This Privacy Policy explains how Something Worth Waiting For, trading as Something Worth Waiting For (“we”, “us” and “our”), uses personal information when you use somethingworthwaitingfor.com and our related letter-writing and delivery services.
1. Who is responsible for your data
We are the controller of personal information processed under this policy. For privacy questions or to exercise your rights, email [email protected]..
2. Information we collect
- Account information: your name, email address, password hash, profile image and account preferences.
- Letter and recipient information: the content you write, any attachments, recipient name and email address, chosen delivery date, and delivery/read-status information where available.
- Payment information: transaction, subscription and billing-status data. Card details are handled by our payment provider and are not stored by us.
- Technical information: IP address, browser/device information, cookie identifiers, log data and information about how you use the Service.
- Communications: messages, feedback and support requests you send us.
3. Why we use your information
| Purpose | Lawful basis |
|---|---|
| Creating accounts, storing letters, scheduling and sending them, taking payment, and providing support. | Performance of our contract with you. |
| Preventing fraud, misuse and security incidents; maintaining records; improving and protecting the Service. | Our legitimate interests in operating a safe, effective service. |
| Meeting tax, accounting, regulatory and legal obligations. | Legal obligation. |
| Sending optional product news or marketing emails. | Your consent, where required. You may unsubscribe at any time. |
Where we rely on legitimate interests, we balance those interests against your rights and expectations. You can object to this processing as explained below.
4. Recipient information and letter content
When you provide a recipient’s details, you must ensure you have a lawful basis to do so. We use that information only to deliver the letter and to operate, secure and troubleshoot the Service. The recipient will receive the content you choose to send. Please do not include special-category information (for example health, political, religious or biometric information) or highly sensitive information unless you are satisfied it is appropriate and lawful to do so.
5. Who we share information with
We use carefully selected service providers to help operate the Service, such as hosting and database providers, email-delivery providers, payment processors, customer-support providers, analytics providers and professional advisers. They process information under contractual safeguards and only as instructed where they act as our processors.
We may disclose information if required by law, to protect rights, safety or security, or in connection with a business sale, merger or restructuring. We do not sell your personal information.
6. International transfers
Some providers may process information outside the UK or European Economic Area. Where this happens, we use appropriate safeguards, such as an adequacy regulation or approved contractual protections, and can provide further information on request.
7. How long we keep information
We keep account information for as long as your account remains open. We retain sent letters and delivery records for 5 years unless you delete them earlier or longer retention is required by law. We generally retain payment and tax records for six years. Backups may persist for a limited additional period. We will delete or anonymise information when it is no longer needed.
8. Cookies
We use essential cookies to keep the Service working, including login, security and preference cookies. We may also use optional analytics or marketing cookies, which we will set only with your consent where required. You can manage cookies through our cookie settings and your browser. See our Cookie Policy for details.
9. Your rights
Subject to applicable law, you may ask us to access, correct, erase, restrict or transfer your personal information, or object to processing based on legitimate interests. You may withdraw consent at any time; this does not affect processing already carried out. To make a request, email [email protected]. We may need to verify your identity.
If you are in the UK, you can complain to the Information Commissioner’s Office at ico.org.uk. If you are elsewhere, you may also contact your local data-protection authority. We would appreciate the opportunity to resolve concerns first.
10. Security
We use reasonable technical and organisational measures designed to protect information. No online service can be completely secure, so please use a strong, unique password and keep account access confidential.
11. Children
The Service is not intended for children under 16. We do not knowingly collect personal information from children under 16 without appropriate authorisation. If you believe a child has provided personal information to us, contact us and we will investigate.
12. Changes to this policy
We may update this policy from time to time. We will post the latest version here and update the date above. For material changes, we will provide additional notice where appropriate.