Privacy Policy

1. Who we are

Hey Friday is run by Hey Friday Ltd, a company registered in England & Wales (company number 17323262), whose registered office is at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ (“we”, “us”, “our”).

We are the controller of the personal data described in this policy under UK data protection law: the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

This policy covers our website at heyfriday.co.uk, our iOS app and its App Clip, and the emails and notifications we send (together, the “Platform”). For privacy questions, email privacy@heyfriday.co.uk.

2. Who this policy covers

• Organisers: people who start a collection or card.
• Contributors: people who sign a card or chip in money, with or without an account.
• Recipients: the person a collection is for.
• Invitees: people an organiser asks to sign or chip in.
• Visitors: anyone browsing the website or contacting us.

3. What we collect

Information you give us

• Account details: your name and email address. If you add them, your phone number and postal address.
• Sign-in details: if you sign in with Google or Apple, the name, email address and profile picture they share with us. If you use a passkey, its public key (the private part never leaves your device). We never see your Google or Apple password.
• Date of birth: when you turn on money collection, so we can check you are 18 or over.
• Collection details: the occasion, title, closing date, card design, cover image and any note you write.
• Card content: your message and anything you add to it, such as a photo, video, voice note, GIF or sticker. Also how you want your name shown: in full, as a nickname, or anonymously.
• Payment details: when you chip in or order a printed card. Card details go straight to our payment provider; we never see or store your full card number.
• Bank details: if you take money out of a collection to a bank account. These go straight to our payment provider and are not stored by us.
• Identity check information: before you can take money out, such as a photo of your passport, driving licence or ID card, a selfie and a short video to check you are a real person. See section 5.
• Delivery details: the name and address a printed card is posted to.
• Messages to us: what you write when you contact support, and our replies.
• Waitlists: your email address, if you join one.
• Choices: your marketing, cookie and notification choices.

Information other people give us about you

• Organisers give us a recipient's name, and may add their email address and a photo. They may also give us invitees' names and email addresses.
• Contributors may mention you in a message on a card.
• Our identity check provider (Didit) tells us the result of your check, including the name, date of birth, document details and screening results it found.
• Payment and delivery partners tell us whether a payment succeeded, was refunded or was disputed, and where a printed card is in the post.
• Google may tell us about security events on a Google account you use to sign in, such as the account being taken over or disabled.
• Our email provider tells us whether an email was delivered, opened or bounced, and if you unsubscribed.

Information collected automatically

• Device and connection: IP address, browser, operating system, device type, and the approximate location (city and country) worked out from your IP address. We never collect your precise location.
• Fraud signals: when you sign up, sign in, create a collection or pay, a device identifier and signals such as whether you are using a VPN, a private window or automated software. See section 4.
• Terms acceptance: when you create a collection, the time, your IP address and your browser, as a record that you accepted our terms.
• Usage: pages and screens visited and actions taken, only if you accept analytics cookies on the website or say yes in the app.
• Crash and error reports: what went wrong, on which device and app or browser version.
• Notification token: if you allow notifications in the iOS app, the token Apple gives us to send them to your phone.

We don't ask for special category data (such as health, religion or ethnicity). Identity checks do use biometric data (a comparison of your selfie with your document photo); see section 5. Please don't include sensitive information about yourself or others in card messages.

4. How we use it, and our legal basis

UK law requires us to have a legal basis for each use of your data. The bases we rely on are: contract (we need it to provide what you asked for), legal obligation (the law requires it), legitimate interests (it's reasonably needed to run Hey Friday and doesn't override your rights), and consent (you said yes, and can change your mind).

Where we rely on legitimate interests, you can ask us for more detail on how we balanced them against your rights, and you can object (see section 14).

Some information is needed to use the Platform. Without a name and email we can't take a contribution or send a receipt, and without an identity check we can't release money from a collection.

