Privacy Notice

  1. WHO ARE WE AND WHAT IS AFTERBOOK?
  2. We are Afterbook Limited, a company registered in Northern Ireland under company number NI643082 and we have our registered office at Graceland, 4 Redbridge, Crawfordsburn, BT19 1ZU (we, us, our).
  3. We provide a website (currently available at https://afterbook.com/) which allows Users to upload and share precious memories about themselves or a loved one (Afterbook). Any reference in this notice to our Services means the provision of Afterbook.

  1. If you have any questions about who we are, what we do, or the provisions set out herein (Privacy Notice), please feel free to contact us at the address above or by email to [email protected]

  1. WHAT IS THIS NOTICE?

  1. In order to provide our Services, we may need to process Personal Data from time to time (that is information from which an individual can be identified). To the extent that we hold this data as a Controller (which means we make decisions about what data to collect and how it should be used), we are required to provide anyone who can be identified from that data (Data Subjects) with a notice explaining how we use Personal Data about them. That is what this document is for.

  1. We might need to change this Privacy Notice from time to time. If we do, we will let you know. So please do keep an eye on our notice before sending us any Personal Data or uploading it on to Afterbook.

  1. All of the defined terms in this notice are explained in paragraph 12 below. If you have any questions about this notice, feel free to send us an email to [email protected].

  1. WHO DO WE HOLD PERSONAL DATA ABOUT?

  1. In the provision of Afterbook, it is likely that we will hold Personal Data about 2 groups of people: (1) anyone who uses our Services (Users) and (2) anyone who is the subject of a Life Story Profile (Life Story Subjects).

  1. User Data: We have 2 types of User: 
  • Curators – that is anyone who creates an online ‘memory box’ on Afterbook about themselves or their loved ones (a Life Story Profile); and

  • Visitors – that is anyone who is invited by a Curator to share and/or contribute to a Life Story Profile.

In each case a User will be required to set up a User Account on Afterbook. To do so a User will be required to provide us with some information about themselves. This information, along with any data we might collect about how a User interacts with Afterbook, is what we mean by ‘User Data’. Since we use this data for our own business purposes, we are a Controller in respect of how we use it. This Privacy Notice sets out what User Data we collect and how we use it.

  1. Life Story Subject Data: that is Personal Data relating to a Life Story Subject. This might be additional information about yourself (if you are the Life Story Subject) or information about another living person (if you are not the Life Story Subject). In some instances, the Life Story Subject will have deceased. While we recognise the extreme importance that such information is treated sensitively and with respect, Data Protection Legislation only applies to data about living individuals. As such, data about individuals who have deceased is not included in this definition.

Save for setting out restrictions on the type of content that can be uploaded when a User uses Afterbook, we do not make decisions about who Life Story Profiles may be created for, nor what details will be added to a Life Story Profile. To the extent that Life Story Profiles include data about individuals who are alive, we hold any such data as a Processor. We will only use such data in accordance with the terms of processing – which are set out in our terms of use (accessible here.)

  1. WHAT TYPES OF PERSONAL DATA DO WE COLLECT ABOUT OUR USERS AND WHERE DO WE COLLECT IT FROM?

4.1 We may collect or obtain User Data in the following ways:

  1. Data which a User uploads on to Afterbook when they set up a User Account. This will include name and contact data, password date of birth and a profile image if the User chooses to submit one.  It may also include details about the User’s relationship with the Life Story Subject.

  1. Data which a User provides us with if they contact us with a query. This would include details of their communication.

  1. Data a User provides us with in respect of their marketing preferences. This is likely to include contact details and marketing preferences.

  1. Usage data which is automatically collected by us about how someone interacts with Afterbook. This may include IP address, login data, browser type and version, time zone setting and location, browser plugin types and versions, operating system and platform and other technology on the devices used to access Afterbook. This data may be collected through the cookies we use or other technology. If you would like to know more about our cookies policy, please click here.

  1. We may also collect, use and share aggregated data such as statistical or demographic data which we collect from interactions with Users of Afterbook. Aggregated data may be derived from Personal Data but since it cannot be used to identify an individual, it is not Personal Data.

4.2 If a User is also the Life Story Subject, we will also collect data uploaded for the purpose of creating the Life Story Profile. To the extent this includes Personal Data, we will process such data as a Processor. This Privacy Notice only deals with data which we process as a Controller. For more information about how we handle Life Story Subject Data, please have a look at the terms of processing set out in our terms of use.

  1. HOW DO WE USE USER DATA AND WHAT IS OUR LAWFUL BASIS FOR DOING SO?
  2. We process User Data for the following purposes:
  3. To provide our Users with our Services. This may include storing log in details, preferences and usage data as well as facilitating payment if you have opted to use a paid-for function on Afterbook. Any such use would be to the extent necessary for the performance of our contract with you.

