Answers forRewards and Recognition

Giftpack reduces privacy risk in AI-assisted recommendations by limiting the workflow to information relevant to the gifting experience and program rules. Recommendations can use permitted signals such as location, budget, eligibility, availability, and preferences the recipient chooses to provide. AI should not be treated as permission to collect unnecessary personal data or infer sensitive characteristics. Companies can also use fixed gifts, curated choice sets, or non-personalized redemption when they want a lower-data approach.

Giftpack manages data retention, deletion, and access according to the service being used, applicable law, security requirements, and contractual obligations. Different data types may need different retention periods because transaction, tax, shipping, security, or legal records do not all follow the same lifecycle. Organizations and individuals can raise appropriate privacy or access requests through the available process. Enterprise customers that need a specific retention schedule, deletion workflow, or access-control requirement should address it during privacy and security review.

Giftpack’s public Security information describes the use of industry-standard encryption for sensitive data in transit and at rest. Encryption is one part of the overall security program and works together with access controls, monitoring, backups, and operational safeguards. If your security team needs exact cipher suites, TLS versions, key-management details, or system-specific at-rest encryption information, those details should be confirmed through the latest security documentation or formal security review rather than relying on a static FAQ.

Yes. Enterprise security and privacy teams can request appropriate materials such as a DPA, security questionnaire responses, and SOC 2 documentation as part of vendor review, subject to applicable confidentiality and access requirements. To speed up the review, share the intended use case, data categories, integrations, target launch date, and any blocking requirements. Sensitive security materials may require an NDA or qualification before they are released.

Yes. Giftpack supports common enterprise security and privacy requirements, including SOC 2 Type II and GDPR-related data protection needs. Enterprise customers can request security questionnaires, a DPA, vendor-security review, and applicable security documentation. Controls and contractual requirements can also be evaluated based on the data involved, countries, integrations, and program design. The exact legal obligations depend on the customer, data subjects, processing purpose, and jurisdiction. Formal GDPR or other regulatory assessments should rely on Giftpack’s current privacy policy, DPA, and security-review materials.

Giftpack protects company and recipient data through a combination of security governance, access controls, encryption, monitoring, operational safeguards, and privacy practices appropriate to the service. Access to personal or business data should be limited to what is needed for the relevant workflow. Security is not a single feature. Enterprise programs may also involve SSO, role-based access, vendor review, data-processing terms, and customer-specific controls. For a formal assessment, use Giftpack’s current Security materials and security-review process rather than relying only on this FAQ.