Privacy Policy

Profile Studio · Privacy Policy · v1.0 · Effective 8 October 2026

1. Introduction & scope

1.1 This Privacy Policy explains how DIGIMACIS LTD, trading as Profile Studio, collects and handles personal data when you visit profile-studio.com, open an Account, order ready-made downloadable avatars, commission bespoke artwork, contact support or subscribe to creator updates. It also explains your rights and the contact route for exercising them. It applies to customers, prospective customers and Website visitors.

1.2 We process customer data to operate an online digital-artwork service and are accountable for doing so fairly, securely and transparently. Personal information is not sold as an item of commerce. The policy distinguishes essential account/order communications from optional newsletters and consent-based advertising or tracking. Links to third-party sites and independently administered payment screens may involve separate privacy notices.

2. Data controller & contact

2.1 The controller responsible for Profile Studio's merchant-operated activities is DIGIMACIS LTD, company number 17503974, registered office 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ. For privacy, access, correction, deletion, marketing and data-protection complaints, write to info@profile-studio.com. Please use a subject line such as 'Privacy rights request' so your inquiry is routed appropriately.

2.2 Some payment networks, card issuers and regulated payment service providers independently determine how they process information for authorisation, anti-fraud and legal obligations. They may act as separate controllers for those activities. We take reasonable steps to explain relevant data sharing and address customer requests concerning the information under our control, while directing independent-controller requests to the correct organisation where necessary.

3. Age position

3.1 Profile Studio is intended for adults aged 18 or older. We do not market avatar orders or invite the submission of custom portrait reference materials from children. Customers should not create accounts on behalf of minors or place orders using a minor's personal data where the relevant permissions and a lawful basis are absent. A parent or guardian may contact us if a child's data appears in an uploaded submission.

3.2 If we learn that an Account was created in breach of the age requirement, we may restrict it, investigate related payments and remove personal information no longer required. We may preserve limited transaction, safety or legal records where necessary and lawful. Requests involving another person's image are checked for authority and relevant rights before we disclose or erase customer information.

4. Categories of personal data

4.1 We process information appropriate to the interaction: identity and contact fields (name, email and account credentials); purchase and entitlement records (order, item, amount and payment status); technical information (browser, network identifiers and diagnostics); communications (tickets and newsletter preferences); and commissioned-work material (brief text, uploaded references and artist feedback). Payment-card credentials are collected in the payment provider's controlled processing flow rather than through a request to email full card details.

4.2 The table below connects these categories to where they arise and why they are processed. A custom reference picture may include someone else's personal image; provide it only where you are authorised and avoid revealing sensitive characteristics unless they are genuinely required for a lawful request. Billing information may be needed for taxes or fraud checks although physical shipment is not offered.

5. Sources of personal data

5.1 Most information comes directly from you, such as account registration, the order form, custom-art instructions, a contact message or a newsletter sign-up. We also receive technical information from your device when the Website operates, and payment outcomes, fraud indicators or transaction identifiers from checkout processors so that we can decide whether an Order is paid and ready for electronic fulfilment.

5.2 Limited additional data may arise from our legitimate operational inquiries: a customer reporting infringement, a platform provider investigating abuse or a payment institution querying a disputed transaction. We assess reliability and relevance before using such information; a third-party allegation alone is not proof of misconduct. We avoid combining unrelated datasets simply because the technology makes doing so possible.

6. How we use personal data

6.1 We use personal information to create and secure Accounts, display order history, process checkout status, send downloadable files, manage bespoke creative briefs, provide technical and customer support, investigate payment disputes and maintain accurate business records. Communications required to supply your purchase, respond to a complaint or protect your Account are service messages rather than marketing.

6.2 We may use aggregated performance statistics to improve navigation and delivery, and may offer opted-in announcements about new creators, styles and avatar collections. Personalised advertising and non-essential storage technologies are subject to applicable consent requirements or another narrow lawful exemption. Creative submissions are used for the Order and related legitimate operational matters, not to grant unrelated third parties a free-standing right to exploit your likeness.

7. Lawful bases for processing

7.1 Where the UK GDPR applies, different activities rely on different lawful bases: contractual necessity for purchases and digital delivery; legal obligations for relevant records and requests; legitimate interests for proportionate security, fraud prevention and customer-service improvements; and consent for optional marketing or tracking that requires it. We do not treat consent as the default basis for unavoidable performance of an agreed Order.

7.2 Legitimate interests are evaluated against customer rights and expectations. You may object to processing based on such interests, and we will assess the objection under applicable law. If you withdraw consent, future optional processing stops, subject to lawfully retained suppression or compliance information. The following table sets out the operational mapping used for Profile Studio.

