1. Who we are
Funeral Invitations is a service of Aimori, located at Kampenstraat 2D, 7575 EK Oldenzaal, registered with the Netherlands Chamber of Commerce under number 98726137. In this policy, we simply call ourselves Aimori.
You can reach us about anything privacy-related at info@funeralinvitations.com.
2. Two kinds of data, two roles
We are responsible for your account data and your payments. This policy applies to them in full.
For the data you enter about a deceased person and the family, you as the funeral home are responsible. We only process it on your instructions. The arrangements for this are in the data processing agreement attached to our terms of service. If you are a family member and want to know or change something, please contact the funeral home. We are happy to help them with it.
3. What data, for what purpose and for how long
We do not process more data than needed. Below you can see, for each purpose, which data, on which legal basis under Article 6 GDPR, and how long we keep it.
- Purpose
- Creating and running your account
- What data
- Name, name of your business, email address, password (stored encrypted; we cannot read it)
- Legal basis
- Performance of the contract
- How long
- As long as your account exists
- Purpose
- Making and storing your video
- What data
- What you enter: name and dates of the deceased, photos, text, music and moments
- Legal basis
- Performance of the contract, on your instructions
- How long
- A video you do not edit or pay for in 30 days receives a warning; after 60 days we remove its images. For a paid video, the separate images are removed after 90 days; the final video and the share page remain as long as your account exists. You can delete everything sooner yourself
- Purpose
- Finding faults and improving the service
- What data
- Which step in the editor you took, whether an error occurred and when, linked to your account. No content of your video
- Legal basis
- Legitimate interest: finding and fixing errors
- How long
- 180 days
- Purpose
- Payment and invoicing
- What data
- Order, amount, date, payment status and Mollie's reference, and the invoice details you enter yourself (business name, address, VAT and Chamber of Commerce number and, if you enter it, a phone number). No account numbers or card details
- Legal basis
- Performance of the contract and a legal obligation
- How long
- 7 years, the Dutch tax retention requirement (Article 52 of the General Tax Act)
- Purpose
- Securing your account
- What data
- Failed login attempts: email address, IP address, type of device and approximate location
- Legal basis
- Legitimate interest: preventing break-ins
- How long
- 90 days
- Purpose
- Messages about your account
- What data
- Email address
- Legal basis
- Performance of the contract
- How long
- As long as your account exists
- Purpose
- Reminding you of an anniversary, if you turn this on yourself
- What data
- Your choice, the date of death in your videos and your email address. The email does not contain the name of the deceased
- Legal basis
- Consent: you turn it on and off yourself
- How long
- As long as you leave it on
- Purpose
- Answering your questions
- What data
- What you email us
- Legal basis
- Legitimate interest: helping you well
- How long
- 2 years after the last contact
- Purpose
- Contacting you if you ask us to
- What data
- Name, phone number, email address, possibly the name of your business, the time that suits you and anything you add
- Legal basis
- Legitimate interest: calling or emailing you back because you asked for it
- How long
- 30 days
- Purpose
- Preventing misuse of discounts and duplicate accounts
- What data
- Whether accounts share the same Chamber of Commerce number, email address, phone number or email domain. Only the administrator sees this; accounts are never merged automatically
- Legal basis
- Legitimate interest: preventing misuse of the welcome discount and helping customers well
- How long
- As long as the accounts exist
4. What we never do
- We do not sell or rent your data, and we do not give it to advertisers.
- We do not send newsletters or advertising unless you asked for them yourself. You can always withdraw such consent.
- We do not use your material or the families' material to train software or AI models.
- We do not make decisions about you based solely on automated processing and we do not create profiles of you.
- Aimori staff do not look at your videos, unless you ask us to yourself, for example in case of a fault.
5. Who we share data with
To make the service work, we engage a small number of specialized parties (sub-processors). We have a data processing agreement with each of them. Your data is stored in the European Union. Where a party may process data in the United States, the transfer is covered by the EU-U.S. Data Privacy Framework and/or the European Commission's standard contractual clauses.
