Privacy Policy of the KEEPMOMENTS® Online Store

Last updated: 15 June 2026

www.keepmoments.uk

1. General provisions, the controller and how to contact us

  1. This Privacy Policy sets out how personal data is processed and protected in connection with the use of the online store available at www.keepmoments.uk (the "Store"), through which we offer bespoke memorial and keepsake jewellery made to order.

  2. The data controller is KEEP MOMENTS LTD, a private company limited by shares incorporated in England and Wales under Companies House registration number 11909402, with its registered office at 167-169 Great Portland Street, 5th Floor, London, W1W 5PF, United Kingdom (the "Controller", "we", "us" or "our").

  3. You can reach us on all data-protection matters using the following details: - e-mail: [email protected] - telephone: +48 731 850 700 - post (registered office): KEEP MOMENTS LTD, 167-169 Great Portland Street, 5th Floor, London, W1W 5PF, United Kingdom - post (operational address, where your consigned material, returns and order handling are processed): KEEP MOMENTS LTD, Wapienna 4A/2, 71-790 Szczecin, Poland.

  4. We process personal data in accordance with the United Kingdom General Data Protection Regulation (the "UK GDPR"), the Data Protection Act 2018 as amended by the Data (Use and Access) Act 2025 (the "DPA 2018"), the Privacy and Electronic Communications Regulations 2003 (the "PECR"), and other applicable data protection law.

  5. We take particular care to protect the interests of the people whose data we process. We make sure that the data we collect is processed lawfully, gathered for specified and legitimate purposes, kept no longer than necessary, and not further processed in a way that is incompatible with those purposes. We are conscious that the data described in this Policy, including material consigned by bereaved customers, is among the most sensitive a person can entrust to anyone, and we handle it accordingly.

  6. We have not appointed a Data Protection Officer. For all matters relating to the processing and protection of personal data, please contact us directly using the details set out in paragraph 3 above.

2. Joint controllership of customer accounts

  1. The Store operates on a shared customer-account system used across several online stores within our group. The same customer account allows you to shop across those group stores without creating a separate account for each one.

  2. Because that shared account system involves stores belonging to different companies, personal data relating to your customer account (including your registration details, login credentials in encrypted form, order history and saved preferences) is jointly controlled within the meaning of the UK GDPR by: - KEEP MOMENTS LTD, Companies House registration number 11909402, registered office 167-169 Great Portland Street, 5th Floor, London, W1W 5PF, United Kingdom; and - MILKIES LTD, Companies House registration number 10195739, registered office 167-169 Great Portland Street, 5th Floor, London, W1W 5PF, United Kingdom.

  3. The essence of this arrangement is as follows. The joint controllers have agreed their respective roles and responsibilities for the shared account data: each is responsible for processing that data lawfully and transparently within its own stores, and together they maintain the shared account infrastructure. The legal basis for the shared account is the performance of the account contract (Art. 6(1)(b) UK GDPR) and our legitimate interest, and that of the other joint controller, in providing a single unified group account (Art. 6(1)(f) UK GDPR). The scope of sharing is limited to the shared group account infrastructure and the account data described above; it does not extend to the content of the consigned material or the special-category data referred to in section 4, which we process as sole controller for the purpose of your order.

  4. You may exercise your data protection rights against either joint controller. Regardless of which store you are dealing with, a single contact point is available to you for exercising those rights and for any question about the joint arrangement: [email protected]. This section is the only part of this Policy in which MILKIES LTD is mentioned; outside the shared customer account, KEEP MOMENTS LTD is the sole controller of the personal data processed through the Store.

3. Categories of personal data we collect

  1. We collect personal data in the following scope: a) data you provide to us: first and last name, e-mail address, telephone number, delivery address and billing address, and, for business customers, a tax identification number; b) order data: information about the ordered piece and its personalisation or engraving, the chosen payment method, and the delivery address; c) account data: if you create an account in the Store, your password (stored in encrypted/hashed form), your order history and your saved preferences; d) consigned-material data: information relating to the material you send to us to be made into your piece, together with the surrounding order context, which may constitute or reveal special-category data as described in section 4; e) automatically collected and behavioural data: IP address, browser type and version, operating system, screen resolution, the pages you visit, the time you spend on the site and your clicks, and information from cookies and the tracking tools described in section 8.

  2. Providing personal data is voluntary. However, the data necessary to fulfil an order is required in order to place and complete that order; without it we cannot accept the order.

