Last updated: 16 September 2026
We take the protection of your personal data seriously. This Privacy Policy explains how we collect, use and protect personal data when you visit or use sendmoments.co.uk, create a customer account, design or order products, communicate with us, or use other services available through our website.
1. Who is responsible for your personal data?
The controller responsible for the processing of personal data in connection with sendmoments.co.uk is:
United Arts GmbH
Eupener Straße 67
50933 Cologne
Germany
For questions, requests or complaints concerning data protection, including requests addressed to our Data Protection Officer, please contact: data-protection-officer@unitedartsgmbh.com
1.1 Representative in the United Kingdom
United Arts GmbH has appointed the following representative in the United Kingdom pursuant to Article 27 UK GDPR:
Picanova UK Ltd.
The Harley Building
77-79 New Cavendish Street
London W1W 6XB
United Kingdom
You may address UK data protection matters to our representative at the address above or contact us by email at data-protection-officer@unitedartsgmbh.com.
2. What personal data do we process?
Depending on how you use our website and services, we may process:
- identification and contact data, such as your name, email address, telephone number, billing address and delivery address;
- account data, such as login information, account settings, saved projects and order history;
- order and transaction data, such as products ordered, order numbers, order values, payment method and delivery information;
- content and design data, including photographs, images, text, names, dates, personalised designs, layouts and other material you upload or create;
- communication data, including emails, customer-service enquiries, chats, complaints and other correspondence;
- marketing and preference data, such as newsletter preferences, marketing consents and objections;
- technical and usage data, such as IP address, browser and device information, website interactions, session information and cookie or similar identifiers; and
- feedback and review data, where you participate in surveys, provide feedback or submit a review.
We generally obtain personal data directly from you. We may also receive relevant information from payment providers, delivery providers, affiliated companies and other service providers involved in providing our services.
If you provide personal data relating to another person, for example by uploading their photograph or including their name in a personalised product, you should ensure that you are entitled to provide that information to us.
We do not ask you to provide sensitive personal data unless it is necessary for a particular service. Please avoid including sensitive information in uploaded content or communications unless it is relevant to the service you are requesting.
3. Why do we process personal data?
3.1 Providing our website and services
We process personal data to operate our website, provide customer accounts and design tools, save projects and enable you to use our services.
Where processing is necessary to provide a service requested by you or to take steps before entering into a contract, the legal basis is Article 6(1)(b) UK GDPR.
We also process technical information where necessary for the security, stability and proper functioning of our website and systems based on our legitimate interests under Article 6(1)(f) UK GDPR.
3.2 Processing and fulfilling orders
We process personal data to:
- process your order;
- prepare and manufacture personalised products;
- process payments and refunds;
- arrange delivery;
- communicate with you about your order; and
- deal with complaints, returns and other contractual matters.
The legal basis is primarily Article 6(1)(b) UK GDPR.
We may also process information where necessary to comply with tax, accounting, consumer-protection or other legal obligations under Article 6(1)(c) UK GDPR.
3.3 Security, fraud prevention and legal claims
We may process personal data to protect our website, customers and business against fraud, misuse and security incidents, to investigate disputes or suspected breaches, and to establish, exercise or defend legal claims.
We rely on our legitimate interests under Article 6(1)(f) UK GDPR and, where applicable, compliance with legal obligations.
4. Customer accounts, projects and uploaded content
When you create a customer account or design a product, we process the information necessary to provide your account, save and display your projects, prepare print files and fulfil your orders.
This may include photographs, text, names, dates and other content selected or uploaded by you.
Uploaded content is processed primarily to provide the services requested by you and to manufacture your personalised products.
We may carry out technical processing of files, including formatting, resizing, cropping, conversion and other processing required to prepare them for display or production.
Where our functionality allows you to delete projects or other content through your account, you can initiate deletion using the relevant account functions. You may also contact us to exercise your data-protection rights.
5. Importing photos from Google Photos
Where we offer the option to import photographs from Google Photos, information necessary to provide that functionality is exchanged with Google.
Selected images are copied into your sendmoments gallery or project so that you can use them in the product you are creating.
Our use and transfer of information received through Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements.
We use the permissions granted through Google Photos only to display content available for selection and retrieve the images that you choose to import.
You can manage or revoke the relevant permissions through your Google account.
6. Guest uploads and QR-based features
Where we offer functionality that allows you or other persons, such as event guests, to upload photographs through a link or QR code, we process the uploaded files and associated technical information in order to provide that functionality and make the content available within the relevant project or event.
Information provided through these functions is used only for purposes connected with the relevant service unless another purpose is separately explained to you.
7. Payments
When you select a payment method, personal data required to process the transaction may be provided to the relevant payment service provider.
Depending on the payment method, this may include your name, billing details, contact details, transaction amount and information relating to the order.
