Privacy Policy

1. Who we are

GiftTrax is operated by Third Eye Lab Ltd.

In this Privacy Policy, “GiftTrax”, “we”, “us” or “our” means Third Eye Lab Ltd as the operator of the GiftTrax website and services.

Third Eye Lab Ltd is responsible for deciding how personal data is used for the purposes described in this Privacy Policy.

Third Eye Lab Ltd, trading as GiftTrax, is registered with the Information Commissioner’s Office as a data controller.

2. Information we collect

Depending on how you use GiftTrax, we may collect and process the following types of personal data.

2.1 Contact details

This may include:

• your name;
• email address;
• telephone number where provided;
• billing address;
• delivery address; and
• other contact information you choose to provide.

2.2 Order and transaction information

This may include:

• the collection, package or product you order;
• selected add-ons, such as Priority Production, companion songs or framed keepsakes;
• payment status;
• order history;
• delivery details;
• order notes;
• customer service messages; and
• related communications.

2.3 Personal content you submit for a commission

Because GiftTrax creates personalised songs and keepsakes, you may provide information such as:

• names;
• relationships;
• dates;
• occasions;
• stories;
• personal memories;
• messages;
• musical preferences;
• vocal preferences;
• lyric direction;
• pronunciation guidance;
• reference songs, artists or styles;
• event details;
• family details;
• tribute information;
• photographs; and
• any other information you choose to include in your order brief.

2.4 Photographs and uploaded images

Where you upload photographs for a framed keepsake, printed item, tribute, children’s song, family gift or other personalised product, those images may include personal data, especially where individuals are identifiable.

Uploaded images may include photographs of:

• children;
• parents, grandparents or family members;
• wedding couples;
• memorial or remembrance subjects;
• friends or recipients of a gift;
• other identifiable people connected to the commission.

2.5 Technical and usage data

When you use our website, we may collect technical information such as:

• IP address;
• browser type;
• device type;
• operating system;
• pages viewed;
• referral source;
• website interactions;
• approximate location based on technical data;
• cookie identifiers; and
• server log information.

This may be collected through our website, analytics tools, server logs or cookie technologies, depending on the live website setup and your cookie choices.

2.6 Marketing preferences

This may include:

• whether you have opted in to receive marketing emails;
• whether you have unsubscribed;
• your communication preferences; and
• your interaction with marketing emails where email analytics are used.

2.7 Customer service records

This may include:

• enquiries;
• support requests;
• complaints;
• correspondence;
• feedback; and
• notes relating to your order or customer relationship.

2.8 Sensitive information

We do not normally need special category personal data for standard GiftTrax orders.

However, some commissions may naturally involve sensitive or emotional information, especially remembrance, memorial, tribute, family or deeply personal commissions.

Please do not send sensitive personal information unless it is genuinely necessary and relevant to your request.

3. Information About Other People

Because GiftTrax songs are often created for or about other people, you may provide personal information about someone else.

This may include:

• the name of a recipient;
• family relationships;
• stories or memories;
• photographs;
• event details;
• personal messages;
• details about children;
• details about a loved one who has passed away;
• details about wedding parties, family members or friends.

Where you provide information about another person, you confirm that you have the right and permission to share that information with us for the purposes of the commission.

You should not provide information, images or stories about another person if doing so would breach their privacy, confidentiality, intellectual property rights or any other rights.

4. Children’s Information and Images

GiftTrax products may be purchased for children or may include information about children where this is provided by a parent, guardian or other adult placing an order.

Children’s information may include:

• a child’s name;
• age or birthday;
• favourite things;
• family relationships;
• personality details;
• stories;
• photographs;
• messages from parents or relatives; and
• other details submitted as part of the order brief.

We do not knowingly provide a general consumer ordering service directly to children without adult involvement.

Where you provide information or photographs relating to a child, you confirm that:

• you are the child’s parent or guardian, or you have appropriate permission from the child’s parent or guardian;
• you have the authority to provide the information or image to us;
• the information is suitable for use in the order; and
• the image or information does not infringe the rights, privacy or safety of the child or any other person.

We treat children’s information and images with particular care.

We will not use children’s images, children’s names, children’s songs, private family stories or identifiable children’s commission details for marketing without appropriate permission.

5. Remembrance and Sensitive Commissions

GiftTrax may create remembrance songs, memorial tributes and other sensitive commissions.

These may involve personal information about someone who has passed away, family relationships, emotional stories, funeral or memorial details, photographs, personal messages and other sensitive material.

We will handle remembrance and sensitive commission information with care, discretion and professionalism.

Where you provide remembrance or memorial information, you confirm that:

• you have the right and permission to provide the information and images;
• the material is suitable for the intended commission;
• you have considered the privacy and feelings of relevant family members or recipients; and
• the information does not infringe another person’s rights.

We will not use memorial songs, remembrance stories, sensitive tribute material, uploaded memorial images or identifiable remembrance commission details for marketing without permission.