5. Identity checks and financial crime screening

Before money leaves a collection, the person taking it out must complete an identity check with our provider, Didit. You photograph an identity document and take a selfie. On iOS, Didit may also read the chip in your passport or ID card. Didit:

• reads the document and checks it is genuine;
• compares your face with the document photo, and checks the selfie is of a live person;
• checks your name against sanctions lists, lists of politically exposed persons and adverse media, and may repeat this while your account is open;
• checks the IP address the check was made from.

Comparing your face with your document uses biometric data, which the law treats as special category data. We rely on your explicit consent, which you give when you start the check, and on the substantial public interest in preventing fraud and other unlawful acts. You can choose not to take the check, but we then can't release money to you.

We keep the result, your verified name and date of birth, the document type, number, country and expiry date, and the screening outcome. We don't keep the document images or your selfie: Didit holds them under its own retention rules. When our payment partner Ryft needs to verify who it is paying, we pass it the document images from Didit without keeping a copy.

We also send details of each payment (amount, payer and organiser names and email addresses, and a device identifier) to Didit to monitor for unusual activity.

6. Automated decisions

Some decisions are made automatically:

• If an identity check or screening result needs a closer look, taking money out is paused until one of our team has reviewed it. A person always makes the final decision.
• After three unsuccessful identity checks, further attempts are paused until our team reviews the account.
• A payment flagged by transaction monitoring may be held for review.
• If you aren't 18 or over, money collection can't be turned on.
• An email address whose domain can't receive mail is refused when you sign a card or chip in.
• If Google tells us a Google account you sign in with has been compromised, we sign you out, and if Google has disabled the account, we suspend sign-in with it.

If an automated decision affects you, you can ask for a person to review it, give your point of view, and challenge it, by emailing privacy@heyfriday.co.uk.

7. What other people on a collection can see

• Anyone with a card's link sees the messages and media on it, with each contributor's name shown the way they chose: in full, as a nickname, or not at all.
• The organiser and the recipient also see each contributor's real name and email address, even if the contributor chose a nickname or to be anonymous on the card. They see whether someone chipped in and how much.
• The recipient sees the recipient details the organiser entered.
• A printed card carries the messages, names as chosen, and media (as a picture or a QR code).

Anyone can share a card's link, so treat a card as visible to the people it's shared with.

8. Who we share it with

We don't sell your personal data. We share it with the providers below, who process it for us under contract, and only for the purposes described. Where a provider decides for itself how to use data (for example a payment provider meeting its own legal duties, or Google and Apple when you sign in with them), its own privacy policy also applies.

We may also share personal data:

• with the police, regulators, courts or other authorities, where the law requires it or to prevent fraud or crime;
• with our professional advisers, such as lawyers, accountants and insurers;
• with a buyer or investor, if all or part of our business is sold or restructured. They would have to use it in line with this policy.

9. Transfers outside the UK

Some of our providers process data outside the UK, mainly in the USA and the EU. When we send personal data abroad we make sure it's protected by one of the following:

• UK “adequacy regulations” for the country, which cover the EU and EEA;
• the UK Extension to the EU-US Data Privacy Framework, for US companies certified under it;
• the ICO's International Data Transfer Agreement, or its Addendum to the EU Standard Contractual Clauses.

Email privacy@heyfriday.co.uk for more detail on the safeguard for a particular provider.

10. How long we keep it

We keep personal data only as long as we need it:

We may keep data for longer if we need it for a legal claim, an investigation, or a request from an authority.

11. Cookies and similar technologies

We use cookies and similar technologies such as local storage. Essential ones keep you signed in, process payments, prevent fraud, run support chat and record your cookie choices; these are always on. Analytics and marketing cookies are off until you say yes, and you can change your mind at any time. Our Cookie Policy lists them and has the link to your cookie settings.