Payment providers may process certain information as independent controllers for purposes including payment processing, fraud prevention, identity verification and compliance with financial-services law. Their own privacy information applies to such processing.
We generally do not receive or store complete payment-card credentials where payment information is processed directly by a payment provider.
8. Production
To manufacture your order, we may provide the information required for production to affiliated companies and external production or fulfilment providers.
Depending on the product, this may include:
- order information;
- product specifications;
- personalised print files;
- photographs, text and other content included in your design; and
- information necessary to associate the production file with your order.
Production providers receive only the information reasonably necessary to manufacture and fulfil the relevant product.
9. Shipping and delivery
To deliver your order, we provide the information necessary for shipment and delivery to the relevant logistics and delivery providers.
This typically includes:
- your name;
- delivery address;
- email address or telephone number where required for delivery;
- order or shipment reference; and
- information necessary for shipment tracking and delivery.
Delivery providers do not receive your personalised photographs or design files unless this is exceptionally necessary for the particular fulfilment process.
10. Customer service and communications
If you contact us by email, contact form, chat or another communication channel, we process your contact information, the content of your enquiry and relevant order information to respond to you and manage the matter.
Where the communication concerns an existing or prospective order, processing is based on Article 6(1)(b) UK GDPR.
We may also rely on our legitimate interests under Article 6(1)(f) UK GDPR in providing effective customer service, resolving complaints, preventing misuse and improving our services.
Affiliated companies within our corporate group and specialised service providers may support us with customer service, CRM, communication infrastructure and related functions.
10.1 AI-assisted customer service
We may use artificial-intelligence tools to assist with processing, categorising and responding to customer-service enquiries.
Depending on the enquiry, relevant communication content, contact information, order information and technical information may be processed through such systems.
Providers supporting these functions are subject to appropriate contractual and data-protection requirements.
Personal data processed through our AI-assisted customer-service functions is not used by us to train general-purpose AI models.
We do not use these systems to make solely automated decisions producing legal or similarly significant effects concerning you.
11. Marketing communications
We may contact you about sendmoments products, services and offers where:
- you have consented to receive such communications; or
- applicable law allows us to contact existing customers about our own similar products or services.
Where electronic marketing is based on the UK soft opt-in, we use it only where the applicable legal requirements are satisfied, including giving you an opportunity to opt out when your contact details are collected and in each subsequent marketing communication.
Where consent is required, the legal basis for processing is Article 6(1)(a) UK GDPR.
Where marketing is lawfully carried out without consent, we may rely on our legitimate interests under Article 6(1)(f) UK GDPR, subject to your rights and the requirements of applicable direct-marketing and electronic-communications legislation.
Marketing communications may include email, SMS, other electronic messaging channels or postal marketing, depending on the services and preferences available.
You may unsubscribe or object to direct marketing at any time using the unsubscribe mechanism provided in the communication or by contacting us.
You have an absolute right to object to the use of your personal data for direct marketing at any time.
12. Reviews, surveys and customer feedback
We may invite customers to provide feedback, participate in surveys or review their experience with us.
Where participation is voluntary, we process the information you choose to provide for the purpose of collecting and analysing feedback and improving our products, services and customer experience.
Depending on the activity, processing may be based on your consent or our legitimate interests in evaluating and improving our services.
Where a third-party review or survey service is used, that provider may also process certain information in accordance with its own privacy information.
13. Cookies, analytics and advertising
Our website uses cookies and similar technologies.
Some technologies are necessary for the website, customer accounts, shopping basket, checkout, security and other services requested by you.
Other technologies may be used for:
- analytics;
- website-performance measurement;
- understanding how visitors use our website;
- advertising and conversion measurement;
- remarketing;
- personalisation; and
- testing and improving website functionality.
Where consent is required under applicable law, these technologies are activated only after you have provided the relevant consent through our consent-management system.
You can manage or withdraw your choices at any time through Cookie Settings.
Our cookie-consent interface provides current information about the relevant providers, purposes, categories and storage periods.
Withdrawing consent does not affect processing carried out lawfully before the withdrawal.
14. Who receives your personal data?
We may disclose personal data where necessary to the following categories of recipients:
- affiliated companies within our corporate group providing CRM, website and platform infrastructure, configurator and account functionality, IT, customer service, production, fulfilment and related administrative services;
- ecommerce and technology service providers;
- payment service providers;
- production and fulfilment providers;
- shipping and delivery providers;
- customer-service and communications providers;
- marketing, analytics and advertising providers, where permitted by law and your consent where required;
- review, survey and customer-feedback providers;
- professional advisers, including lawyers, auditors, insurers and tax advisers; and
- courts, regulators, law-enforcement authorities and other public bodies where disclosure is required or permitted by law.
The precise data-protection role of a recipient depends on the activity concerned.
