Privacy policy

Last updated: 6 November 2026

This notice explains how EllieWish handles personal information on the website and in the app, under the UK GDPR and the Data Protection Act 2018.

EllieWish is operated by Haddon Family Ltd, a registered limited company, company number 16993428. Haddon Family Ltd is the controller of personal information used to run EllieWish. Contact us about privacy at hi@haddon.family.

Account information includes your name, email address, account settings, password hash and authentication or recovery records. If you choose a supported social sign-in provider, we receive the account details needed to identify and sign you in.

Wishlist information includes list names, descriptions, sharing settings, product titles, retailer links, images, quantities, priorities, notes and preowned preferences. Saved wishlists and browsing preferences may also be stored for the features you choose to use.

Gifting information includes the name you provide, reserved or purchased quantities, reservation times and records that let the same browser manage its gifts. You can gift as a guest without creating an account.

We also process technical information needed to deliver and protect the service, such as IP addresses, browser or device details, session identifiers, request logs and security or gift-action records. Messages you send to our contact address contain the details you choose to provide.

We use account and wishlist information to provide the account, saving and sharing features you request. Our lawful basis is performance of our contract with you, or taking steps at your request before entering into it. If you do not provide required account details, we cannot provide account features.

We use session and gift records to provide guest gifting and prevent duplicate or conflicting reservations. We rely on our legitimate interests in running a reliable gifting service and protecting wishlist owners and givers. Security, fraud prevention, proportionate service troubleshooting and handling enquiries also rely on legitimate interests, where those interests do not override your rights.

Where we must keep or disclose information to meet a legal requirement, we rely on that legal obligation. If we introduce a use that requires consent, we will ask for it separately; acknowledging the cookie notice is not consent to advertising, analytics or marketing.

Public wishlists can be viewed by people with the link and may be found using the owner's name or full email address. A private list is not publicly shared. A password-protected list can be viewed by anyone who has its link and password. People who can view a list can copy or share what they see.

Other givers do not see your giver name. The wishlist owner can choose to reveal names on purchased gifts using the surprise-reveal feature. Reservation counts and expiry information can be visible to other givers. Do not enter a giver name you are unwilling for the owner to see.

Avoid putting sensitive personal information, or information about other people without an appropriate reason, in wishlist titles, descriptions or notes. Choose the sharing setting that is right for the information you add.

Providers may process information on our behalf where needed for hosting, storage, security, service email and technical support. We may also disclose information where required by law or needed to establish or defend legal claims. Contact us for the current provider list, processing locations and details of any international-transfer arrangements and applicable safeguards.

Retailer pages, product-image hosts and optional sign-in providers are separate services with their own privacy notices. Loading a remotely hosted product image discloses a network request, including your IP address, to its host. Opening a retailer site, including in Ellie Browser, connects you directly to that site. This notice does not control its cookies or handling of your information.

We keep account and wishlist information while it is needed to provide your account and the features you use. You can remove items or lists, and eligible signed-in accounts can use Delete account to remove the account and its wishlists from the live service.

A reservation lasts 24 hours unless it is cancelled or marked as purchased. Purchased-gift records do not expire after 24 hours. Some security, audit, support, legal-claim or backup records may need to be retained separately. Retention depends on the purpose, security need and any applicable legal obligation; contact us for details for a particular record or deletion request.

You can change sharing settings, edit your wishes and delete your account. Depending on the circumstances, UK data-protection law also gives rights of access, correction, erasure, restriction, portability and objection. Where processing relies on consent, you can withdraw it without affecting earlier lawful processing.

Contact hi@haddon.family to exercise your rights or raise a concern. Our Your data rights page explains how to make a request and complain to the ICO. We do not use your information to make solely automated decisions that have legal or similarly significant effects on you.

We will update this notice when our service or data practices change and show the revised date above. Where required, we will provide additional information or ask for consent before introducing a new use.

Privacy policy | Cookie policy | Your data rights | Terms and conditions