Privacy Policy
1. Name and Contact Details of the Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is:Rapid Data GmbH Unternehmensberatung, Ritterstraße 3, 10969 BerlinPhone +49 (30) 208 98 17-40 | Fax +49 (30) 208 98 17-49Email: info@rapid-data.deResponsibility for Individual Memorial Pages
This website serves, among other things, as a central, funeral-home-independent overview of memorial pages.Individual memorial pages for deceased persons are made available on this website. The content of these memorial pages is generally created and managed by the respective funeral home providing care, or by relatives within that funeral home's area of responsibility.The funeral home named on the respective memorial page is generally responsible for the processing of personal data in connection with a specific memorial page, in particular the creation and publication of condolences.The contact details of the responsible funeral home, as well as its privacy information, can be accessed via the respective memorial page.Rapid Data provides funeral homes with the technical platform required for this purpose and, in this respect, generally processes personal data on behalf of the respective funeral home.2. Contact Details of the Data Protection Officer
Our data protection officer can be reached at:LOROP GmbH, Dennis Schulz, Landgrafenstraße 16, 10787 Berlindatenschutz@lorop.de3. Description of Individual Processing Activities
3.1 Central Overview and Search for Memorial Pages
On the central hub page, memorial pages of deceased persons are aggregated across funeral homes. Using a search and filter function, users can search for deceased persons and access the corresponding memorial pages.In particular, the following information may be displayed: the first and last name of the deceased person, year of birth, year of death, a picture of the deceased person, and a link to the respective memorial page.The purpose is to provide a central search and overview platform through which existing memorial pages can be found regardless of the funeral home providing care.The GDPR generally does not apply to data of deceased persons. Insofar as the central overview processes exclusively information about deceased persons, no legal basis under Art. 6 GDPR is therefore required.As a rule, personal data of living persons is not intended to be displayed in the central overview.Insofar as technical data of the website visitor is processed when accessing or using the search function, the information on the technical provision of the website set out below applies in addition.A memorial page and its display in the central overview generally remain in place until the memorial page is deleted by the responsible funeral home or a person authorized to do so.3.2 Individual Memorial Pages
The individual memorial pages may display, in particular, the first and last name of the deceased person, year of birth and year of death, a picture, information about the funeral, and published condolences.The funeral home named on the memorial page is generally responsible for the content, provision, and management of the respective memorial page.In this respect, Rapid Data generally processes the personal data arising in connection with the memorial page as a processor on behalf of the respective funeral home.The privacy information of the funeral home applicable to the specific memorial page is separately linked on the respective memorial page.3.3 Creation and Publication of Condolences
Visitors to a memorial page can create their own condolences and memorial contributions. In particular, the following data may be processed:- First and last name
- Email address
- Texts, comments, greetings, and memories
- Uploaded images
- Uploaded videos
Controller
The controller for this processing is generally the funeral home named on the respective memorial page. Rapid Data processes the data on behalf of the funeral home.Purpose of Processing
The purpose is the creation, publication, and management of condolences and memorial contributions, as well as verification of the email address provided and the ability to subsequently edit one's own contributions.Legal Basis
Processing and publication take place on the basis of the consent given by the author pursuant to Art. 6(1)(a) GDPR.Consent may be withdrawn at any time with effect for the future. The lawfulness of processing carried out on the basis of the consent until its withdrawal remains unaffected.Recipients of Data
The recipients of the published content are the visitors to the publicly accessible memorial page.In addition, the data is processed by Rapid Data and, where applicable, further technical service providers as processors on behalf of the responsible funeral home.Transfer to Third Countries
No targeted transfer to a third country is planned; however, the publicly accessible website can be accessed from third countries.Storage Period
Published condolences generally remain stored for as long as the respective memorial page exists.A condolence is deleted earlier if the author withdraws their consent or if the condolence is removed for other reasons by the responsible funeral home.The contact details required for managing and verifying the contribution are stored for as long as is necessary for managing the condolence. Data required as evidence of consent given or withdrawn may be stored beyond this for the duration of statutory retention and limitation periods.Persons publishing images, videos, or texts may only upload content they are authorized to publish. This applies in particular where living persons, in addition to the deceased person, are recognizable in uploaded images or videos.3.4 Protection Against Spam and Misuse
A proprietary technical CAPTCHA solution is used when creating condolences. This is intended to prevent the function from being used in an automated or abusive manner.In particular, technical information about the respective access and interaction with the form may be processed.Purpose of Processing
Protecting the website and the condolence function against automated access, spam, and other misuse, and ensuring the security and functionality of the service.Legal Basis
Art. 6(1)(f) GDPR.The legitimate interest lies in safeguarding the website, preventing misuse, and preventing unwanted automated contributions.Recipients of Data
The CAPTCHA solution is operated by Rapid Data as a proprietary, in-house solution. The data generated is not transferred to external CAPTCHA providers.Transfer to Third Countries
No transfer to third countries takes place.Storage Period
The technical data generated is stored only for as long as necessary for detecting misuse and ensuring system security.3.5 Reporting and Deletion of Condolences
Memorial pages provide the option to report a condolence. This may occur, for example, if a contribution contains inappropriate content, infringes the rights of third parties, or the author wishes to have their own contribution removed.The report is forwarded to, or made available for processing by, the funeral home responsible for the respective memorial page.Purpose of Processing
Reviewing reported content, processing deletion requests, and ensuring the appropriate and lawful operation of the memorial pages.Legal Basis
Insofar as this concerns the general review of inappropriate or potentially unlawful content, processing takes place on the basis of Art. 6(1)(f) GDPR.The legitimate interest lies in moderating the content offered and protecting the rights of users and other data subjects.Insofar as the report involves the withdrawal of previously given consent or the exercise of a data subject right under data protection law, processing also takes place to fulfil the resulting legal obligations.Recipients of Data
The recipient is, in particular, the funeral home responsible for the memorial page. Rapid Data provides the function technically as a processor.Transfer to Third Countries
As a rule, no transfer to third countries takes place.Storage Period
Reports are stored for as long as necessary to review and process the respective matter. Any storage beyond this period takes place only insofar as it is necessary to fulfil statutory obligations or to assert, exercise, or defend legal claims.3.6 Sharing Memorial Pages
Memorial pages can be shared via various social networks and communication services, as well as by email, using a share function.The share function is designed so that merely accessing the memorial page does not automatically establish a connection to the respective social network. Only when the user selects the corresponding share button is the desired service invoked.In particular, the URL of the memorial page and the technical data generated when accessing the respective third-party provider may be processed.When sharing by email, the email program or email service set up on the user's device is invoked.Purpose of Processing
Enabling the user's desired sharing of a memorial page.Legal Basis
Insofar as we process personal data in connection with providing the share function, this takes place on the basis of Art. 6(1)(f) GDPR. Our legitimate interest lies in providing users with a simple means of sharing a memorial page.The subsequent processing carried out by the selected social network or communication service is generally the sole data protection responsibility of the respective provider.Recipients of Data
Only after active selection of the respective service: the provider selected by the user.Transfer to Third Countries
Depending on the provider selected, processing may also take place outside the European Union or the European Economic Area. Further information can be found in the privacy information of the respective provider.Storage Period
We generally do not independently store the information passed to the selected service via the share button.3.7 Technical Provision of the Website and Server Log Files
Each time our website is accessed, the web server processes technically required information (including the IP address and the date and time of the website visit).Purpose of Processing
Technical provision of the website, ensuring secure and stable operation, error analysis, and the detection and prevention of attacks and abusive access.Legal Basis
Art. 6(1)(f) GDPR.Our legitimate interest lies in the secure, functional, and trouble-free provision of our website.Recipients of Data
Further technical service providers engaged as processors. These are Microsoft Azure for hosting and Datadog for technical logging, each using data centers located in Europe.Transfer to Third Countries
As a rule, no transfer to third countries takes place.Storage Period
Technical log data is deleted after 90 days at the latest, unless longer storage is required to investigate a specific security incident.3.8 Consent Management with CookieYes
We use the consent management platform CookieYes on our website. The provider is:CookieYes Limited, 3 Warren Yard, Warren Park, Wolverton Mill, Milton Keynes MK12 5NW, United KingdomCookieYes is used to query, store, and implement the cookie and privacy settings of website visitors, and to document the consent given.In particular, a pseudonymous consent ID, the selected consent settings, and technical data such as IP address, user agent, and information on the website visit may be processed for this purpose.Purpose of Processing
Obtaining, managing, storing, and providing evidence of the data protection and cookie settings made by the user.Legal Basis
Insofar as information is stored on or read from the user's device and this is strictly necessary to provide the expressly requested consent management, this takes place pursuant to Section 25(2) No. 2 TDDDG (German Telecommunications and Digital Services Data Protection Act).The processing of personal data in connection with managing and documenting consent decisions takes place to fulfil our data protection documentation and accountability obligations under Art. 6(1)(c) GDPR. In addition, the technical provision of the consent management is based on Art. 6(1)(f) GDPR. The legitimate interest lies in the purposes mentioned above.Recipients of Data
CookieYes Limited and its subprocessors engaged in providing the service.Transfer to Third Countries
CookieYes Limited is based in the United Kingdom. An adequacy decision by the European Commission exists for the United Kingdom.CookieYes also engages subprocessors within and outside the European Economic Area. Insofar as data is transferred to countries without an adequacy decision, the transfer takes place, according to the provider, on the basis of appropriate safeguards, in particular standard contractual clauses, or, where applicable, on the basis of an adequacy decision.Storage Period
The cookie storing the consent preferences is stored for 365 days.3.9 Web Analytics with Matomo
We use Matomo for the statistical analysis of the use of our website.Matomo is only used if the website visitor has previously consented to the use of analytics technologies via the cookie banner.The IP address is shortened, i.e. anonymized, before further evaluation.Matomo uses cookies to statistically attribute recurring website visits. At least one of the analytics cookies used remains stored beyond the end of the respective browser session.Purpose of Processing
Statistical analysis of the use of our website, measurement of reach, and improvement of the design and usability of our website.Legal Basis
Art. 6(1)(a) GDPR.The storage of, or access to, the information required for this purpose on the user's device takes place on the basis of your consent pursuant to Section 25(1) TDDDG.Consent is voluntary and can be withdrawn at any time via the cookie settings with effect for the future.Recipients of Data
The data processed as part of Matomo is transferred, under a data processing agreement, to the provider of Matomo. This is: InnoCraft Ltd, 7 Waterloo Quay, PO Box 625, 6140 Wellington, New Zealand.Transfer to Third Countries
As a rule, no transfer of analytics data to a third country takes place. An adequacy decision exists for New Zealand.Storage Period
The analytics data is stored for 744 days.4. Data Subject Rights
Insofar as we process your personal data, you are entitled, in accordance with the statutory requirements, to the following rights in particular:- Right of access pursuant to Art. 15 GDPR
- Right to rectification pursuant to Art. 16 GDPR
- Right to erasure pursuant to Art. 17 GDPR
- Right to restriction of processing pursuant to Art. 18 GDPR
- Right to data portability pursuant to Art. 20 GDPR
- Right to object pursuant to Art. 21 GDPR