Privacy

Who this notice is for

This notice, given under articles 13 and 14 of Regulation (EU) 2016/679 (GDPR), explains how the personal data of those who use Necrologi360 is processed: the website and the apps for phones and tablets.

It covers those who visit the public pages, those who create an account, the registered businesses (funeral homes and suppliers) with their team members, and the people named in published content, such as the relatives mentioned in an obituary.

Data controller

The data controller is Svmedia di Simone Viagi, Via 4 Novembre 2, 07100 Sassari (SS), Italia.

Email: info@svmedia.it. Certified email (PEC): svmedia@pcert.postecert.it. Phone: +39 379 382 3981.

No data protection officer (DPO) has been appointed, because the conditions of article 37 of the GDPR are not met. For any request about personal data, write to the addresses above.

What data we process

Account data: first name, last name, email, password (stored only in a non-reversible encrypted form), chosen language, date on which terms and privacy notice were accepted, date of the last sign-in.

Sign-in with Google or Apple: if you choose to sign in this way, instead of a password we keep the identifier of your account with that service and the access codes it issues to us, used only to sign you in. From the service we receive first name, last name and confirmed email (from Apple the name only at the first sign-in) and, from Google, the address of the profile photo.

Business data: name, categories, address, phone, VAT number, billing details (company name, tax code, address, recipient code or certified email), logo, photos and texts of the profile, invited team members with their roles.

Content you write: thoughts left on obituaries, telegrams for families, flower orders with the text of the ribbon and of the card, quote requests, municipalities whose new obituaries you follow.

Payments: they take place on Stripe's pages. We neither receive nor store card numbers; we keep the outcome of the payment, the amount and the identifiers needed to manage orders, subscriptions and refunds.

Technical data: IP address, type of browser and device, date and time of requests, recorded in the server logs to run the site and protect it. The counters that limit repeated attempts (sign-in, password recovery, submissions) use the IP address and the email in a non-reversible encrypted form and expire by themselves.

Apps: to send notifications the app registers an identifier of the device, tied to the session you signed in with, which is deleted when you sign out. The session stays in the protected storage of the device.

Cookies: without your consent the site uses technical cookies only; if you give it, also the analytics cookies of Google Analytics. Which ones and what they are for is written in the cookie policy.

Usage statistics, only if you accept them. On the site Google Analytics records the pages viewed (address and title), where you come from (for example a search engine or a social network), the type of browser and device, the approximate area (worked out from the IP address, which Google Analytics does not keep) and a random identifier stored in a cookie. In the apps Google Analytics for Firebase records the screens opened, counted by type (for example "obituary") and never with the content they show, the model and system of the device, the approximate area and a random identifier of the installation; it does not use the advertising identifier of the device. This data is not linked to your account.

Obituaries and third-party data

Obituaries are published by funeral homes, on behalf of the families. For the data they contain (name, photo, dates, places of the ceremonies, names of relatives) the publishing funeral home is the data controller; Svmedia di Simone Viagi hosts and shows them on its behalf, as data processor under article 28 of the GDPR.

The rights concerning the data of a deceased person can be exercised by those who have an interest of their own, act to protect the person or for family reasons worthy of protection (article 2-terdecies of the Italian Data Protection Code).

To correct or remove an obituary, contact the funeral home that published it, named on the page. If the funeral home does not answer, write to info@svmedia.it: we check the request and take action.

When a funeral home uploads a poster, its text and photo may be read by an automated system to fill in the obituary. The funeral home checks and confirms the data before publication.

Whoever writes a thought, a telegram or a card is responsible for the data of other people they include, and must have the right to share it.

Why we process it and on what basis

To provide the service (account, publication of obituaries, thoughts, telegrams, flower orders, quotes, alerts for followed municipalities, business panel): performance of a contract and of pre-contractual measures, article 6.1.b of the GDPR.

For invoicing, accounting and tax obligations: legal obligation, article 6.1.c.

For the security of the site, the prevention of abuse and fraud and the defence of a right: legitimate interest, article 6.1.f.

For visit statistics of obituary and business pages, which are only aggregated counters and do not concern identifiable people: legitimate interest, article 6.1.f.

For usage statistics of the site and the apps with Google Analytics: your consent, article 6.1.a, which you can withdraw at any time.

