Gigabyte Studios Privacy Policy

24 Sept 2026

1. Who we are and what this policy covers

1.1 Gigabyte Holdings Limited, trading as Gigabyte Studios ("we", "us"), runs product gifting programmes for consumer brands. We arrange for brands to donate products to organisations and communities in the United Kingdom and the United States, such as hospitals and nursing teams, professional associations, charities, faith communities and wellness programmes, and we report on the results.

1.2 We are a company registered in England and Wales (company number 17053102). Registered office: [Swan Building, 20 Swan Street, Manchester, M4 5JW, England]. ICO registration number: ZC103677.

1.3 This policy explains how we handle personal data when we:

  • contact organisations about receiving donated products, by phone, email or message

  • arrange, deliver and follow up on gifts

  • collect feedback, photos and testimonials about a gift

  • operate our website gigabyte-studios.com and our client reporting dashboard

  • deal with brands, suppliers and other business contacts

1.4 Questions: info@gigabyte-studios.com, or write to us at the address above.

2. Our two roles

2.1 We are the controller for data we collect for our own purposes: our outreach to organisations, arranging and following up on gifts, testimonials we gather, our website, and our business relationships. This policy covers that data.

2.2 We act for the brand when we handle data on a brand client's instructions, for example processing claims made through a brand's QR code or landing page, or passing delivery details to the brand's warehouse. In that case the brand is the controller, its privacy policy applies, and we act as its processor under a written agreement.

2.3 If you received a gifted product and redeemed a code or signed up on the brand's website, the brand holds that data. Contact us if you are unsure who holds your data and we will tell you.

3. What personal data we collect

3.1 We collect only what we need to arrange and run gifts:

  • Contact and role data: name, job title or role, organisation, work email, work phone (and any other number you give us), organisation address, US state or UK region, and time zone.

  • Gift arrangement data: delivery contact and address, number of units, distribution plans, approvals and paperwork exchanged with your organisation, and dates of recognition events or awareness weeks the gift ties to.

  • Call and correspondence data: notes of calls, call date, time and outcome, call recordings where you have been told the call is recorded, and the content of emails and messages.

  • Preference data: whether you have asked us not to call, email or text you, and your do-not-contact status.

  • Feedback and content: feedback on a gift, photos, videos, quotes and testimonials you choose to send us, and whether you agree to them being used publicly.

  • Ambassador interest: if you tell us you would like to become an ambassador or affiliate for a brand, your contact details and interest.

  • Website data: IP address, browser and device details, pages viewed, and cookie data, as described in our Cookie Policy.

  • Dashboard users: login details and activity for brand staff who use our reporting dashboard.

3.2 We do not ask for, and ask you not to send us, health information about yourself or anyone else. See Section 7.

3.3 We do not collect data about the individual people who receive products from an organisation, except where they choose to contact us or send us feedback directly.

4. How and why we use your data

4.1 As a UK company, we apply the UK GDPR to all personal data we control, wherever you are. Our lawful bases are:

Purpose

Lawful basis

Why

Researching and contacting organisations about receiving donated products

Legitimate interests

Offering free products to organisations is our business. We contact people in relevant roles at their work details, and you can opt out at any time

Arranging, delivering and following up on a gift

Legitimate interests, or steps towards an agreement with your organisation

Needed to deliver what your organisation agreed to

Recording calls

Legitimate interests, and consent where local law requires it

Accuracy, training and record keeping. We tell you at the start of every recorded call

Keeping a do-not-contact list

Legal obligation and legitimate interests

So we never contact you again once you ask us not to

Follow-up texts and WhatsApp messages

Consent

Only where you have asked us to message you

Using testimonials, photos and quotes publicly or sharing them with the brand

Consent

You choose, and you can withdraw

Reporting results to the brand that funded the gift

Legitimate interests

Brands need to see where products went and what happened. Reports are at organisation level wherever possible

Website analytics and advertising cookies

Consent

See our Cookie Policy

Legal, tax and regulatory compliance

Legal obligation

4.2 Where we rely on legitimate interests, we have balanced our interests against your rights. You can ask for a copy of that assessment.

4.3 We do not sell your personal data. We do not use automated decision-making that has legal or similarly significant effects on you.

5. Telephone calls

5.1 We call organisations in the UK and the US to offer donated products and to follow up on gifts. Our calls are made by people on our team, dialled individually. We do not use autodiallers, prerecorded messages or AI-generated voices.

5.2 We call at reasonable times. For US numbers, that means between 8am and 9pm in your local time.

5.3 Recording. We may record calls. If a call is recorded, we tell you at the start and you can ask us to stop recording or end the call. We do not record calls where you have not been told.

5.4 Do-not-call. If you ask us not to call you, we add your number to our internal do-not-call list straight away and will not call it again for any brand. We check US numbers against the National Do Not Call Registry and applicable state lists before calling, and UK numbers against the Telephone Preference Service and Corporate Telephone Preference Service. A copy of our do-not-call policy is available on request.

5.5 You can ask not to be called by telling the caller, emailing info@gigabyte-studios.com, or writing to us.

6. Email and text messages

6.1 Email. We email people at their work address about gifts relevant to their role. Every email identifies us, includes our postal address and has a working unsubscribe link. We act on unsubscribe requests promptly, and in any case within 10 business days.

