Your information

The least we can work with, kept the shortest time

Sending a gift means handing someone's home address to a supplier. That is worth being precise about, so here is exactly what the programme holds, where it sits, and when it is deleted.

What is collected, and what is not

The programme is built so that the sensitive thing about an occasion never needs to be written down in the first place.

Collected

Four things, per gift

The recipient's name
A delivery address and postal code
A phone number, for the courier
The message you want on the card

Plus the email address of whoever placed the request, so the confirmation and tracking go back to the right person.

Never collected

Anything that belongs in an HR file

Why a colleague is unwell, or any medical detail
A baby's sex or date of birth
Dates of birth, employee numbers or job titles
Leave dates, salary or grade
A reason for any dietary choice you make

Where it is held and for how long

Question	Answer
Where is the information processed?	In Canada. Gifts are packed by approved suppliers within Canada, and recipient details are not transferred outside the country.
Who else sees it?	The courier chosen for the delivery, which needs the name, address and phone number to deliver. No one else.
How long is it kept?	Until the gift is delivered, then cleared — unless an office has asked in writing for a recurring list to be held.
Is there a standing list of staff?	No. There is no copy of a CIMA+ directory, and no list is retained by default.
Is it used for marketing?	No. Recipients are not added to any mailing list and are not contacted again.
Who can I ask about a record?	Your office lead, or email gifting@cima.boutique.

How this lines up with CIMA+ supplier rules

CIMA+ publishes Personal Information and Data Security Requirements that bind every supplier it contracts with. The programme is built to them rather than around them.

Canada only

Recipient information is processed in Canada. Any processing elsewhere would need written authorisation from CIMA+ first.

Only what the job needs

Four fields per gift, used to pack and deliver it and for nothing else.

Named sub-processors

The courier is the only third party, named on the quote and bound by written contract.

Incidents reported fast

Any suspected loss or unauthorised access is phoned through immediately and confirmed in writing within 24 hours.

Returned or destroyed

On request or at the end of the contract, every copy of CIMA+ information is returned or securely destroyed.

Open to audit

CIMA+ can inspect how its information is handled, on reasonable notice.

About this demonstration site

This preview collects nothing at all. The sign-in asks for an email only, takes no password, checks it against nothing and sends it nowhere — it stays in your own browser tab until you close it. There is no database behind this site, no analytics and no tracking cookie.