This Privacy Policy explains how personal data is collected, used, stored, and protected when you use Lasted and its product MemoryBox.

Lasted exists to help people record and preserve personal memories for their loved ones. We recognise that the information entrusted to us is deeply personal, and we are committed to handling it with care, transparency, and respect.

1. Who We Are

MemoryBox is a product operated by the Lasted Charitable Trust, 

Company number: 15573195

• Registered office:
  76 King Street, Manchester, England, M2 4NH

The Lasted Charitable Trust, run by its trustees, exists to support the long-term mission and continuity of the platform, including the preservation of stored memories.

For the purposes of UK data protection law, Willfully Limited is the data controller.

2. Who This Policy Applies To

This policy applies to:

• Individuals who create a MemoryBox account

• Care home or hospice staff acting on behalf of a resident

• Family members or trusted contacts nominated by a user

• Visitors to the Lasted website

MemoryBox is intended for UK users. Users outside the UK may register, but do so at their own discretion. English law and UK GDPR apply.

3. The Data We Collect

3.1 Information You Provide

We may collect the following personal data when you create or use a MemoryBox account:

• Name

• Email address

• Account login details

• Details of trusted contacts or nominated recipients

• Communications with us (for example, support emails)

• Preferences relating to MemoryBox features or services

3.2 Memory Content

MemoryBox allows users to upload and store:

• Video recordings

• Audio or voice recordings

• Written text

• Images

This content is private by default and belongs to the account holder.

MemoryBox is not designed for medical records, but content may naturally reference illness, end-of-life messages, or personal experiences. All content is treated as highly sensitive.

3.3 Technical and Usage Data

We may collect limited technical data, including:

• IP address

• Device and browser information

• Usage and interaction data

This data is collected using tools such as Google Analytics, PostHog, HubSpot, and Meta, in line with our Cookie Policy.

4. How We Use Personal Data

We use personal data to:

• Create and manage MemoryBox accounts

• Securely store and protect uploaded memories

• Deliver content to nominated recipients when a trigger is verified

• Provide customer support

• Maintain platform security and performance

• Facilitate user-requested services, including introductions to third-party providers

• Produce anonymised, aggregated statistics (for example, total users or memories created)

We do not sell personal data.

5. Lawful Bases for Processing

Under UK GDPR, we rely on the following lawful bases:

• Consent – for storing memory content, releasing content to nominated recipients, and sharing data with third-party providers when requested

• Contract – to provide the MemoryBox service

• Legitimate interests – to operate, secure, and improve the platform

• Legal obligation – where required by law

6. Content Ownership and Access

• The MemoryBox account holder remains the legal owner of all content they upload.

• Lasted acts solely as a secure custodian of that content.

• Content is not routinely accessed, viewed, or shared by Lasted.

Access may occur only where:

• Required to resolve a technical or support issue

• Required by law

• Necessary to protect users or enforce platform rules

Internal access is strictly limited and controlled.

7. Posthumous Access and Release of Content

Users may nominate recipients to receive access to their memories in the future.

Content is released only when a trigger is verified, which may include:

• A trusted contact providing a unique access code, or

• Submission of a death certificate or equivalent documentation

Until a trigger is verified:

• Content remains private

• No access is granted to others

If no trigger ever occurs, content remains private indefinitely.

8. Care Homes, Hospices, and Acting on Behalf of Others

Care home or hospice staff may assist residents by acting on their behalf.

In these cases:

• The resident remains the account holder

• Appropriate consent must be in place

• Staff do not gain ownership or independent rights over content

Lasted is not responsible for internal consent processes within care settings.

9. Wills and Legal Services via Treadstone Law

Lasted and MemoryBox do not provide will-writing or legal services.

10. Charities and Impact Reporting

Charity partners may receive anonymised, aggregated statistics only, such as:

• Total number of users

• Number of memories created

No personal or identifiable data is shared with charities.

11. Data Storage and Security

• All data is hosted on Amazon Web Services (AWS) in London (eu-west-2).

• Data is encrypted in transit and at rest.

• Automated backups are in place.

• Access controls are strictly limited.

If Lasted were ever to cease trading, the Lasted Charitable Trust exists to support the continued storage and preservation of content, and reasonable efforts would be made to allow users or their representatives to export their data.

12. Data Retention and Deletion

• Users may initiate account deletion at any time.

• A 7-day cooling-off period applies once deletion is requested.

• After this period, data is deleted within 7 days.

• Backups are securely overwritten in line with our retention processes.

13. Cookies and Analytics

We use cookies and similar technologies to operate and improve our services.

Full details are set out in our Cookie Policy, including how to manage your preferences.

14. Your Rights

Under UK GDPR, you have the right to:

• Access your personal data

• Request correction of inaccurate data

• Request deletion of your data

• Restrict or object to processing

• Request data portability

• Withdraw consent at any time

To exercise your rights, contact:
support@lasted.co.uk

15. Children

MemoryBox accounts are available to individuals aged 18 and over only.

16. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be published on our website, with the updated date shown at the top.

17. Contact and Complaints

If you have any questions, concerns, or complaints about this policy or how your data is handled, please contact:

Email: support@lasted.co.uk
Address: Willfully Limited, 76 King Street, Manchester, England, M2 4NH

You also have the right to complain to the Information Commissioner’s Office (ICO).