The emails we send are service emails (confirmation codes, outcome of orders, replies to quotes, alerts you asked for). We do not send advertising without a separate consent.

Visit statistics

We count the visits to the pages of businesses and obituaries without cookies and without identifying the visitor: we only store how many visits a page had in a day, from which channel (search, social, QR code, direct access) and from which area.

The area (city, region, country) is estimated from the IP address with a database kept on our servers: the IP address is neither stored nor shared with others for this purpose.

IP geolocation uses data by DB-IP (db-ip.com).

Who receives the data

Data is processed by the controller and the people authorised by it, and by providers working on its behalf as data processors: hosting, file storage and email delivery services.

Businesses receive the data needed for what you ask: the funeral home sees the thoughts and telegrams of the obituary and who sent flowers; the florist receives the order with your name and the texts; the supplier receives the quote request and, if you accept the offer, your contact details. For this data each business is an independent controller.

Stripe handles payments, subscriptions and the accounts of sellers, and receives the billing details of businesses.

OpenAI processes the images of the posters uploaded by funeral homes, to read their data and retouch the photos, and the texts of the obituaries, to translate them into the other languages of the site. Data sent through its API is not used to train models.

Google receives the text you type in address fields, to suggest addresses (Google Places), and delivers notifications to Android devices; Apple delivers them to iOS devices.

Google receives through Google Analytics (in the apps Google Analytics for Firebase) the usage statistics described above, only if you accepted them. We use them for overall statistics on how the site and the apps are used, not for advertising: Google Signals is off and the data is not used to personalise ads.

Google and Apple, if you choose to sign in with their account, verify who you are and send us the data listed above; we do not receive your Google or Apple password. With Apple you can hide your email: in that case we receive an Apple relay address and our emails reach you through its servers. For the sign-in each of them processes your data under its own privacy policy.

Maps load their images from the servers of OpenStreetMap, which receive the IP address of your browser for this.

What is public by nature (obituaries, thoughts with the name of who signed them, business profiles) is visible to anyone and can be found by search engines. We do not sell data to anyone.

Transfers outside the European Union

Some providers (Stripe, OpenAI, Google, Apple) are based in the United States or may process data outside the European Economic Area. In these cases the transfer takes place on the basis of an adequacy decision (EU-US Data Privacy Framework) or of the standard contractual clauses approved by the European Commission.

How long we keep it

Account: as long as it exists. You can delete it at any time from your profile: the account, the sessions and the membership of businesses are deleted.

Thoughts, telegrams and flowers already sent remain after the account is deleted, with the name you signed them with, because they are part of the remembrance and were delivered to the family. You can ask for their deletion by writing to info@svmedia.it.

Obituaries: as long as the funeral home keeps them published or until it asks for their removal.

Invoices, orders and accounting documents: ten years, as required by law.

Technical logs: twelve months at most. Attempt counters: from a few minutes to a few days.

Usage statistics of Google Analytics: 14 months, then Google deletes them.

Quote requests and contact messages: twenty-four months from the last reply.

Security

Connections are encrypted, passwords are stored in a non-reversible form, you sign in only with a confirmed email and each team member of a business sees only what their role allows. Private files open only with signed addresses that expire. Logs never contain passwords, codes or personal data other than identifiers.

Automated decisions

We do not take decisions based solely on automated processing that produce legal effects or significantly affect people, and we do no profiling.

Your rights

You can ask to access your data, to correct it, to delete it, to restrict its processing, to receive it in a format readable by another service (portability), and you can object to processing based on legitimate interest (articles 15 to 22 of the GDPR). Where processing is based on consent you can withdraw it at any time: for usage statistics, from the cookie preferences of the site or from the profile in the apps.

Write to info@svmedia.it or to the certified email svmedia@pcert.postecert.it. We answer as soon as possible and in any case within one month. Many things you can do yourself from your profile: edit your data, change language, delete the account.

If you believe the processing breaks the law you can lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it).

Minors

You must be at least 18 to create an account. We do not knowingly collect data of minors; if you notice that a minor gave us their data, write to us and we delete it.

Changes to this notice

We may update this notice when the service or the law changes. The version in force is always on this page, with the date of the last update; important changes are communicated by email to registered users.