  1. To manage our relationship with our Users. This may include notifying Users of updates to our services or software or updates to our privacy notice. This is necessary to protect our legitimate interests of running our business.

  1. For administration and dispute resolution purposes. This may include processing Personal Data to meet our internal administration requirements and for matters such as dispute resolution.  This is necessary to protect our legitimate interests of running our business.


  1. For marketing purposes. From time to time we might contact our Users by telephone or email about updates to our services, new features or functions or new products we are bringing out. Our marketing may be tailored on the basis of what we think your interests are (from looking at past transactions and interactions). We will always include the right to opt out in any such correspondence. Generally we will rely on the fact that this is necessary to protect our legitimate interests of running our business or we will obtain your consent.

  1. We may use usage data to monitor account usage and manage disputes. Such use is necessary for us to achieve our legitimate interest of protecting the integrity of our software. If a User does not use Afterbook in accordance with our terms of use, we may cease allowing them to access Afterbook and we may pass on the User’s details if such activities are or are likely to be in breach of someone else’s rights of privacy, intellectual property rights or any other lawful rights.

  1. WILL WE DISCLOSE USER DATA TO ANYONE ELSE?
Data Processors

  1. We may disclose User Data to our employees as well as other third parties who we engage to help us provide our Services. For example, we use third parties to provide the following services for the following services:
  • Email provider
  • Host server provider
  • Marketing database provider

Any such parties contracted by us will be acting as our Processors and will be subject to strict contractual requirements only to use such Personal Data in accordance with our Privacy Notice. If you would like more information about third party processors used by us, please contact us at: [email protected].

Information published on Afterbook

  1. The nature of our Services means that:
  2. if you send a Life Story Profile Link to anyone who you would like to access your Life Story Profile, the recipient will be able to see your User Profile, as well as the Life Story Profile in question;

  1. if you sign up as a Visitor, at a Curator’s request, anyone who accesses the Life Story Profile will be able to see your User Profile. A Visitor cannot control who is invited to access a Life Story Profile. For this reason you should only agree to access a Life Story Profile and/or add content to your User Profile which you are happy to share (or have shared) with other people; and

  1. if you contribute to a Life Story Profile, any contributions you make may be published as part of that Life Story Profile and will be available to anyone who the Curator invites to access the Life Story Profile. A Visitor cannot control who is invited to access any Life Story Profile. For that reason, you should never contribute any content which you want to keep confidential.

This Privacy Notice only deals with how we handle Personal Data. Other Users are not bound by this Privacy Notice. You should only upload information that you are comfortable to share (or have shared) with other people.

Other Disclosures

  1. We may also disclose User Data if:

  1. we are under a duty to do so in order to comply with any legal obligation, or in order to enforce or apply our terms of use and other agreements or to protect the operation of our website, or the rights, property, or safety of us, our Users, or others; or

  1. to any buyer if we sell, transfer or merge parts of our business or our assets. If a change happens to our business, then the new owners will only be entitled to use Personal Data in accordance with the provisions set out in this privacy notice.

  1. WHAT SECURITY PROCEDURES DO WE HAVE IN PLACE? 

  1. It is our policy to ensure that all Personal Data held by us is handled correctly and appropriately according to the nature of the information, the risk associated with mishandling the data, including the damage that could be caused to an individual as a result of loss, corruption and/or accidental disclosure of any such data, and in accordance with any applicable legal requirements.
7.2      There are some steps you can take to help make sure that your data is protected. For example:

(a)     if you are sending any financial details or sensitive information, consider sending it in separate emails or encrypted, password protected documents; 

(b) make sure that you keep any passwords associated with your Afterbook account secure; and

(c) make sure you understand who can access the data you upload on to your User Profile or contribute to a Life Story Profile before you add any information which might be shared. For more information on this, please have a look at paragraph 6.2 above.

  1. WHERE DO WE STORE THE PERSONAL DATA WE COLLECT?

8.1 Our current host servers are provided by Amazon Web Services, whose servers are based in Dublin. 

8.2 Some of our Processors may be based outside the EEA. We will only use Processors who ensure that they have adequate safeguards in place to protect Personal Data relating to you.

8.3 If you are based outside the EEA and would like further information about where we hold your data, please contact us by email: [email protected].

  1. FOR HOW LONG DO WE STORE PERSONAL DATA?

  1. You can delete your User Account at any time. If you do, you will no longer have access to any Life Story Profiles held on Afterbook. We may continue to hold data about you in accordance with our retention policy, which is set out below.
  2. Our retention policies for User Data are as follows:

  1. we may store your Account Details for a period of 1 year after termination of your User Account. This is to make it easy for you to sign up again if you choose to do so. Unless there is a dispute or a potential dispute relating to your use of Afterbook, any Life Story Profiles which you created through your User Account will be deleted in accordance with our terms of processing which can be accessed in our terms of use;

  1. we may store data related to financial transactions for up to 7 years to ensure that we have sufficient records from an accounting and tax perspective;

  1. we may archive data relating to negotiations, contracts agreed, payments made, disputes raised for up to 6 years to protect ourselves in the event of a dispute arising between you and us;

  1. we may retain data which is held for marketing purposes for up to 5 years from the date you opt in – this is subject to your right to opt out at any time;

  1. we may store aggregate data without limitation (on the basis that no individual can be identified from the data); and

  1. we may retain usage data for a period of up to 6 years after expiry of the relevant User contract in case of any disputes arising.

