I have a web start up that enables people to send handwritten greeting cards without an address. We have made it as cheap and easy as possible to help people send hand written cards to each other - It's a fun and meaningful way to connect with people. Everyone loves christmas cards right?
There's no privacy statement on the Xmas page, you might want to add one. There is a link to one on the main website. 
The statement mentions the product containing ads and sharing information with ad networks. Nowhere else do I see anything about that on your web site.
You also want to use the addresses later on, not just to send one free card. Customers should know that.
"We use information held about you in the following ways: […] to provide you with information, products or services that you request from us or which we feel may interest you, where you have consented to be contacted for such purposes"
And if I don't give out the address for the person I'd like you to send a card to, you'll make him sign up too:
"We will mail your card as soon as your friend updates their address information at Bfore."
"to provide aggregate statistical information about site visitors and users to recruiters (such as the number of CVs on the database, or the number of visitors to the site) and for other lawful purposes. We provide this information to customers, advertisers, suppliers and other reputable third parties on the basis that it will not include any information that enables them to identify individuals."