Privacy Policy

1. What data we process

Account data: name, e-mail address, encrypted password, chosen language. If you sign in with Google, we receive your name, e-mail address and account identifier from Google — we do not receive your password.

Order data: name, delivery and billing address, telephone number, e-mail address, the contents, value and payment method of the order, and any note for the courier. Card details never reach us — they are processed by Stripe.

Memorial page content: the texts, photographs, video and audio you upload, and the guest book messages.

Technical data: IP address, device and browser type, time of access, generated automatically as the service runs.

2. Purposes and legal bases

Performance of the contract (Art. 6(1)(b) GDPR): processing the order, delivery, creating and hosting the memorial page, managing the account, customer support.

Compliance with a legal obligation (Art. 6(1)(c) GDPR): issuing and retaining invoices, accounting and tax obligations.

Legitimate interest (Art. 6(1)(f) GDPR): security of the service, preventing abuse, establishing or defending our rights. Our interest is the safe operation of the service; you may object at any time.

Consent (Art. 6(1)(a) GDPR): the anniversary reminders you can switch on and off. Consent may be withdrawn at any time, without affecting the lawfulness of earlier processing.

3. Data of the deceased and of third parties

The GDPR does not apply to the data of deceased persons. The content of a memorial page may, however, contain data of living people — for example relatives who appear in photographs or are mentioned in stories.

For that content you decide what to upload, so for those data you are the controller and we process them on your behalf, as a processor. Please upload only content you are entitled to publish.

If a living person asks for content about them to be removed, we will pass the request on to you; in clear cases we may remove the content directly.

4. The guest book

Anyone leaving a guest book message provides their name and, optionally, an e-mail address. Messages appear publicly on the memorial page after you approve them.

The owner of the page can delete messages at any time, and the guest book can be switched off entirely.

5. Who we share data with

Stripe Payments Europe, Ltd. (Ireland) — processing card payments.

Google Ireland Limited — only where you sign in with Google, to verify your identity.

Our hosting provider, e-mail provider and courier company, strictly to the extent needed to fulfil the order and run the service.

We do not sell your data and do not pass it on for advertising. We disclose it to authorities only on a lawful request.

6. Transfers outside the European Economic Area

Our service providers may process data outside the EEA. Where that happens, the transfer takes place under standard contractual clauses approved by the European Commission or under an adequacy decision.

7. How long we keep data

Memorial page content and account data: for the 35-year hosting period, or until you delete it.

Order data and invoices: 10 years, under accounting obligations.

Technical logs: 12 months at most.

When an account is deleted we remove the data, except what we are required by law to keep.

8. Cookies and local storage

We use no analytics, advertising or tracking cookies. There is no traffic measurement tool or social network pixel built into the site — which is why we do not ask for consent in a cookie banner.

Strictly necessary cookies: “auth_token” (keeping you signed in), “i18n_redirected” (your chosen language), “currency” and “geo_currency” (the currency displayed, valid for 30 days).

In your browser's local storage we keep the basket, the order you are configuring, and — if you tick the box — your delivery address. These never reach us; you can clear them in your browser settings.

Signing in with Google loads a Google script, which may set its own cookies; this happens only on the sign-in and registration pages.

9. Your rights

You have the right of access to your data, and the rights to rectification, erasure, restriction of processing, objection and data portability. Where processing is based on consent, you may withdraw it at any time.

Requests can be sent to the e-mail address above. We reply within one month at most; in complex cases this may be extended by two months, and we will tell you if it is.

You can download the content you uploaded from your account at any time.

10. Data security

Traffic to the site is encrypted (HTTPS), passwords are stored as cryptographic hashes, and activation codes are held encrypted. Only those who need it for their work have access to personal data.

11. Complaints

If you believe your data is being processed unlawfully, please contact us first. You also have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru nr. 28-30, Bucharest, www.dataprotection.ro, and to go to court.

12. Changes to this policy

We reserve the right to change this policy. We will tell you about significant changes by e-mail or in a notice shown when you sign in.