Last updated: 15 February 2026
We, ERM LTD, registered in London, United Kingdom (hereinafter referred to as "we", "us" or "our"), place great importance on your privacy and treat your personal data with care. This privacy policy is intended to inform you about the data we collect when you use our website mypersonalbook.co.uk (hereinafter: "the Website"), place an order or contact us in any other way. We explain how we use this data, how it is stored, with whom it may be shared, and what rights you have in relation to your data. By using our Website, you agree to the terms of this privacy policy.
1. Personal Data Collected
We collect various types of personal data in order to provide and improve our services:
1.1 Data you provide directly
- Contact and account data: Your name, email address, password (encrypted) when you create an account.
- Order data: Information necessary for generating the personalised digital book.
- Personalisation data: The child's name, age, gender, story theme, illustration style and text instructions you enter. Note: please do not enter sensitive medical data or special category personal data in free-text fields.
- Uploaded images: Photographs you upload for personalising the illustrations. These are analysed by our AI systems to generate illustrations that resemble the character.
- Communication data: Data you provide when contacting us by email or other communication channels.
- Payment data: These are not stored directly by us but are processed by our external payment provider. We only receive a confirmation of payment.
1.2 Data collected automatically
When you visit our Website, we may automatically collect certain data through cookies and similar technologies:
- Technical data: IP address, browser type and operating system, device data.
- Usage data: Pages visited, click behaviour, visit duration and interactions on the Website.
2. Purposes of Data Processing
We process your personal data exclusively for the following purposes:
- Creating and managing your account.
- Processing and managing your orders.
- Generating personalised digital children's books using AI technology.
- Verifying text inputs for compliance with our terms and conditions.
- Making digital books (PDF) available for download.
- Communicating with you about your order, answering enquiries or providing customer services.
- Sending service-oriented emails (e.g., order confirmations, notifications when the book is ready).
- Improving our products, services and Website functionality.
- Analysing website usage to optimise user experience.
- Fulfilling legal obligations.
- Preventing fraud and misuse of services.
3. Legal Bases for Processing
We process your personal data on the basis of the following legal grounds (UK GDPR):
- Performance of contract (Article 6(1)(b) UK GDPR): For processing your order, delivering digital products and managing your account.
- Consent (Article 6(1)(a) UK GDPR): For using photographs you upload and specific personalisation data to create children's books. You give this consent when uploading and confirming your choices. You have the right to withdraw your consent at any time.
- Legal obligation (Article 6(1)(c) UK GDPR): For fulfilling our administrative and tax obligations.
- Legitimate interest (Article 6(1)(f) UK GDPR): For fraud prevention, enforcing our terms and conditions, and improving our services.
4. Sharing Personal Data with Third Parties
We do not sell your personal data to third parties. We share your data with third parties only where necessary for the performance of our services:
- Payment providers: For secure processing of your payments.
- Hosting and IT service providers: For hosting the Website and storing data.
- AI technology providers: Specialised parties for generating texts and illustrations through artificial intelligence. Uploaded photographs and text inputs are processed by these systems to create the final product.
- Analytics services: For analysing website usage (anonymised where possible).
- Authorities: Where required by law.
International Transfers
Because we use advanced AI technology, your data (including photographs and instructions) may be processed on servers outside the United Kingdom. We ensure that we work exclusively with parties that provide an adequate level of protection in accordance with UK GDPR, for example through certification under the Data Privacy Framework or approved Standard Contractual Clauses.
5. Retention Periods
We do not retain your personal data longer than strictly necessary:
- Account data: As long as your account is active, or until you request deletion.
- Order data: Minimum 7 years, in accordance with legal retention requirements for tax authorities.
- Personalisation data (photographs and digital books): Uploaded photographs and generated digital books are retained for a maximum of 10 days from creation. After this period, these files are automatically and permanently deleted. You must download the digital book within this timeframe.
- Communication data: Up to 2 years after resolution of your enquiry or complaint.
6. Cookies and Tracking Technologies
We use cookies and similar technologies to analyse Website usage, improve functionality and, with your consent, for marketing purposes. We use the following types of cookies:
- Functional cookies (necessary): These cookies are essential for the proper functioning of the Website. They ensure you can navigate, log in and place orders.
- Analytical cookies: These cookies help us understand how visitors use the Website so we can optimise the experience.
- Marketing cookies: These cookies may be used to track your browsing behaviour. They are only placed after your explicit consent.
On your first visit to our Website, you will be informed via a banner about the use of cookies and asked for your consent. You can change your settings or withdraw your consent at any time.
7. Security of Personal Data
We take the protection of your personal data seriously and take appropriate technical and organisational measures to prevent misuse, loss, unauthorised access, unwanted disclosure and unauthorised modification. This includes the use of encryption (SSL/TLS) for data transmission, secure servers, access controls and regular security updates.
Despite our efforts, we cannot provide an absolute guarantee for the security of data transmitted over the internet. If a data security breach occurs, we will inform you in accordance with our legal obligations.
8. Your Rights
Under the UK General Data Protection Regulation (UK GDPR), you have the following rights:
- Right of access (Article 15 UK GDPR): You have the right to request an overview of the personal data we process about you.
- Right to rectification (Article 16 UK GDPR): If your data is incorrect or incomplete, you have the right to correct or complete it.
- Right to erasure (Article 17 UK GDPR): You have the right to request deletion of your personal data, unless we have a legal obligation to retain it.
- Right to restriction of processing (Article 18 UK GDPR): In certain cases, you have the right to request temporary restriction of processing your data.
- Right to data portability (Article 20 UK GDPR): You have the right to receive your data in a structured, commonly used and machine-readable format.
- Right to object (Article 21 UK GDPR): You have the right to object to the processing of your personal data. You may also object at any time to processing for direct marketing purposes.
If you wish to exercise any of these rights, you can contact us using the contact details below. We will respond to your request within one month.
If you believe that the processing of your personal data infringes data protection legislation, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
9. AI Generation and Image Use
When uploading images for personalising your child's book, you give us explicit permission to process these images through our AI systems. This processing takes place exclusively for generating the ordered product. We and our partners do not use your photographs and entered data to train AI models. Your data remains your property and is used solely for the execution of the order.
10. Children's Data
Our products are intended for children but are ordered by adults. We do not knowingly collect personal data directly from children without the consent of a parent or legal guardian. Children's personal data (such as the name in the book and the uploaded photograph) is processed solely for the purpose of personalising the product, based on the input and consent of the adult buyer. If you suspect that we have collected personal data of a child without the necessary consent, please contact us.
11. Changes to the Privacy Policy
We reserve the right to modify this privacy policy. Changes will be published on our Website. We recommend that you periodically consult this policy to stay informed of any changes. In the event of significant changes, we will actively inform you.
12. Contact Details
If you have questions about this privacy policy, about the processing of your personal data, or if you wish to exercise your rights, you can contact us:
