Privacy policy

Last updated: 4 September 2026

1. Who controls your information

GetFigure is the trading name of a UK-based sole trader. GetFigure is the data controller for the personal information described in this policy.

Address: 240 Hendon Way, London NW4 3NL, United Kingdom
Email: contact@getfigure.co.uk

This policy covers getfigure.co.uk, the photo personaliser at design.getfigure.co.uk, the MyPukki and MyBaddii brand sites, and physical figurine orders placed through any of them. GetFigure is the seller and merchant of record for all those orders.

2. Information we collect

Photos and designs: the image you upload, design choices, text or instructions, generated previews and the production-ready 3D model.
Contact and delivery details: name, email address, phone number, billing address and delivery address.
Order information: products, price, payment status, approval record, order number, correspondence, tracking, returns and refunds. The online store and payment providers handle full card details; GetFigure does not receive your full card number or security code.
Site and device information: IP address, browser and device details, pages requested, timestamps, security logs, cookies and local storage described in our Cookie Policy.
Messages and claims: emails, support messages, photographs of a damaged item and information needed to handle a complaint or product-safety issue.

We collect this information from you, from the device you use, and from providers involved in the preview, checkout, payment, production and delivery process.

3. How and why we use it

What we do	Information used	UK/EU lawful basis
Create a free preview at your request	Photo or design, instructions, technical details and generated files	Steps you ask us to take before a contract
Take payment, record approval, make, check and deliver an order	Order, contact, delivery, preview and model information	Performance of our contract with you
Answer questions and handle faults, refunds and safety reports	Contact, order, messages and claim evidence	Contract and our legitimate interest in providing support and keeping products safe
Prevent fraud, misuse and security incidents	Order, payment status, device and log information	Our legitimate interest in protecting customers, our sites and our business
Keep tax, accounting, product-safety and legal records	Order, transaction, traceability and claim information	Legal obligation
Use an optional, non-essential cookie or send electronic marketing, if introduced	The information explained when we ask	Consent, which you may withdraw

We do not use facial recognition, identify a person from their face, or make decisions about people from their appearance. The image-generation process is used only to create the figurine you requested. There is no solely automated decision with legal or similarly significant effects.

4. Who receives information

We share only what is needed for the service with the following categories of recipient:

Online store, checkout and payment providers process basket, checkout, payment-status and order information.
An AI image and 3D-model generation provider in the United States processes the photo or design and generated files needed to create your requested preview and production model.
Hosting, infrastructure and security providers host the personaliser and brand sites and process normal technical and security logs.
The manufacturing partner receives the production model file and order reference needed to print. It does not receive the original photo.
Delivery carriers receive the name, delivery address and contact details needed to deliver and provide tracking.
Communication and professional service providers receive information only where needed to support customers, protect the business or meet a legal duty.

We may disclose information where the law requires it, to protect someone’s safety or legal rights, or in connection with a sale of the business. We do not sell personal information.

5. International transfers

GetFigure is in the UK. The personaliser’s main hosting is in the EU, and the provider that generates AI images and 3D models processes relevant photos, designs and generated files in the United States. Store, checkout, payment, infrastructure and other service providers may also process information in more than one country. This means information may leave the UK or European Economic Area.

Where a transfer needs a legal safeguard, we use an applicable adequacy decision or contractual protection designed for that transfer, such as the EU standard contractual clauses and the UK International Data Transfer Agreement or UK Addendum. You may ask us for more information about the safeguard used, subject to necessary confidentiality.

6. How long we keep it

We keep personal information only for as long as we need it for the purposes described above, including providing previews, making and supporting orders, preventing misuse, keeping required business records and handling legal claims.

Preview access: an unfinished preview normally expires after 12 hours. A completed preview normally remains available for up to one year, or for up to two years after you create a basket link. If you create another basket link, the two-year period runs from the most recent link.
Photos and generated files: expiry of a preview does not by itself delete the uploaded photo, generated concepts or model files. These files may remain until they are removed through our data-cleanup process.
Expired links: we may keep limited information needed to recognise an expired preview link for up to five years. This can include the preview identifier and the browser-session identifier connected with it.
Orders and tax records: core transaction and accounting records are normally kept for six years.
Support messages and claims: normally kept for two years after closure, or longer where a legal claim or product-safety duty requires it.
Routine technical logs: kept for the period needed to operate and secure the service and investigate incidents.

You may ask us to delete your photos and generated files sooner where the right to erasure applies by emailing contact@getfigure.co.uk. We may keep a minimal record that an erasure or marketing objection request was honoured.

7. Your UK and EU rights

Depending on the circumstances, you may ask us to:

give you a copy of your personal information;
correct inaccurate or incomplete information;
delete information;
restrict how it is used;
provide information you gave us in a portable format;
stop processing based on legitimate interests; or
honour withdrawal of consent for future use.

These rights can have legal exceptions. Email contact@getfigure.co.uk. We may ask for enough information to confirm your identity and normally respond within one month.

If you are unhappy, please contact us first. In the UK, you may complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or call 0303 123 1113. In the EEA, you may complain to the data-protection authority where you live, work or believe a breach happened.

8. United States privacy rights, including California

This section applies where a US state privacy law gives you the relevant right. The California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) applies only to businesses that meet its legal thresholds; this notice does not claim that GetFigure meets them.

In the preceding 12 months, the categories we may have collected are identifiers and contact details; commercial and order information; internet or device activity; payment status; photographs and other visual information; communications; and inferences needed to turn a submitted photo or design into a requested figurine. Sources and purposes are described in sections 2 and 3.

We may disclose those categories for business purposes to the service providers and recipients in section 4. We do not sell personal information and do not share it for cross-context behavioural advertising. We do not knowingly sell or share the personal information of anyone under 16. We do not use or disclose sensitive personal information to infer characteristics or for purposes outside what a customer would reasonably expect from the requested service.

Where applicable, you may have rights to know, access, correct, delete or receive a portable copy of personal information; to opt out of sale, sharing or targeted advertising; to limit certain uses of sensitive information; to appeal a refusal; and not to receive discriminatory treatment for using a right. Because we do not sell or share personal information for cross-context behavioural advertising, there is no such use to opt out of at present.

Submit a request to contact@getfigure.co.uk. An authorised agent may submit a request, but we may ask for proof of authority and identity. We will verify and respond within the period required by the law that applies.

9. Children

The physical figurines are collectible display pieces for people aged 14 and over, not toys. A person under 18 should not place an order or upload someone’s photo without a parent or guardian. If you believe a child has given us personal information improperly, contact us so we can investigate and delete it where appropriate.

10. Security

We use reasonable technical and organisational measures to protect information and limit access to people and providers who need it. No online service is completely secure. Please do not send payment card details by email.

11. Changes

We will update the date above when this policy changes. If a change materially affects how we use existing information, we will give additional notice where the law requires it.