6.2 Texts and WhatsApp. We only text or WhatsApp you if you have asked us to, for example to confirm a delivery or send photos. Reply STOP to any text to opt out. Message and data rates may apply.

6.3 Emails may contain tracking pixels showing whether they were opened. You can block these by turning off automatic image loading in your email client.

7. Health information

7.1 Some of the communities we work with are connected to health, such as nursing teams, cancer charities, survivorship programmes and weight-management programmes. We deal with these organisations at organisation level and do not collect health information about individuals.

7.2 Please do not send us information about your own or anyone else's health. If you share it anyway, for example in a testimonial, we will not use or share it without your separate, explicit consent, and we will delete it if you ask.

7.3 We do not sell or share health information, and we do not use it for advertising.

8. Where we get your data

8.1 From you, when you speak to us, email us, send feedback or use our website.

8.2 From public sources, such as your organisation's website, staff directories, association and event listings, LinkedIn and published contact details for your role.

8.3 From colleagues or other people at your organisation who refer us to you, and from brand clients who ask us to contact an organisation. We tell you where we got your details when we first contact you.

9. Who we share it with

9.1 We share personal data only as needed to run gifting programmes:

  • The brand funding the gift: your organisation's name and delivery details for fulfilment, and results reported at organisation level. We share your name, role or testimonial with the brand only where needed to deliver the gift or where you have agreed.

  • Warehouses and couriers: delivery contact and address.

  • Service providers acting for us: CRM [GoHighLevel], telephony and call recording [provider], email [provider], SMS and WhatsApp [provider], website hosting [Squarespace], dashboard and cloud hosting [provider], and office software. Each is bound by a data processing agreement.

  • Advertising and analytics providers, such as Meta, only for website visitors who accept cookies.

  • Professional advisers, such as accountants and lawyers.

  • Authorities, where the law requires it.

  • A buyer or investor, if our business or its assets are sold or restructured, under confidentiality terms.

9.2 We do not sell personal data, and we do not share it with third parties for their own marketing.

10. International transfers

10.1 We are based in the UK and work with organisations and service providers in the US. Data may be transferred between the UK and the US.

10.2 When we transfer UK personal data abroad, we use a recognised safeguard: the UK Extension to the EU-US Data Privacy Framework for certified US recipients, or the International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses. Ask us for details of any transfer.

11. How long we keep it

Data

Retention

Outreach contacts with no gift arranged

24 months from last contact, then deleted

Organisations that received a gift, and the gift record

Length of the programme plus 6 years, for contract and tax records

Do-not-contact list

Indefinitely, name and number or email only, so we never contact you again

Call recordings

6 months, unless needed for a dispute

Testimonials and content

Until you withdraw consent or the brand stops using it

Dashboard user accounts

Until the account closes, plus 12 months

Website and cookie data

As set out in our Cookie Policy

11.1 Data we no longer need is securely deleted or anonymised.

12. Security

12.1 We protect personal data with access controls, encryption in transit and at rest where our platforms support it, multi-factor authentication on core systems, and data processing agreements with every supplier. No system is completely secure, but we will notify you and the relevant regulator of a breach where the law requires.

13. Your rights

13.1 Under the UK GDPR you can ask us to:

  • give you a copy of your data

  • correct it

  • delete it

  • restrict how we use it

  • give it to you in a portable format

  • stop using it where we rely on legitimate interests, including for outreach, which we will always do for direct marketing

  • stop using it where we rely on consent, by withdrawing consent

13.2 Email info@gigabyte-studios.com. We reply within one month and there is normally no fee. We may need to verify your identity.

13.3 You can complain to the UK Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to resolve your concern first.

14. If you are in the United States

14.1 Several US states give residents rights over their personal data. Whether or not those laws apply to us, we offer all US residents the following:

  • Know and access: the categories and specific pieces of personal data we hold about you, where we got it, why we use it and who we share it with. Sections 3, 8 and 9 set this out.

  • Delete personal data we hold about you, subject to legal exceptions and keeping you on our do-not-contact list.

  • Correct inaccurate data.

  • Opt out of targeted advertising and of any sale or sharing of personal data. We do not sell personal data. We honour Global Privacy Control browser signals as an opt-out of advertising cookies.

  • Non-discrimination: we will not treat you differently for using these rights.

14.2 Email info@gigabyte-studios.com with the subject line "US privacy request". We will confirm receipt within 10 business days and respond within 45 days. An authorised agent may make a request for you with your signed permission. If we decline a request, you can appeal by replying to our decision, and we will answer the appeal within 45 days.

14.3 In the past 12 months we have collected the categories of data in Section 3 for the purposes in Section 4 and disclosed them to the recipients in Section 9. We have not sold personal data, and we do not knowingly collect sensitive personal data.

15. Children, cookies, changes and contact

15.1 Children. Our services are for organisations and adults. We do not knowingly collect data from anyone under 18. If you think we have, contact us and we will delete it.

15.2 Cookies. Our website uses cookies. Non-essential cookies, including the Meta Pixel, are only set with your consent. See our Cookie Policy.

15.3 Changes. We will update this policy when our activities or the law change, and show the date at the top. We will tell you directly about significant changes where we can.

15.4 Contact. Gigabyte Holdings Limited (trading as Gigabyte Studios), [Swan Building, 20 Swan Street, Manchester, M4 5JW, England]. Email: info@gigabyte-studios.com. Website: gigabyte-studios.com.