4. Special-category data: consigned biological material

  1. We make each piece to order from material that you consign to us by sending it in. That material may include cremation ashes (human or animal), hair or fur, breast milk, flowers or fabric (for example a piece of a wedding dress), or an umbilical cord. We use the term "ashes" with respect, and we refer to any breast milk only factually, as one of the materials a piece may be made from.

  2. Because of the nature of this material and the surrounding order context (which may concern, for example, bereavement, the loss of a child, or a living person's hair or breast milk), we may process information that constitutes or reveals special-category personal data within the meaning of Art. 9 UK GDPR, in particular data concerning health and possibly genetic data of the living customer or of an identifiable living person. A deceased person is not a data subject under the UK GDPR; where special-category data arises, it relates to the living customer and to any identifiable living person.

  3. The legal basis for processing this special-category data is your explicit consent (Art. 9(2)(a) UK GDPR), which you give at the point of placing your order and when you send the material. You may withdraw this consent at any time. Withdrawing your consent does not affect the lawfulness of processing carried out before the withdrawal, but it may make completing your order impossible, because we cannot make the piece without the material and the related information.

5. Handling of consigned material and return of any remainder

  1. We handle every piece of consigned material with the care its irreplaceable nature demands. The material is stored securely; access is restricted to the authorised workshop staff directly involved in making your piece; it is used solely to make the piece you ordered; and it is identified throughout by your order code.

  2. Once your piece is complete, any unused material is returned to you. We destroy unused material only where you instruct us to do so. You may ask us to return or destroy your consigned material at any time by contacting us at [email protected].

We process personal data for the following purposes and on the following legal bases under the UK GDPR:

Purpose Legal basis
Performing the sales contract, including making your piece, contacting you about your order, and handling complaints and returns Art. 6(1)(b) UK GDPR - performance of a contract, or steps taken at your request before entering into a contract
Creating and maintaining your customer account Art. 6(1)(b) UK GDPR - performance of the contract for electronic services
Operating the unified group account and the related sharing of account data between the joint controllers (see section 2) Art. 6(1)(b) UK GDPR (performance of the account contract) and Art. 6(1)(f) UK GDPR (our legitimate interest, and that of the other joint controller, in a single unified group account)
Sending transactional e-mails relating to your order (for example order confirmation, dispatch notification) Art. 6(1)(b) UK GDPR - performance of the contract
Sending the newsletter and marketing communications Art. 6(1)(a) UK GDPR - your consent, which you may withdraw at any time without affecting the lawfulness of processing carried out before the withdrawal
Analytics and advertising through the tools named in section 8 (Google Analytics 4 and Google Tag Manager, Meta Pixel and Conversions API, TikTok Pixel and Events API, Google Ads, Microsoft Clarity) Art. 6(1)(a) UK GDPR - your consent, given through the consent banner; these tools are not operated on the basis of legitimate interest
Login and registration via Google or Facebook (see section 9) Art. 6(1)(b) UK GDPR (performance of the account contract) together with your decision to connect the relevant account
Establishing, exercising or defending legal claims Art. 6(1)(f) UK GDPR - our legitimate interest in protecting our rights
Meeting tax and accounting obligations Art. 6(1)(c) UK GDPR - compliance with a legal obligation to which we are subject
Processing the special-category data described in section 4 (consigned biological material) Art. 9(2)(a) UK GDPR - your explicit consent (see section 4)

We do not carry out solely automated decision-making that produces legal effects concerning you or that similarly significantly affects you within the meaning of Art. 22 UK GDPR. Any product recommendations we show are limited in scope, are based on your purchase history and activity in the Store, do not use special-category data, and you may object to them at any time.

7. Recipients of personal data and international transfers

  1. We share personal data only to the extent necessary to achieve the purposes set out in this Policy, with the following categories of recipients. Each recipient that processes personal data on our behalf is bound by a data-processing agreement requiring an appropriate level of protection.
Recipient Purpose Data location / transfer basis
Our own infrastructure - Medusa application and PostgreSQL database (our own server), Directus content management system, Cloudflare R2 storage and Cloudflare CDN Operating the Store, customer accounts, orders, content and media delivery Hosted within the EU (Cloudflare additionally operates a global edge network)
Stripe Processing of card payments and local payment methods EU and USA; processor bound by EU-US Data Privacy Framework where certified, otherwise Standard Contractual Clauses
Mailchimp / Mandrill (The Rocket Science Group LLC) Transactional and marketing e-mail USA; EU-US Data Privacy Framework / Standard Contractual Clauses
DHL Express Shipping of orders and transport of consigned material Per destination country
Sentry Error monitoring EU region
Google (Google Analytics 4, Google Tag Manager, Google Ads, Google OAuth login) Analytics, advertising and login USA; EU-US Data Privacy Framework / Standard Contractual Clauses
Meta (Meta Pixel, Conversions API, Facebook OAuth login) Advertising and login USA; EU-US Data Privacy Framework / Standard Contractual Clauses
TikTok (TikTok Pixel, Events API) Advertising Transfers outside the United Kingdom and the EEA (Standard Contractual Clauses; EEA, USA, Singapore)
Microsoft Clarity Session recording and heatmaps USA; Standard Contractual Clauses

