Privacy notice

Lasting Legacy Sculptures (“we”, “us”) makes memorial sculptures from photographs. We are the controller of the personal information described here, under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Legal name and registration: [Registered business or company name, company number — TO CONFIRM]. Registered address: [Registered address — TO CONFIRM]. ICO registration: [ICO registration number — TO CONFIRM].

For anything about your information, email support@lastinglegacysculptures.co.uk.

• Your order: name, email address, delivery address, telephone number if you give one, the sculpture and options you chose, any inscription, and the order history. We need these to make and deliver what you ordered (performance of a contract).
• Photographs: the photographs you upload of the person or pet being remembered, and the name you give them. We use them only to assess the likeness, sculpt, and prepare your previews. They are kept in private storage that is not publicly reachable (performance of a contract).
• Payment: card payments are taken by Stripe on its own secure page. We never see or store your full card number; we receive confirmation of payment and the last details Stripe shares with sellers.
• Messages: what you send through the contact form, chat or email, so we can answer you (legitimate interests, or steps before a contract).
• The free sculpture preview: the photograph you upload is sent to our image-generation provider to produce the preview, and the result is kept for a limited period so you can see it again (your request, and our legitimate interest in showing what a sculpture could look like).
• Your account: if you sign in to follow your order, your email address and a session cookie.
• Site statistics: see section 5.

Photographs may show a person who has died. Data protection law does not generally cover people who have died, but we treat those photographs with the same care as anyone else’s. If a photograph shows living people, we use it only for your order.

We use a small number of trusted providers, each only for the job described:

• Stripe — card payments and fraud prevention.
• Vercel — hosts this website and stores uploaded photographs and files in private storage.
• Neon — hosts the database that holds orders and enquiries.
• Resend and Microsoft 365 — send and receive our email, including order updates.
• OpenAI — generates the free digital sculpture previews from your photograph.
• Tripo — helps generate the three-dimensional model the workshop then corrects by hand.
• Telegram — sends the workshop private notifications of new orders and messages.
• Google Analytics — only if you accept analytics cookies (section 5).
• Couriers — your name and delivery address, to deliver your sculpture.

Some of these providers process information outside the UK, including in the United States. Where they do, the transfer is covered by the UK’s adequacy regulations (including the UK–US data bridge) or by the UK International Data Transfer Addendum to standard contractual clauses. We do not sell your information, and we never use your photographs in our marketing without your separate written permission.

• Order records, including invoices: six years after the order, as tax law requires.
• Photographs and design files: [retention period — TO CONFIRM, e.g. 12 months after delivery so a further piece can be made from the same sculpt], or sooner if you ask us to delete them.
• Free preview uploads and results: [retention period — TO CONFIRM].
• Enquiries that did not lead to an order: [retention period — TO CONFIRM, e.g. 12 months].

We use a few cookies that the site needs to work. They do not track you across other websites:

• lls_basket — remembers what is in your basket.
• lls_customer_session — keeps you signed in to your account.
• lls_sculpture_preview, lls_preview and lls_studio — keep your free preview and design session together.
• lls_partner_session and lls_admin_session — for funeral director partners and our own staff only.

We count visits ourselves without a cookie: the page, the referring site, country, device type, and a one-way scrambled code made from your connection details so we can tell repeat visits apart. The raw address is never stored.

Google Analytics runs only if you choose “Accept” on the cookie banner. You can change your mind at any time by clearing this site’s data in your browser, after which the banner will ask again.

You can ask for a copy of your information, ask us to correct it, delete it, restrict or object to how we use it, or to receive it in a portable form. Email support@lastinglegacysculptures.co.uk and we will reply within one month. Some records (for example invoices) we must keep by law.

If you are unhappy with how we have handled your information, please tell us first. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

If we change this notice we will update the date at the top. See also our terms of sale and returns and refunds.