Privacy policy

1. Who is responsible

1.1 The controller of the personal data processed through https://www.funerar.com is Weeleaks Technology Limited (C 116871), .

1.2 Any question about this policy, and any request to exercise a right, may be sent to [email protected].

2. People concerned

2.1 Funerar is a public register of death notices. Several categories of people are therefore concerned, some of whom have never used the Website:

• families and funeral professionals who publish a notice and open an account (“Publishers”);
• visitors who leave a tribute — a candle, a flower or a message;
• the deceased persons who are the subject of the notices;
• living relatives named in the text of a notice;
• recipients of an announcement card sent by a Publisher;
• funeral professionals listed in the directory.

2.2 The General Data Protection Regulation (GDPR) protects living persons. In France, the data of a deceased person falls under Article 85 of the French Data Protection Act (loi Informatique et Libertés), which allows directives to be given on the fate of their data and grants rights to heirs (section 13). Relatives named in a notice, for their part, fully benefit from the GDPR.

3. Data about Publishers

Account data

First name, last name, email address, hashed password or the identifier of the social account used to sign in, language.

Order and billing data

Notice concerned, press publications ordered, subscription, amounts, invoices, billing address and, where requested, phone number.

Payment data

Processed by Stripe. Funerar receives only payment references, never the card number.

Proof of acceptance

The date the terms were accepted, and the IP address and browser used.

Technical data

IP address, browser, pages viewed, security logs, and the referral source to the Website.

Correspondence

Messages exchanged with support.

4. Data contained in a notice and its memorial page

4.1 A notice contains the information entered by the Publisher: title, first name, last name, birth name, dates of birth and death, town of residence, details of the ceremony and of the funeral services company, and a free-text message which often names family members.

4.2 The memorial space may also contain a portrait, a cover photo, a photo gallery, a biography, a text from the family, an occupation, personal tastes and a song.

4.3 This information is public by nature: a notice and its memorial page can be viewed by any visitor and may be indexed by search engines. Uploaded photos are served from a public address. Publish only what the family agrees to make public.

4.4 The optional religious or secular symbol may reveal the beliefs of the deceased or of their family. It is displayed only if it is chosen by the Publisher, who thereby makes it public on their own initiative.

4.5 Where the ceremony is indicated as being held in private, its location and time are not displayed.

5. Data about tribute authors and announcement card recipients

Tribute

The name given by the author, their email address if they provide one, the type of tribute, the text of a message, the date it was left, and a salted hash of the IP address, used solely to limit abuse. The IP address itself is not stored with the tribute.

Publication

The author's name and the text of an approved tribute are public. The email address is never displayed.

Announcement cards

The email addresses entered by the Publisher and the sending date, kept so that the same recipient does not receive the announcement card twice and to apply the limit of 200 recipients per notice.

6. Data from public sources

6.1 The register may include notices drawn from the file of deceased persons publicly released by INSEE. Only the name, first names, sex, dates of birth and death, and the town of death are taken over. These notices contain no photo and no text from the family.

6.2 Any death appearing in the opt-out file published by INSEE is excluded before publication. Matching is based on the date, the town and the death certificate number; it is deliberately strict, so that no other death is ever wrongly excluded.

6.3 The directory of funeral professionals is compiled from the public business register (SIRENE). Only active establishments appear. Where a business has asked that certain of its information not be disclosed, that information is not taken over, and the establishment does not appear at all where its name itself is not releasable.

6.4 The legal basis for this processing is the legitimate interest of Funerar in maintaining a searchable register of deaths, based on data that the administration makes public. A relative may request the removal of a notice compiled in this way, and a professional may request the correction or removal of their listing (section 14).

7. Why data is processed, and on what basis

7.1 No decision producing legal effects is taken solely on the basis of automated processing.

8. Who receives the data

8.1 Personal data is never sold or rented. It is shared only with the recipients below and with a public authority where the law requires it. Processors are bound by a data processing agreement.

9. Transfers outside the EEA

9.1 The application, the database and the photos are hosted within the European Union.

9.2 Some of the processors listed above may process data outside the European Economic Area (EEA). These transfers are governed by the European Commission's standard contractual clauses and, where the provider is certified, by the EU-US Data Privacy Framework.

10. How long data is kept

10.1 When an account is erased, the deletion of its notices, memorial pages, photos and tributes may be deferred while a payment dispute is open, and for no more than 120 days after the last payment, the period during which a bank may still challenge a transaction.

11. Security

11.1 Traffic is encrypted in transit. Passwords are stored hashed, never in plain text. A notice, its memorial space and its pending tributes can be modified or moderated only from the account that published it, which is verified on every action.

11.2 Access to production systems is restricted to staff who need it.

11.3 Where a personal data breach is likely to result in a high risk to the rights of the persons concerned, those persons and the supervisory authority are informed within the time limits set by the GDPR.

12. Cookies and similar technologies

12.1 The Website uses:

• strictly necessary cookies — session, language, anti-bot verification and security protections — which do not require consent;
• audience measurement and advertising measurement cookies, set via Google Tag Manager, only according to the choices made in the cookie banner;
• an attribution cookie that records the referral source to the Website.

12.2 Choices can be changed at any time from the cookie banner or the browser settings. Refusing strictly necessary cookies prevents the Website from working.

13. Your rights

13.1 Any person whose data is processed has the right of access, rectification, erasure, restriction, objection and portability, as well as the right to withdraw any consent given at any time.

13.2 A Publisher may edit their notices and remove photos from their account. They may request erasure of their account from the website's data erasure request page: the request is confirmed by a link sent to the account's email address. Any ongoing subscription must be cancelled beforehand.

13.3 In accordance with Article 85 of the French Data Protection Act (loi Informatique et Libertés), any person may define directives on the fate of their data after their death. The heirs of a deceased person may request the updating or removal of information concerning them.

13.4 Any other request should be sent to [email protected] and will receive a response within one month, extendable by two months where the request is complex. Proof of identity or capacity may be requested where there is reasonable doubt about the identity or standing of the applicant.

13.5 Any person may lodge a complaint with the French data protection authority, the Commission nationale de l'informatique et des libertés (CNIL), www.cnil.fr, or with the supervisory authority of their country of residence.

14. Having a notice, tribute or listing removed

14.1 You are a relative of a person whose notice appears on Funerar and you are not its Publisher — in particular for a notice drawn from INSEE data? Write to [email protected] stating the address of the memorial page and your relationship to the deceased. It is free of charge, and no account is required.

14.2 You are named in the text of a notice, or visible in a photo, and you do not wish to appear? Contact the Publisher or write to [email protected]; Funerar will review the request together with the family.

14.3 You left a tribute and wish to remove it? Write to [email protected] from the email address given when you left it, or provide the details needed to identify it. In any case, a written message is published only after it has been approved by the Publisher of the notice.

14.4 You are a professional listed in the directory? You may ask [email protected] to correct or remove your listing.

15. Changes to this policy

15.1 This policy may be updated. The applicable version is the one published on the Website at the time of consultation; any material change will be announced by email or in the account.