Privacy Policy

Version: 1.0
Effective date: 9 September 2026

1. Who we are

This Privacy Policy explains how My Best Birthday Limited (“we”, “us”, “our”) collects and uses personal data when you use our website and related features.

Company details:

• Legal name: My Best Birthday Limited
• Company number: 17309994
• Registered office: 128, City Road, London, EC1V 2NX
• Email: contact@mybestbirthday.co.uk

We are the data controller for personal data processed in connection with our website and services.

2. What this policy covers

This policy covers personal data we process when you:

• browse the website and directory;
• create or use an account (parent, business, or both);
• use parent planning tools (Saved Favourites, Gift Lists, Birthday Reminders);
• create, manage, or claim a business listing;
• subscribe to a paid business advertising package;
• contact us;
• interact with our emails; and
• click affiliate links.

3. Key principles (plain English)

• We are a directory and advertising platform. We do not provide party services and we do not manage bookings between families and businesses.
• Parents and businesses interact directly.
• We aim to collect only what we need and keep it only as long as necessary.

4. Personal data we collect

Depending on how you use the platform, we may collect the following categories of personal data.

4.1 Account and profile data

• Email address
• Password (stored securely/hashed)
• Account role (parent/business/both)
• Account settings and preferences
• Marketing preference/consent status
• Legal acceptance records (see section 4.4)

4.2 Parent planning tools data

If you use our parent planning tools, we process:

• Saved Favourites: the relationship between your account and the listings you save.
• Gift Lists: list information, items added, external retailer/product links where supplied, claim status, and information necessary to operate claims.
• Birthday Reminders: child’s name, birthday/date information, reminder preferences/scheduling information, and information necessary to operate and prevent duplicate reminders.

4.3 Business listing and business account data

If you are a business user, or you create/claim/manage a listing, we may process:

• Listing content you submit (e.g., business name, description, categories)
• Business contact details (which may include personal data, particularly for sole traders)
• Listing claim information
• Communications and support messages

4.4 Legal acceptance records (Terms and Privacy)

When you register, we record information to evidence:

• the Terms of Use version accepted;
• the Privacy Policy version presented;
• acceptance timestamp; and
• acceptance history/log.

4.5 Subscription, billing and transaction data (business users)

If you purchase a paid business advertising package, we process and store payment-related administrative information including:

• customer name and contact information
• billing address/details
• invoices/receipts
• purchased package/item
• amount, currency and payment status
• subscription status and relevant dates
• transaction history/references
• Stripe identifiers needed to associate our records with Stripe (for example transaction, customer, subscription or similar identifiers)

Payments are processed securely by Stripe. We do not store full payment card numbers or card security codes on our systems.

4.6 Communications

• Messages you send us (e.g., contact forms/emails)
• Support requests and related correspondence

4.7 Technical and usage data

• IP address
• device/browser information
• pages viewed and interactions
• cookie identifiers and consent signals (where applicable)

4.8 Location data

• location you type in (postcode/town) and radius; and
• optional device/browser location if you choose to use “My Location” and grant permission.

5. Children’s data

Our platform is intended for adults. We do not offer accounts to children.

A parent, guardian or other authorised adult may voluntarily provide limited information about a child (principally a child’s name and birthday) to use parent planning functionality such as Birthday Reminders.

Businesses cannot access this information. We do not use it to market to children, build advertising profiles of children, or allow children to interact with the platform.

6. Where we get personal data from

We collect personal data:

• directly from you when you register, use features, submit content, subscribe, or contact us;
• from your device/browser when you browse our website (subject to your cookie choices); and
• from public sources where we create directory listings from publicly available business information (for example where a listing is created and later claimed by a business).

7. How we use your data (purposes and lawful bases)

We use personal data for the purposes below. The lawful basis depends on the context.

7.1 Provide the website and directory

• Purpose: operate the website, directory search, and core functionality.
• Lawful basis: legitimate interests.

7.2 Create and manage accounts

• Purpose: registration, login, account administration, security.
• Lawful basis: contract.

7.3 Provide parent planning tools

• Purpose: Saved Favourites, Gift Lists, Birthday Reminders.
• Lawful basis (adult user data): contract.

7.4 Child data used within parent planning tools

• Purpose: provide the birthday-planning/reminder functionality specifically requested by the adult user.
• Lawful basis (child data such as name and birthday): legitimate interests.

Our legitimate interest is enabling the adult user to use the birthday planning and reminder functionality they have requested. Processing is limited to what is necessary for that purpose and subject to safeguards described in this policy.

7.5 Send service emails

• Purpose: transactional/service communications, including Birthday Reminder emails.
• Lawful basis: contract.

7.6 Manage business listings, claims, and subscriptions

• Purpose: listing administration, claim workflows, paid advertising packages, billing and subscription management.
• Lawful basis: contract.

7.7 Respond to enquiries and provide support

• Purpose: handle contact requests and support.
• Lawful basis: legitimate interests.

7.8 Marketing communications (opt-in only)

• Purpose: send marketing communications where you have opted in.
• Lawful basis: consent.

7.9 Measure and improve the platform (analytics)

• Purpose: understand usage and improve the website.
• Lawful basis: consent for non-essential analytics/cookies.

8. Marketing consent and preference controls

• Marketing consent is separate from acceptance of the Terms and acknowledgement of this Privacy Policy.
• Marketing consent is optional and unticked by default at registration.
• You can change your marketing preference later through your account/email preferences.
• Marketing opt-in is synchronised with FluentCRM.
• Unsubscribe choices are respected.
• Marketing communications are only sent to users who have provided the appropriate marketing consent.

9. Cookies, consent, and analytics

We use cookies and similar technologies.