  1. We may also disclose personal data to public authorities and bodies performing public tasks, to the extent and for the purposes required by applicable law.

  2. We do not sell personal data.

  3. Where a recipient is located outside the United Kingdom, the transfer of UK personal data is made under a transfer mechanism recognised by UK data protection law. This includes the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, an adequacy regulation (data-bridge) where one applies, and other transfer mechanisms recognised under the DPA 2018 and the Data (Use and Access) Act 2025. For the providers listed above that are certified under it, we additionally rely on the EU-US Data Privacy Framework and, where it does not apply, on the EU Standard Contractual Clauses (Art. 46(2)(c)) supplemented as appropriate.

  4. You may obtain a copy of the safeguards we apply to international transfers by contacting us at [email protected].

  1. The Store uses cookies, that is small text files saved on your device (computer, tablet or smartphone) while you use the Store, and similar technologies for storing and reading information on your device.

  2. We use our own consent banner together with Google Consent Mode v2. The banner is shown on your first visit to this domain and blocks all non-essential tags until you make a choice (Consent Mode v2 defaults to "denied"). You can choose between granular categories (necessary, analytics, marketing). Rejecting is as easy as accepting. You may withdraw your consent at any time using the persistent link or icon in the footer of the Store, which reopens your cookie settings. We log your consent as proof. The banner links to the Cookie Policy, which describes each cookie and its duration in detail.

  3. Essential cookies (for example those that operate the shopping cart, the login process and your session) are necessary for the Store to function and are used on the basis of our legitimate interest in providing the Store you have asked to use (Art. 6(1)(f) UK GDPR). All other (non-essential) cookies and tracking tools are used only on the basis of your consent (Art. 6(1)(a) UK GDPR and Regulation 6 PECR).

  4. Subject to your consent, the Store uses the following tools, and no others: a) Google Analytics 4 and Google Tag Manager - analytics and tag management, to understand how the Store is used; b) Meta Pixel and the Conversions API (CAPI) - advertising measurement, operating both in your browser and server-side; c) TikTok Pixel and the Events API - advertising measurement, operating both in your browser and server-side; d) Google Ads - remarketing and conversion measurement; e) Microsoft Clarity - session recording and heatmaps. Clarity records how visitors interact with the Store (for example mouse movements, scrolling and clicks). Given the sensitivity of what our customers do on the Store, Clarity runs only with your consent and is configured to mask sensitive fields, so that the content of forms, personal data, engraving text and any uploads is not captured.

  5. Server-side measurement. Where you have consented to marketing tracking, conversion data is also sent to Meta and TikTok server-side, in addition to browser-side. This server-side measurement is consent-gated in the same way, and identifying data is hashed before transmission.

  6. You can also manage cookies through your browser at any time, including blocking them or deleting cookies already saved. Instructions are available in the settings of the main browsers (for example Google Chrome: Settings then Privacy and security then Cookies; Mozilla Firefox: Settings then Privacy and Security then Cookies and Site Data; Safari: Preferences then Privacy then Cookies; Microsoft Edge: Settings then Privacy, search and services then Cookies). Restricting essential cookies may affect the proper functioning of the Store, including the shopping cart.

9. Login and registration via Google or Facebook

  1. The Store offers the option to log in or register using your Google account or your Facebook account.

  2. If you choose this option, we receive from the relevant provider your e-mail address, your name and a unique identifier, which we use to create or access your account and to log you in. The legal basis is the performance of the account contract (Art. 6(1)(b) UK GDPR) together with your decision to connect the relevant account.

  3. The login process is also governed by the privacy policies of Google and Meta respectively. We recommend that you review those policies before using social login.