6. How We Use Your Information

We may use your personal data to:

• respond to enquiries;
• process orders;
• take payment and manage payment status;
• administer customer accounts where applicable;
• create personalised songs, lyrics, productions and related products;
• create framed keepsakes, printed lyrics or photo-based items where ordered;
• understand your creative brief;
• communicate with you about your order;
• request missing information or clarify details;
• provide lyric reviews where included;
• deliver digital files;
• arrange delivery of physical products where applicable;
• handle customer service issues, complaints or follow-up queries;
• maintain internal business records;
• comply with accounting, tax and legal obligations;
• improve our website, services, products and customer experience;
• manage website security and prevent misuse;
• prevent fraud;
• enforce our Terms and Conditions;
• send marketing communications where permitted by law;
• manage cookie preferences and website analytics; and
• protect our legal rights and legitimate business interests.

7. Lawful Bases for Processing

Under UK GDPR, we rely on one or more lawful bases depending on the context.

7.1 Contract

We process personal data where it is necessary to take steps at your request or to perform a contract with you.

This includes:

• processing your order;
• creating your personalised song;
• producing lyrics and music;
• preparing framed keepsakes or printed items;
• communicating with you about the commission;
• delivering digital or physical products; and
• providing customer support relating to your order.

7.2 Legitimate interests

We may process personal data where it is necessary for our legitimate business interests, provided those interests are not overridden by your rights and interests.

This may include:

• responding to enquiries;
• managing customer relationships;
• improving our services;
• keeping appropriate business records;
• preventing fraud;
• protecting website security;
• handling complaints;
• resolving disputes;
• protecting our legal rights;
• requesting reviews or feedback;
• maintaining internal administration; and
• limited business-to-customer communication where permitted by law.

7.3 Legal obligation

We may process personal data where necessary to comply with legal or regulatory obligations.

This may include:

• accounting records;
• tax records;
• company records;
• compliance with lawful requests;
• fraud prevention obligations; and
• responding to regulators, courts or authorities where legally required.

7.4 Consent

We rely on consent where required, such as for:

• certain marketing communications;
• non-essential cookies;
• use of identifiable customer content for promotional purposes where permission is requested;
• certain uses of uploaded images, testimonials or commission excerpts outside normal order fulfilment.

Where we rely on consent, you may withdraw that consent at any time.

Withdrawing consent will not affect the lawfulness of processing carried out before consent was withdrawn.

8. Image Uploads and Framed Keepsakes

Where you upload photographs or images for a framed keepsake, printed item, lyric display, tribute product or other personalised item, we will use those images for the purpose of creating and fulfilling your order.

Uploaded images may be used to:

• prepare design layouts;
• create framed keepsakes;
• create printed lyric or photo-based products;
• check suitability for production;
• communicate with you about image quality or layout issues;
• fulfil the order; and
• deal with customer service queries relating to the item.

You are responsible for ensuring that:

• you have permission to upload the image;
• you have the right to allow us to use it for the order;
• the image does not infringe copyright, privacy or any other rights;
• the image is suitable for the intended product;
• the image is of sufficient quality and resolution;
• any people shown in the image have been considered appropriately; and
• where the image includes a child, you have parental or guardian authority, or appropriate permission.

We will not use uploaded photographs, children’s images, family photographs, memorial images or private commission images for marketing without permission.

For framed keepsakes and printed items, we may need to share relevant images, names, wording or delivery details with trusted production, printing, framing or fulfilment providers where necessary to complete your order.

9. Marketing

We may send marketing communications where you have consented or where we are otherwise permitted to do so by law.

You can unsubscribe from marketing emails at any time by using the unsubscribe link in the email or by contacting us.

We will not sell your personal data.

We will not use your full song, personal story, private information, uploaded images, children’s images, memorial material or identifiable commission details for marketing without your permission.

Where we would like to use a testimonial, review, excerpt, anonymised story, image, video, audio sample or other customer content for marketing, website, portfolio or social media purposes, we will ask for permission where required.

If you prefer your commission to remain entirely private, you can tell us.

10. Sharing Your Information

We may share personal data with trusted service providers where necessary for the operation of our business, website and services.

Depending on the live site setup, these may include:

• payment processors and payment service providers, including CanDo / Elavon;
• website hosting providers;
• website platform providers;
• content delivery, security and backup providers;
• website form providers;
• email communication providers;
• customer support tools;
• analytics providers, such as Google Analytics if used;
• email marketing providers, such as Mailchimp or similar if used;
• printing, framing, fulfilment or delivery providers where physical products are ordered;
• cloud storage or file transfer providers;
• professional advisers, including accountants, legal advisers and insurers;
• regulators, law enforcement, courts or public authorities where required by law or necessary to protect our rights.

Where third-party processors act on our behalf, they are expected to process personal data only on appropriate instructions and with suitable safeguards.

We do not sell your personal data.

11. International Transfers

Some of our service providers may process personal data outside the UK.

Where this happens, we will take reasonable steps to ensure that your personal data remains protected and is handled in accordance with applicable data protection law.

This may include relying on:

• UK adequacy regulations;
• standard contractual clauses;
• international data transfer agreements;
• transfer risk assessments; or
• other lawful transfer mechanisms where appropriate.