• CookieYes is used for cookie consent.
• Google Consent Mode is enabled.

9.1 Google Analytics 4 (GA4)

We use Google Analytics 4 (GA4) to understand how the website is used.

Analytics is consent-based:

• before a visitor makes a consent choice: analytics is denied and no Google Analytics cookies are set;
• after Accept: analytics is granted and GA4 tracking operates; and
• after Reject: analytics remains denied and no Google Analytics cookies are set.

9.2 GA4 retention

GA4 data retention is set to 14 months.

10. Maps and location services

• Visitor-facing maps use Leaflet with OpenStreetMap tiles.
• Google is used for geocoding during listing creation/import.
• If you choose “My Location”, your device/browser may share approximate location information with us to help show nearby results. Precision varies by device/browser/OS/settings.

11. Affiliate links and affiliate tracking

Some links may be affiliate links (including within Gift Lists). If you click an affiliate link and/or make a purchase, we may earn a commission at no extra cost to you.

We use Awin MasterTag functionality and custom tracking for relevant affiliate outbound interactions. Affiliate-related cookies/technologies are managed in line with your cookie consent choices.

12. CRM and email delivery

• FluentCRM is used within the WordPress environment for CRM/contact and marketing preference functionality.
• Brevo is used for email delivery, including transactional/service emails.

13. Payments (business subscriptions)

We use GetPaid within WordPress and Stripe for payment processing and recurring subscriptions.

• Stripe processes payments and handles sensitive payment card information.
• We retain customer, billing, invoice, subscription and transaction-reference information in WordPress/GetPaid for account administration, payment management, accounting and legal purposes.

14. Who we share data with (service providers and other recipients)

We may share personal data with service providers who help us run the platform. Depending on your use of the site, this may include:

• Hostinger (website hosting and backups)
• Google (GA4 analytics; geocoding for listing creation/import)
• CookieYes (cookie consent management)
• Brevo (email delivery)
• Stripe (payment processing)
• Awin (affiliate tracking where applicable)

15. International transfers

Some of our service providers may process personal data outside the United Kingdom. Where personal data is transferred internationally, we ensure that an appropriate safeguard or lawful transfer mechanism applies where required. Depending on the provider and destination, this may include UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework, the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or another mechanism recognised under UK data protection law.

16. How long we keep personal data (retention)

We keep personal data only for as long as necessary for the purposes set out in this Privacy Policy, including to meet legal, accounting, or reporting requirements.

Retention depends on the type of data and how you use the platform. In summary:

• Account and parent planning tools data: retained while your account is active and deleted/anonymised when you delete your account (see section 17).
• Marketing/CRM data: Marketing communications cease when you withdraw consent or unsubscribe. We may retain a limited record of your consent or opt-out preference where necessary to demonstrate compliance and ensure your marketing preference continues to be respected.
• Support/contact enquiries: normally retained for up to 24 months from the last interaction.
• Analytics (GA4): retained for 14 months (see section 9.2).
• Subscription/billing/transaction records: retained as required for accounting and legal/tax purposes, even if you delete your account.
• Backups: deleted data may persist temporarily in backups for up to 7 days (see section 18).

17. Account deletion and anonymisation

If you delete your account (or request deletion), we take steps to delete or anonymise personal data associated with your account, subject to legal and accounting retention requirements.

As part of account deletion/anonymisation:

• Birthday Reminders, reminder history and related data are deleted.
• Saved Favourites relationships are deleted.
• Gift Lists and Gift List items are deleted.
• Gift List claims on other people’s lists are anonymised (so the list can still function without identifying you).
• Your FluentCRM contact record is removed, making you ineligible for marketing communications.
• We run an orphan-data sweep as a safeguard to remove residual account-linked data.
• If you re-register with the same email address later, your new account does not reconnect to previously deleted/anonymised data.

Please note: certain records may need to be retained for legal, tax, accounting, fraud prevention, or dispute resolution purposes (for example invoices and transaction references).

18. Hosting, backups, and security

18.1 Hosting and backups

Our website is hosted by Hostinger. Automated daily backups of the website and database are retained for up to 7 days.

Where personal data has been deleted from our active systems, a residual copy may therefore remain temporarily within a secure backup until that backup expires or is overwritten. Backup data is not used for ordinary business purposes except where necessary for disaster recovery or security.

18.2 Security

We take appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access.

19. Your rights (UK GDPR)

Under UK data protection law, you have rights in relation to your personal data, including:

• the right to access your personal data;
• the right to rectification (correct inaccurate data);
• the right to erasure (delete your data) in certain circumstances;
• the right to restrict processing in certain circumstances;
• the right to object to processing in certain circumstances (including where we rely on legitimate interests);
• the right to data portability in certain circumstances;
• the right to withdraw consent at any time where we rely on consent (this will not affect the lawfulness of processing before withdrawal); and
• the right to complain to the UK Information Commissioner’s Office (ICO).

You can usually manage certain information directly in your account settings. For other requests, contact us using the details in section 21.

20. Automated decision-making and profiling

We do not use your personal data for automated decision-making that produces legal or similarly significant effects for you. We do not build advertising profiles of children.

21. How to contact us

If you have questions about this Privacy Policy or want to exercise your rights, you can contact us at:

My Best Birthday Limited
Registered office: 128, City Road, London, EC1V 2NX
Email: contact@mybestbirthday.co.uk

22. Complaints

If you are unhappy with how we handle your personal data, you can complain to the UK Information Commissioner’s Office (ICO). You can find more information at the ICO’s website.

23. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to the platform, legal requirements, or how we process personal data.

We will update the effective date of this Privacy Policy when changes are made and, where appropriate, notify you of material changes through the website, your account or by email.