8. Payments & checkout

8.1 When you place an Order, a specialised payment service provider and participating banks process the information necessary to authorise, authenticate, capture or refund funds. The checkout may request cardholder and billing details, use fraud screening and apply bank authentication such as 3-D Secure. We use the resulting order identifier, transaction status, masked payment information where provided, currency and amount to reconcile delivery and support requests.

8.2 Do not send full card numbers, card verification codes or payment passwords by email or through custom-brief uploads. We do not need those details to investigate a merchant transaction. A processor may independently retain payment data to meet card-network and regulatory duties; its separate privacy terms should be consulted where relevant. We may share necessary evidence of fulfilment with payment institutions to handle a legitimate retrieval or chargeback.

9. Cookies & similar technologies

9.1 The Website uses essential storage to maintain browsing sessions, preferences, order status, fraud controls and consent choices, and may use attribution, statistical and promotional technologies subject to the legal rules that apply to their particular purposes. Cookies and browser storage may contain an online identifier associated with a visit; they can therefore constitute personal data when linked to an identifiable visitor.

9.2 The Cookie Policy identifies categories and listed technology names, explains how to reject or revise optional permissions and distinguishes exempt essential activity from uses requiring consent or a valid statutory exception. You can use the Website preference interface, browser settings and other objection mechanisms made available for qualifying statistical or appearance purposes. Disabling essential site functions may prevent orders or Accounts from working correctly.

10. Sharing of personal data

10.1 Information may be shared with hosting and infrastructure suppliers, website-commerce and delivery vendors, commissioned artists engaged to fulfil your Order, customer-support systems, email delivery services, payment service providers and advisers who need appropriate access. Such access is limited by role, contract and security measures where we act as controller and they act as processors. We do not provide artist reference images for unrelated promotional exploitation without a separate legal basis.

10.2 We may disclose information where law requires it, to respond proportionately to allegations of intellectual-property infringement, to investigate serious abuse or fraud, or as part of a lawful corporate transaction accompanied by appropriate protection. Payment institutions may receive limited order/fulfilment logs. We assess whether sharing is necessary; inclusion in an internal business system does not authorise unlimited access to a customer's identity or creative files.

11. International transfers

11.1 Profile Studio operates from the United Kingdom but hosting, technical support, artist collaboration and payment infrastructure may involve processing outside the UK. Where a restricted transfer of UK personal data occurs, we use a legally recognised safeguard, such as a UK adequacy regulation or an appropriate transfer agreement and risk assessment, where required. We aim to restrict remote access to the minimum information necessary for the service.

11.2 A customer's use of an international payment network or social media platform may involve that platform's independent transfers under its own notices. If a vendor changes processing location, we reassess the nature of the transfer and associated contractual security terms. You may request further information about applicable safeguards at info@profile-studio.com, subject to security, confidentiality and other lawful limitations.

12. Data retention

12.1 We retain information only for the period needed for the relevant purpose, subject to statutory accounting, consumer, complaint, fraud, limitation and security requirements. An Account's closure does not automatically erase transaction records needed to establish a payment, resolve a dispute or comply with applicable law. Conversely, original uploaded images and incomplete creative briefs should not be preserved indefinitely merely because technical storage is available.

12.2 The following periods are Profile Studio's retention rules. A shorter or longer period may be required for a specific legal hold, active claim, statutory requirement or authorised user request; in such cases the relevant record is restricted and reviewed. Backups rotate under the service's retention controls. Retention may be measured from the last interaction, order settlement, closure or end of the relevant accounting period as specified below.

13. Data security

13.1 We apply proportionate organisational and technical measures such as access controls, encrypted transmission, least-privilege access, logging, controlled supplier permissions and secure backups. Staff and creators working on bespoke artwork receive only the reference information reasonably required to execute the specific project. Accounts should use strong unique passwords and should not share credentials across unrelated websites.

13.2 No online environment is guaranteed immune from mistakes or attack. If a data-security incident occurs, we assess its likely impact, take reasonable containment steps and provide notices to authorities or affected people where required by law. Reporting a suspicious Account event early helps reduce harm. We will not ask you to send payment verification codes or passwords to customer service.

14. Your privacy rights

14.1 Subject to UK GDPR conditions and exemptions, you may request access to personal data, correction of inaccurate information, erasure in appropriate circumstances, restriction of processing, data portability for applicable automated information, and objection to certain processing. You may withdraw consent at any time without affecting past lawful processing; you may also object to direct marketing without having to explain why.

14.2 Send a rights request to info@profile-studio.com, describing the account or contact email and the action sought. We may perform proportionate identity checks before releasing information and ordinarily respond within one month, subject to extensions or limits permitted by law. You may complain to the UK Information Commissioner's Office (ICO) or another competent regulator; contacting us first is welcomed but not a condition of that right.