Where a recipient acts as our processor, it may process personal data only on our instructions and subject to appropriate contractual safeguards.
Certain recipients, including payment providers and some affiliated companies or service providers, may act as independent controllers for particular processing activities where they determine their own purposes and means of processing. Where required, they provide their own privacy information.
15. International transfers
United Arts GmbH is established in Germany, and our services are supported by companies and service providers located in the European Economic Area and other countries.
Personal data may therefore be processed outside the United Kingdom.
Transfers from the United Kingdom to countries covered by UK adequacy regulations, including relevant countries in the European Economic Area, may take place on the basis of those adequacy arrangements.
Where personal data is transferred to a country that is not covered by applicable UK adequacy regulations and the transfer is restricted under the UK GDPR, we use an appropriate transfer mechanism. Depending on the circumstances, this may include:
- the UK International Data Transfer Agreement;
- the UK Addendum to the EU Standard Contractual Clauses;
- the UK Extension to the EU-US Data Privacy Framework, where applicable to an eligible participating US organisation; or
- another safeguard or derogation permitted by applicable data-protection law.
Where the EU GDPR applies to a relevant processing activity, appropriate mechanisms under EU data-protection law may also be used.
Where legally required, we assess whether additional measures are necessary to ensure an appropriate level of protection.
You may contact us for further information about safeguards applicable to relevant international transfers.
16. How long do we keep personal data?
We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, taking into account applicable legal, accounting, tax, contractual and claims-related requirements.
Retention periods depend on the type of information and the relevant purpose.
In particular:
- order, invoice and accounting information is retained for the applicable statutory retention period;
- customer-account information and saved projects may be retained while the account or relevant service remains active, subject to available deletion functions and legal retention requirements;
- uploaded photographs and design content are retained for the period required to provide the relevant account, project, ordering and reordering functions, unless deleted earlier in accordance with the available service functionality or a valid deletion request;
- customer-service records are retained for as long as reasonably necessary to resolve the relevant matter, maintain appropriate service records and establish, exercise or defend legal claims;
- marketing information is retained while the relevant marketing relationship continues and, where necessary, afterwards to document consents, withdrawals, objections and suppression preferences; and
- cookie and tracking information is retained according to the periods stated in our cookie-consent system.
Where personal data is no longer required, it is deleted or anonymised unless continued retention is required or permitted by law.
17. Your data-protection rights
Subject to the conditions and exemptions provided by applicable law, you may have the right to:
- request access to your personal data;
- request correction of inaccurate or incomplete personal data;
- request deletion of your personal data;
- request restriction of processing;
- object to processing based on legitimate interests;
- object at any time to processing for direct marketing;
- receive certain personal data in a structured, commonly used and machine-readable format and exercise your right to data portability;
- withdraw consent at any time where processing is based on consent; and
- exercise rights relating to certain automated decision-making, where applicable.
Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
You can exercise your rights by contacting: data-protection-officer@unitedartsgmbh.com
We may request information reasonably necessary to confirm your identity before acting on a request. We respond to rights requests without undue delay and normally within one month, subject to any extension permitted by applicable law.
Your right to object
Where we process personal data on the basis of our legitimate interests, you have the right to object to that processing in accordance with applicable data-protection law.
Where personal data is processed for direct-marketing purposes, you may object at any time. If you object to direct marketing, we will stop using your personal data for that purpose.
18. Data-protection complaints
If you believe that we have processed your personal data unlawfully or otherwise failed to comply with applicable data-protection law, you may submit a complaint to us at: data-protection-officer@unitedartsgmbh.com
We will acknowledge your data-protection complaint within the period required by applicable law and, in any event where the statutory UK complaints procedure applies, within 30 days. We will take appropriate steps to investigate the complaint, keep you informed as appropriate and communicate the outcome without undue delay.
You also have the right to complain to the Information Commissioner's Office (ICO), the supervisory authority responsible for data protection in the United Kingdom.
You do not have to complain to us before approaching the ICO, although we welcome the opportunity to address your concerns directly.
19. Providing personal data
Certain personal data is necessary for us to enter into or perform a contract with you.
For example, we normally require sufficient contact, order, payment and delivery information to process and fulfil an order.
If required information is not provided, we may be unable to provide the relevant service or complete your order.
Information identified as optional is not required for those purposes.
20. Security
We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
Access to personal data is restricted according to operational requirements and appropriate access controls.
If a personal-data breach occurs, we assess the incident and notify affected individuals and/or the competent supervisory authority where required by applicable law.
21. Changes to this Privacy Policy
We may update this Privacy Policy where necessary to reflect changes to our services, processing activities or applicable law.
The current version will be available on sendmoments.co.uk.
Where a change materially affects how we process your personal data, we will provide additional notice where required by law.