10. Retention periods

  1. We keep personal data only for as long as necessary for the purposes for which it was collected, in particular as follows: a) data processed to perform the sales contract is kept for the duration of the contract and afterwards for the period needed to handle complaints and pursue or defend claims, that is up to 6 years under the law of England and Wales (limitation periods in other jurisdictions may be shorter); b) data processed to meet tax and accounting obligations is kept for the statutory retention period under the applicable accounting and tax law, generally 6 years; c) account data is kept for as long as the account exists and, after the account is deleted, only for as long as required by law or until any related claims are time-barred; d) data processed on the basis of consent for the newsletter and marketing communications is kept until you withdraw your consent; e) consent logs are kept as proof for the relevant limitation period, up to 6 years after the consent ends; f) data processed on the basis of our legitimate interest (analytics and the establishment or defence of claims) is kept until you effectively object or until the purpose ceases; g) automatically collected server logs are kept for no longer than 12 months; h) tracking cookies and the tools described in section 8 are kept for the durations stated in the Cookie Policy; i) consigned material is kept only for as long as needed to fulfil your order, after which any unused remainder is returned to you (or destroyed on your instruction), as described in section 5.

11. Your rights

  1. You have the following rights in relation to your personal data under the UK GDPR: a) the right of access to your data and to receive a copy of it (Art. 15); b) the right to rectification of inaccurate data (Art. 16); c) the right to erasure, the so-called "right to be forgotten" (Art. 17); d) the right to restriction of processing (Art. 18); e) the right to data portability (Art. 20); f) the right to object to processing, including profiling (Art. 21); g) the right to withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal (Art. 7(3)).

  2. To exercise these rights, contact us by e-mail at [email protected] or by post to KEEP MOMENTS LTD, Wapienna 4A/2, 71-790 Szczecin, Poland. As explained in section 2, where your customer account is concerned you may exercise these rights against either joint controller, using the same single contact point.

  3. We will respond to your request without undue delay and in any event within one month of receiving it. For particularly complex requests or where we receive a large number of requests, this period may be extended by a further two months, in which case we will tell you within one month of receiving your request.

12. Complaints to us and to the supervisory authority

  1. If you are dissatisfied with how we have handled your personal data or responded to a request, you have the right to complain directly to us before involving the regulator. You can make a data protection complaint to us by e-mail at [email protected] or by post to either address in section 1. We will acknowledge your complaint, investigate it, and tell you the outcome. This direct complaint channel is provided in accordance with the Data (Use and Access) Act 2025.

  2. You also have the right to lodge a complaint with the supervisory authority. In the United Kingdom this is the Information Commissioner's Office (the Information Commission), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom, www.ico.org.uk. Making a complaint to us first does not remove or limit your right to complain to the Information Commissioner's Office.

13. Security of personal data

  1. We apply appropriate technical and organisational measures to keep personal data secure, in proportion to the level of risk, in particular: a) encryption of the connection using TLS (Transport Layer Security); b) restricting access to personal data to authorised persons who need it to perform their tasks; c) regular backups; d) server hardening, firewalls, and intrusion detection and prevention.

  2. We regularly review the measures we apply to make sure they remain appropriate to current threats.

  3. If a personal data breach is likely to result in a risk to people's rights and freedoms, we will notify the Information Commissioner's Office without undue delay and, where feasible, within 72 hours of becoming aware of it (Art. 33 UK GDPR). Where the breach is likely to result in a high risk to affected individuals, we will also notify them without undue delay (Art. 34 UK GDPR).

14. Children

The Store is not directed at children. We do not knowingly collect personal data from children, and we treat 13 as the minimum age at which a child may consent to information society services in the United Kingdom (Art. 8 UK GDPR / DPA 2018). If we become aware that we have collected a child's personal data without appropriate parental consent, we will delete it without undue delay.

15. Changes to this Policy

  1. We may update this Privacy Policy where the law, our processing, or the technology we use changes.

  2. We will publish any updated version on the Store's website and, where a change is material and it is appropriate to do so, we will notify the e-mail address associated with your account.

  3. Where consent is the legal basis for processing and a change affects that processing, we will ask for your consent again.

16. Final provisions

  1. In matters not covered by this Privacy Policy, the UK GDPR, the DPA 2018, the PECR and other applicable data protection law apply.

  2. This Privacy Policy supplements the Terms and Conditions of the KEEPMOMENTS Online Store.

  3. Controller and seller identity:

KEEP MOMENTS LTD Private company limited by shares, incorporated in England and Wales Companies House registration number: 11909402 Registered office: 167-169 Great Portland Street, 5th Floor, London, W1W 5PF, United Kingdom Operational address (returns and handling of consigned material): Wapienna 4A/2, 71-790 Szczecin, Poland E-mail: [email protected] Telephone: +48 731 850 700

Last updated: 15 June 2026