15. Marketing communications

15.1 Signing up for creator updates is distinct from creating an Account or purchasing artwork. Where prior consent is required, newsletters and promotional emails are sent only after a valid opt-in; every marketing email provides an unsubscribe mechanism. Transaction confirmations, account recovery messages, fraud notices and replies to your questions are operational and may continue when marketing messages are stopped.

15.2 We keep a minimal record of unsubscribe or objection status to honour your preference rather than re-importing you into a campaign. Marketing systems should not use contact details obtained solely for fulfilment for unrelated behavioural targeting without an appropriate lawful basis and any required transparency. Changes to your marketing choices will not diminish your entitlement to the files or support associated with a paid Order.

16. Automated decision-making & profiling

16.1 Website and payment systems may employ automated risk scores, device indicators, suspicious-order rules, anti-bot checks and delivery eligibility decisions. These controls help detect fraud and prevent unauthorised transactions; they are not an invitation to infer sensitive traits from uploaded likenesses. A declined card payment may be decided by the issuer rather than Profile Studio, which generally cannot override the issuer's reason.

16.2 We do not use creative-reference photographs to identify people for biometric authentication as an ordinary part of avatar fulfilment. Where a decision is based on automated fraud screening and materially affects you, contact support for an explanation and appropriate human review. Any solely automated decision producing legal or similarly significant effects must meet the safeguards and conditions required by applicable data-protection law.

17. Third-party services & links

17.1 The Website may link to artists' portfolios, social platforms, external tools or a payment provider's screens. Their data practices are governed by their own controllers and notices when they independently decide the purposes of processing. An external link is not a declaration that every destination follows Profile Studio's privacy controls. Review third-party terms before supplying additional personal data through those services.

17.2 We assess service partners for relevance and reasonable security, but an independent card issuer's checks, browser provider's storage, and a social network's publication choices remain outside our direct control. Contact us if you discover an unauthorised link or request apparently made in our name. We may investigate and remove links that mislead visitors about the party responsible for processing information.

18. Changes to this policy

18.1 We may revise this Privacy Policy in response to new services, technology, regulator guidance or legal requirements. Material changes to processing that require a new lawful basis or fresh consent will not be implemented merely by changing a document date. The version and effective date identify the notice applying when it was published. Where required, we will provide additional notifications or obtain renewed permissions.

18.2 Past order and support records may remain governed by legal duties applying at their creation even after the Website's functional features change. We retain records needed to respond to inquiries about earlier data use and will explain meaningful changes through an accessible Website notice or the contact channel appropriate to the processing concerned.

19. How to contact us / submit a request

19.1 Address privacy, access, erasure, correction, direct-marketing objections or processor-inquiry requests to DIGIMACIS LTD at info@profile-studio.com, or write to 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ. Include a clear description of the request; provide an order identifier where it helps us find the correct records. Do not email passwords or full card data.

19.2 We will confirm receipt and, where required, ask focused questions to verify identity or clarify scope. If we cannot comply in full, we will explain the legal basis for the decision and the complaint routes available. Requests about content that another controller holds may need to be sent to that controller; we will provide available contact information where practical.

19.3 This Privacy Policy operates under the laws of England and Wales, including the UK General Data Protection Regulation and Data Protection Act 2018, without excluding any mandatory protections applicable to an individual elsewhere. Where our handling of a request is disputed, you may complain to the UK Information Commissioner’s Office or another competent supervisory authority in accordance with applicable law.

Schedule 1 — Practical Retention Guide

Before an order: browsing information and preference signals are limited to their technical purpose. A custom brief uploaded but never associated with a completed purchase is removed under the unfulfilled-brief rule; any relevant support or fraud record may remain for its separate lawful purpose.

After ready-made delivery: the order record, amount, chosen format and fulfilment event are retained for accounting and dispute resolution. Download access may be restored using an order token while the Account is active; entitlement history is not treated as a cash balance. The customer should keep a copy of the received image.

During a custom commission: the brief, reference images, selected style, communications and revision status are available to appropriately authorised production personnel. After final delivery, production reference files are subject to the retention period in the table, except for evidence genuinely required for an active dispute or another lawful basis.

After account closure: optional marketing stops on unsubscribe or objection, routine Account information enters the closure schedule, and outstanding refunds or legal holds remain segregated until resolved. Closing an Account is not the same as deleting every financial record or revoking a valid Licence to already delivered artwork.

Rights request: email the privacy contact, identify the relevant records and specify access, correction, restriction, objection, portability or deletion. Requests are assessed by category, as statutory obligations may justify keeping transaction data while image references are erased. Suppression information may remain solely to prevent new unwanted marketing.

Profile Studio · Privacy Policy · v1.0 · 8 October 2026 · Published on the Website; subject to update; the current published version governs.