  1. WHAT RIGHTS DO YOU HAVE IN RELATION TO THE PERSONAL DATA WE HOLD?

10.1 Users have the following rights in respect of any User Data we hold about them as a Controller:

  1. Right to be informed: the right to be informed about what Personal Data we collect and store and how it’s used.
  2. Right of access: the right to request a copy of the Personal Data we hold, as well as confirmation of:
  3. the purposes of the processing;
  4. the categories of personal data concerned;
  5. the recipients to whom the personal data has/will be disclosed;
  6. for how long it will be stored; and
  7. if data wasn’t collected directly from you, information about the source.

  1. Right of rectification: the right to require us to correct any Personal Data we hold which is inaccurate or incomplete.

  1. Right to be forgotten: in certain circumstances, the right to have the Personal Data we hold erased from our records. 

  1. Right to restriction of processing: the right to request us to restrict the processing we carry out. You might want to do this, for instance, if you think the data we hold is inaccurate and you would like to restrict processing the data has been reviewed and updated if necessary.
  2. Right of portability: the right to have the Personal Data we hold transferred to another organisation, to the extent it was provided in a structured, commonly used and machine-readable format.
  3. Right to object to direct marketing: the right to object where processing is carried out for direct marketing purposes (including profiling in connection with that purpose).
  4. Right to object to automated processing: the right not to be subject to a decision based solely on automated processing (including profiling) which produces legal effects (or other similar significant effects) on you.
10.2 If you want to avail of any of these rights, you should contact us immediately at [email protected]. If we are not the Controller, we will need to transfer your request to the Controller – but we will only do so with your consent. If you do contact us with a request, we will also need evidence that you are who you say you are to ensure compliance with data protection legislation.


  1. WHO DO YOU COMPLAIN TO IF YOU’RE NOT HAPPY WITH HOW WE PROCESS PERSONAL DATA ABOUT YOU?

11.1 If you have any questions or concerns about how we are using Personal Data about you, please contact our data protection officer immediately at our address (see paragraph 1.1 above) or by email to [email protected]. If we are processing Personal Data about you on behalf of our User, we will need to pass your complaint to our User – we will only do so with your consent.

11.2 If you wish to make a complaint about how we have handled Personal Data about you, you may lodge a complaint with the Information Commissioner’s Office by following this link: https://ico.org.uk/concerns/

  1. WHAT DO ALL OF THE DEFINED TERMS IN THIS PRIVACY NOTICE MEAN?

12.1 Throughout this notice you’ll see a lot of defined terms (which you can recognise because the first letter is capitalised). Where possible, we’ve tried to define them as we go, but we thought it might be useful to have a glossary as well. Anywhere in this notice you see the following terms, they’ll have the following meanings:

Controller is a legal term set out in the General Data Protection Regulation (GDPR), it means the party responsible for deciding what Personal Data to collect and how to use it;

Curator means the User who creates the Life Story Profile;

Data Subject means the individual who can be identified from the Personal Data;

Life Story Profile means an online ‘memory box’ created on Afterbook which includes stories and images about the Life Story Subject;

Life Story Subject means the individual about whom the Life Story Profile is written;

Life Story Subject Data means Personal Data relating to a Life Story Subject. This might be additional information about yourself (if you are the Life Story Subject) or information about another living person (if you are not the Life Story Subject). In some instances, the Life Story Subject will have deceased. While we recognise the extreme importance that such information is treated sensitively and with respect, Data Protection Legislation only applies to data about living individuals. As such, data about individuals who have deceased is not included in this definition.

Life Story Profile Link means the link supplied by us which a Curator can send to a Visitor to enable them to access a particular Life Story Profile; 

Personal Data means data which can be used to identify a living individual. This could be a name and address or it could be a number of details which when taken together make it possible to work out who the information is about. It also includes any information about the identifiable individual;

Processor is another legal term set out in the GDPR, it means the party who has agreed to process Personal Data on behalf of the Controller and in accordance with their instructions;

User means a user of Afterbook;

User Account means the account set up by a User so they can use Afterbook;

User Data means Personal Data about Users of Afterbook which is provided by Users in order to set up a User Account. It also includes any data we might collect about how a User interacts with Afterbook;

User Profile means the user name and any profile image you selected when you set up your User Account; and

Visitor means anyone invited by a Curator to access a Life Story Profile.


Last updated: 01/05/2019