12. Data Retention

We keep personal data only for as long as reasonably necessary for the purposes set out in this Privacy Policy.

Retention periods may vary depending on the type of information, the reason we hold it and whether we need to keep it for legal, accounting, tax, customer service or dispute-resolution purposes.

Our current intended retention approach is as follows.

12.1 Order, billing and transaction records

Order, billing and transaction records may be kept for up to 6 years after the end of the relevant financial year to support accounting, tax, legal and business record requirements.

12.2 Customer correspondence

Customer correspondence may be kept for up to 6 years where reasonably necessary to manage the customer relationship, resolve disputes, respond to complaints or protect our legal rights.

12.3 Order briefs and personal commission information

Order briefs, stories, names, lyric direction, pronunciation notes, preferences and other commission information may be kept for up to 3 years after completion of the order, unless we need to keep it longer for legal, complaint, accounting or dispute-resolution reasons.

12.4 Uploaded photographs and images

Uploaded photographs and images used for framed keepsakes, printed items or personalised commissions will usually be kept only for as long as reasonably necessary to fulfil the order and deal with follow-up customer service queries.

As a general approach, uploaded images may be kept for up to 12 months after order completion, unless:

• you ask us to delete them earlier and we no longer need them;
• we need them to resolve a query, complaint or dispute;
• we are legally required to retain them;
• they form part of a record we need to keep for legitimate business reasons; or
• you have given permission for a longer use, such as approved promotional use.

12.5 Audio files, lyrics and production files

Final audio files, lyrics, project files, drafts and production materials may be kept for up to 3 years after order completion so that we can manage customer service queries, technical issues, repeat requests, related orders or reasonable follow-up support.

Some internal production materials may be deleted earlier where no longer required.

12.6 Marketing data

Marketing data may be kept until you unsubscribe, withdraw consent, object to marketing, or we decide to remove inactive contacts from our marketing records.

We may keep a limited suppression record to ensure we do not contact you again after you unsubscribe.

12.7 Website analytics and cookie data

Cookie-related and analytics information will be kept in line with the durations stated in our Cookie Policy, cookie banner or relevant analytics platform settings.

12.8 Legal claims and disputes

Where there is a complaint, dispute, unpaid amount, legal claim, regulatory issue or potential claim, we may keep relevant information for longer where necessary to protect our rights or comply with legal obligations.

13. Your Rights

Depending on the circumstances, you may have the right to:

• request access to the personal data we hold about you;
• ask us to correct inaccurate or incomplete personal data;
• ask us to erase your personal data in certain circumstances;
• ask us to restrict the way we use your personal data in certain circumstances;
• object to processing carried out on the basis of legitimate interests;
• withdraw consent at any time where we rely on consent;
• request a copy of certain personal data in a portable format where applicable;
• object to direct marketing;
• complain to the UK Information Commissioner’s Office if you believe your data protection rights have been breached.

If you would like to exercise any of these rights, please contact us using the details at the end of this Privacy Policy.

We may need to verify your identity before responding to a request.

Some rights are not absolute and may be subject to legal limitations. For example, we may need to keep certain information for accounting, legal, dispute-resolution or legitimate business reasons.

You also have the right to complain to the Information Commissioner’s Office, the UK regulator for data protection matters.

ICO website: ico.org.uk

14. Cookies

Our website may use cookies and similar technologies for essential website functions and, where permitted, for analytics, functionality, performance and marketing.

Essential cookies may be required for the website to work properly.

Non-essential cookies should not be set unless you have given the appropriate consent through our cookie banner or preference tool.

For more detailed information, including the cookies we use, why we use them, how long they last and how to manage your choices, please see our Cookie Policy.

15. Security

We take reasonable technical and organisational measures to help protect personal data against unauthorised access, loss, misuse, alteration or disclosure.

These measures may include, where appropriate:

• access controls;
• password protection;
• secure systems and platforms;
• limited access to customer information;
• appropriate supplier selection;
• secure storage practices;
• backups;
• staff or contractor confidentiality expectations; and
• deletion or disposal of data when no longer required.

However, no system, website, email service or online transmission can be guaranteed to be completely secure.

You are responsible for ensuring that any information you send to us is accurate and that you use appropriate care when communicating online.

16. Payment Information

Payments are processed by our third-party payment provider, CanDo / Elavon.

We do not usually store full card details on our own systems.

CanDo / Elavon may process payment information in accordance with their own terms, privacy policies and applicable payment security requirements.

We may receive limited payment-related information such as:

• payment status;
• transaction reference;
• amount paid;
• billing details;
• payment date;
• refund status where applicable; and
• fraud prevention or verification information where relevant.

17. Third-party Links

Our website may include links to third-party websites, platforms, payment providers, social media pages or other external services.

We are not responsible for the privacy practices, content or security of third-party websites.

You should review the privacy policies of any third-party services you use.

18. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes to our business, services, website features, legal requirements or data practices.

The latest version will always be posted on this page.

Last updated: 29 June 2026

19. Contact us

If you have any questions about this Privacy Policy or the way we handle personal data, please contact us using the details below.