Privacy policy
We respect the personal information you share when browsing Picsme, creating a photo gift, opening an account or placing an order. This notice explains what we use, why we use it, who helps us provide the service and the choices you have.
Who is responsible for your information?
Picsme is a trading name of ESP Colour Limited, company number 03513763. We are the controller of the personal information we use for the purposes described here. Our address is Millbuck Close, Elgin Drive, Swindon, Wiltshire, SN2 8XU.
Our Data Protection Manager is Simon Smogur. Contact hi@picsme.co.uk with a privacy question or request. We handle personal information under the UK GDPR, the Data Protection Act 2018 and other applicable privacy law.
Information we collect
- Account and contact information: your name, email address, telephone number, delivery and billing addresses, account identifiers and preferences.
- Photographs and designs: images, captions, dates and other content you choose to upload or include in a personalised product.
- Orders and payments: products, quantities, prices, payment status, delivery information, discounts, refunds and order history. Payment providers process the payment details needed to take your payment.
- Support and feedback: enquiries, correspondence, reviews and information you choose to send us.
- Technical and usage information: IP address, browser and device information, pages visited, shopping actions, referral information, cookie identifiers and consent preferences.
We receive information directly from you, from your use of the website and from services that help process payments, deliver orders, host our store or provide the features you use. If necessary information is missing, we may be unable to complete an order or provide the requested feature.
Your photographs and imported images
We use photographs and design content to provide the editor, prepare and produce your personalised products, and provide relevant support. Our design and production services, including Mediaclip, process the content needed to provide these functions.
If an import service is available in the editor, you choose whether to connect it and which content to use. Its authorisation screen explains the access requested. You can instead upload files directly from your device.
Our use and transfer of information received from Google APIs must comply with the Google API Services User Data Policy, including its Limited Use requirements. Google Photos content is not used for advertising. You can manage an authorised Google connection through your Google account.
Photographs may include other people, including children, or reveal sensitive details. Only upload content you are entitled to use and share for the requested product. Do not include unnecessary sensitive information in captions, filenames or support messages.
Why we use information
| Purpose | Information used | Lawful basis |
|---|---|---|
| Accounts, product design and orders | Contact details, account identifiers, uploaded photographs and designs, order and payment information. | Performance of our contract with you, including steps you request before ordering. |
| Delivery and customer support | Order details, delivery address, contact details and relevant correspondence. | Performance of our contract; legitimate interests in resolving enquiries and complaints. |
| Security and business records | Technical logs, transaction records and information needed to prevent fraud or meet accounting duties. | Legitimate interests in securing our service; legal obligations where applicable. |
| Optional analytics and advertising measurement | Website events, browser information and, for the OpenAI pixel where available, hashed matching identifiers. | Consent where required for the tracking technology or personal-data processing. You can change your cookie preferences. |
| Email offers | Email address, marketing preferences and relevant purchase history. | Consent, or the permitted existing-customer exception for our own similar products where its conditions are met. You can opt out at any time. |
| Reviews and feedback | Relevant order details, contact details and feedback you choose to provide. | Legitimate interests in obtaining feedback and improving our service; consent where required. |
Where we rely on legitimate interests, we consider your rights and interests. Where we rely on consent, you can withdraw it without affecting the lawfulness of processing carried out before withdrawal.
Cookies, analytics and advertising
Our store uses Shopify and configured services including Google, Judge.me and the OpenAI Ads Measurement Pixel. These services can process technical information and shopping events for their respective analytics, review or advertising-measurement purposes. See our cookie notice for details and controls.
The OpenAI pixel measures page and product views, additions to the basket, checkout starts and completed orders. The event information can include product identifiers and names, quantities, order value and currency, an order or event identifier, page origin and an advertising referral identifier.
When available and permitted by the visitor's privacy choices, our pixel code converts an email address and customer identifier into SHA-256 hashes before sending them to OpenAI for matching. A hash is a coded identifier: it is still personal data where it can be matched to a person, and is not anonymous. Our configured event payload does not include uploaded photographs or the content of your photo book designs.
The OpenAI custom pixel is configured to require Shopify's analytics, marketing and data-sharing permissions. Refusing or withdrawing those permissions prevents it from sending further measurement events. Essential order processing continues independently.
Who we share information with
- Shopify: hosting, checkout, customer accounts, store operation and related services. Read the Shopify Consumer Privacy Policy.
- Design, production, payment and delivery providers: information needed to create products, process payments, fulfil orders and provide support. This includes the Mediaclip editor integration.
- Review and analytics services: relevant information for services such as Judge.me and Google, subject to applicable permissions.
- OpenAI: permitted advertising measurement events and matching identifiers described above. Read OpenAI's Privacy Policy.
- Professional advisers, authorities or business successors: where necessary to meet legal obligations, handle claims or carry out a lawful business transfer.
We limit sharing to information needed for the relevant purpose. Providers may process information on our instructions or, for their own stated services and purposes, as separate controllers under their privacy notices. Following a link to Trustpilot, Google or another external service takes you to a service with its own privacy practices.
Marketing choices
You can unsubscribe using the link in our marketing emails or contact hi@picsme.co.uk. Withdrawing marketing permission does not stop essential messages about an order, payment, delivery or account security. Cookie and advertising preferences are separate from email subscriptions.
We only send electronic marketing where you have consented or where an applicable existing-customer exception permits it. For that exception, we offer an opt-out when collecting the details and in each message.
How long we keep information
We retain personal information only for as long as needed for the relevant service and our legal, accounting, security and dispute-handling obligations. We normally retain basic customer and transaction records for six years after the customer relationship ends for tax and record-keeping purposes. A complaint or legal claim may require longer retention.
Photographs and saved designs are considered separately from financial records. Their retention depends on the editor and storage service, whether the project is needed for production or support, and any deletion request or legal obligation. Contact hi@picsme.co.uk to ask about a particular project or request deletion.
Session cookies normally end with the browser session. Persistent cookies remain until expiry or deletion. See our cookie notice and linked provider information.
Security and international processing
We use organisational and technical measures to protect information, limit access to people and providers who need it, and investigate suspected security incidents. We notify affected people and regulators where the law requires us to.
Our UK operation uses service providers that may process data outside the UK. Where a restricted international transfer occurs, the required safeguards must be in place, such as an applicable adequacy arrangement or approved contractual protections, with additional safeguards where necessary. Contact us for information about the safeguards relevant to your data.
Your rights
Depending on the circumstances, you can request access, correction, deletion, restriction or transfer of your personal information. You can object to processing based on legitimate interests and to direct marketing, and withdraw consent where we rely on it.
Email hi@picsme.co.uk to exercise a right. You do not have to use a special form. We may need proportionate information to confirm your identity. Access requests are normally free and answered within one month; lawful extensions or exceptions may apply, which we will explain.
You can complain directly to the Information Commissioner's Office. You are also welcome to contact us first so we can try to resolve your concern.
Changes to this notice
We update this notice when our services or data practices change. Please check this page for the current version and contact us if you need an explanation of a change.