A plain “no nuts” tells us everything we need in order to pack her box safely.

If something does reach us that looks like health information, we remove it from our records once your order has shipped and keep only the practical instruction.

What each box contains is listed in full on the product page, so you can always check it yourself before ordering.

How long we keep it, and what she can do

What you told us about her is deleted 60 days after your order ships. We keep her first name and the fact a card was sent for as long as we must keep the order record itself, because that is part of the transaction.

She has the same rights over her data as you have over yours (section 6). If she contacts us we will tell her what we hold, correct it, or delete it. We will not reveal that you placed an order unless she already knows or asks us directly, and we will never pretend we hold nothing when we do.

5. Who we share data with

Only the services that make this work:

• Cloudflare — DNS, proxy and edge TLS for this site.
• Hostinger — the server that stores the database.
• Stripe — payment processing.
• [YOUR EMAIL PLATFORM, e.g. MailerLite] — sends the emails you signed up for, and the card.
• [YOUR COURIER, e.g. Royal Mail] — receives the delivery address in order to deliver.

Some operate outside the UK. Where that happens, transfers are covered by the provider’s standard contractual clauses or an equivalent safeguard. We never sell your data and never pass it to advertisers.

6. Your rights

You can ask us to:

• Give you a copy of the data we hold about you.
• Correct it if it’s wrong.
• Delete it, where we’re not required to keep it.
• Stop using it, or restrict how we use it.
• Object to processing we do on the basis of legitimate interests.
• Withdraw consent you gave us.
• Receive it in a portable format.

Write to [email protected] and we’ll respond within one month. There’s no charge.

If you’re unhappy with how we’ve handled your data you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

7. How long we keep things

Waiting list email	until you unsubscribe, or 24 months after the last edition we emailed you about
What you told us about her	60 days after your order ships
Order and payment records	6 years, as tax law requires
Server access logs	30 days

8. Changes

If we change how we use your data we’ll update this page, and email you where the change is significant.