12. The iOS app

The app handles the same data as the website, plus:

• Permissions: the app asks before using your camera, microphone or photos (for identity checks, and for photos on a card), or NFC (to read the chip in your passport or ID card). You can change these in your iPhone's Settings at any time.
• Notifications: only if you allow them. They show the collection's title and the first name of the person who signed or chipped in.
• Crash, error and performance reports: sent to Sentry. They hold no screenshots and are linked only to a random number that identifies your account.
• Usage analytics (which screens are used): sent to PostHog in the EU. The app asks first and sends nothing without a yes, and you can change your answer in the app's Account screen. They are linked only to a random number that identifies your account: never your name or email, and never your messages or payment details.
• The App Clip: lets you sign a card and chip in with Apple Pay without installing the app. It collects your name, your message and, if you chip in, an Apple Pay payment.

We don't use the app to track you across other companies' apps or websites.

13. Marketing

We only send marketing emails if you opt in, and every one has a link to unsubscribe. You can also email privacy@heyfriday.co.uk. Emails about collections you are part of, such as receipts and reminders, are not marketing and keep coming while you take part. An invitee can stop invitation emails for a collection using the link in them.

If you accept marketing cookies and create an account, we send Google a scrambled (one-way hashed) copy of your email address and name so it can tell whether one of our ads led to the sign-up. If you arrive from a Google ad, we keep the ad's click identifier for up to 90 days for the same reason.

14. Your rights

Under UK data protection law you have the right to:

• Access: get a copy of the personal data we hold about you.
• Rectification: have inaccurate or incomplete data corrected. You can update most details yourself in your account.
• Erasure: have your data deleted. You can delete your account yourself in your account settings or the app, once no money is held or in transit for you. Some records must be kept by law (see section 10).
• Restriction: ask us to limit how we use your data while a concern is resolved.
• Portability: receive data you gave us in a structured, machine-readable format, or have it sent to another organisation.
• Objection: object to uses based on legitimate interests, and to direct marketing at any time.
• Automated decisions: ask for a person to review a decision made automatically (see section 6).
• Withdraw consent: at any time, where we rely on consent. This doesn't affect what we did before.

To use any of these rights, email privacy@heyfriday.co.uk. It's free. We may need to confirm your identity first. We'll reply within one month; if a request is complex we may extend this by up to two more months and will tell you why. Sometimes the law lets us refuse, for example where it would reveal someone else's data or prejudice the prevention of crime, and we'll tell you if so.

If someone mentioned you on a card, or an organiser entered your details as a recipient or invitee, you have these rights too.

15. Children

The Platform is not intended for anyone under 18. We don't knowingly collect personal data from children. If you think a child has given us personal data, email privacy@heyfriday.co.uk and we'll delete it promptly.

16. Security

We protect personal data with measures including encryption in transit, access controls that limit which staff and systems can see what, identity verification before money leaves the Platform, and contracts with every provider that handles it. No system is completely secure. If a breach puts your rights at high risk, we'll tell you without undue delay, and the ICO within 72 hours where the law requires it. To report a security problem, see our Security page.

17. If you live outside the UK

Hey Friday is a UK service for UK workplaces, priced in pounds. If you use it from elsewhere, your data is handled as this policy describes, under UK law.

• European Economic Area: you have the same rights as under the EU GDPR, which match those in section 14, and can complain to your local data protection authority.
• United States: we don't sell personal information. With marketing cookies we share limited data with Google to measure our ads; you can opt out at any time by turning marketing cookies off in your cookie settings. We don't use sensitive personal information to infer characteristics about you. We won't treat you differently for using your privacy rights.
• Elsewhere: email privacy@heyfriday.co.uk and we'll respond in line with this policy and the law that applies to you.

18. Changes to this policy

We update this policy when what we do with personal data changes. The date at the top shows the latest version. We'll tell you about significant changes by email or with a notice on the Platform.

19. Contact us and complaints

For any question about this policy or your data, email privacy@heyfriday.co.uk, or write to Hey Friday Ltd, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ.

If you are unhappy with how we handle your data, please tell us first so we can try to put it right. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.