- Party
- Supabase
- Purpose
- Database, accounts and file storage
- Where
- Frankfurt, Germany
- Party
- Vercel
- Purpose
- Running the website
- Where
- Your data is processed on servers in Frankfurt, Germany. Vercel is an American company; the European Commission's standard contractual clauses and the EU-U.S. Data Privacy Framework apply
- Party
- Mollie
- Purpose
- Payments. Mollie is also responsible for the payment itself and has its own privacy policy
- Where
- The Netherlands
- Party
- Mailjet (Sinch)
- Purpose
- Sending emails about your account, such as the confirmation link
- Where
- European Union
- Party
- Plausible Analytics
- Purpose
- Visitor numbers for the public pages. Without cookies, without IP addresses and never on your account pages or a shared link
- Where
- Germany
- Party
- Google Analytics (Google Ireland)
- Purpose
- Only if you say yes: how the public pages are used. Never on your account pages, a video or a shared link, and without the part of the address after the question mark
- Where
- Ireland; Google may also process data in the United States (EU-U.S. Data Privacy Framework and standard contractual clauses)
We only give data to others if the law requires us to, for example under a court order. If so, we will let you know, unless the law prohibits it.
We do not sell personal information and do not share it with anyone for cross-context behavioral advertising, as those terms are defined in California law.
6. Security
- All traffic between your browser and funeralinvitations.com runs over an encrypted connection.
- Passwords are only stored encrypted. We cannot see your password.
- The data of each account is strictly separated in the database. Another account cannot see your videos, not even indirectly.
- Photos and videos are kept in protected storage. They can only be viewed through temporary links that expire after a short time.
- Failed login attempts are recorded, and repeated attempts are slowed down by the login system.
- Only a small number of staff have technical access, solely for administration and faults.
- For support and quality control, the administrator of Funeral Invitations can view your videos and images. Each time this happens, we record who viewed which video and when. We never use your material for anything else.
- Deleted data also disappears from any backups within thirty days.
8. Data of deceased persons and relatives
The GDPR protects living persons. Data of someone who has died formally falls outside it. We still handle it with exactly the same care, because a photo or a name also concerns the family.
Photos and text in which relatives can be seen or recognized are personal data. The funeral home arranges the family's consent. If a family member wants something changed or removed, this can be done through the funeral home, or through us at info@funeralinvitations.com; we will then make sure it happens together with the funeral home.
9. Your rights
You have the right to:
- see what data we hold about you (access);
- have incorrect data corrected;
- have your data deleted;
- have the use of your data temporarily restricted;
- receive your data in a common file format (portability);
- object to processing based on our legitimate interest;
- withdraw consent you have given.
- Send your request to info@funeralinvitations.com, preferably from your account's email address. We will respond within one month. We never ask you for a copy of your ID; if we need to verify who you are, we do so through your account or your email address.
10. Your California and other US state privacy rights
US state privacy laws, such as the California Consumer Privacy Act as amended by the CPRA, apply to businesses above certain thresholds (in California, for example, annual gross revenue above about $26.6 million, or buying, selling or sharing the personal information of 100,000 or more consumers or households). At our current size, Aimori does not meet those thresholds, so these laws may not apply to us. We nevertheless offer the same rights to everyone:
You can ask to know which personal information we collect, use and disclose about you, to receive a copy, to correct it and to delete it, using the same address and the same one-month response time as above. We will not treat you differently for exercising these rights.
We do not sell personal information, do not share it for cross-context behavioral advertising, and do not use sensitive personal information to infer characteristics about you. Global Privacy Control is honored as described in the cookies section.
The categories of personal information we collect, their sources, purposes and retention are listed in the table in section 3; the categories of recipients are listed in section 5.
11. A complaint
If you are not satisfied with how we handle your data, please let us know first. If we cannot resolve it together, you can file a complaint with the Dutch Data Protection Authority via autoriteitpersoonsgegevens.nl.
If you live outside the EU, you can also contact the data protection or consumer protection authority where you live, such as your state attorney general in the United States.
12. If something does go wrong
Despite all measures, a data breach can occur. If so, we act immediately to limit the damage. Where the law requires it, we report it to the Dutch Data Protection Authority within 72 hours and inform the people affected. If it concerns data you hold with us as a funeral home, we will inform you no later than 48 hours.
If a breach affects residents of a US state, we will also notify the affected people and authorities as that state's breach-notification law requires.
13. Who the service is for
The service is intended for professionals who guide a farewell. You must be 18 or older to create an account.
The service is not directed at children under 13, and we do not knowingly collect personal information from them through the service (US Children's Online Privacy Protection Act). A video may show photos of family members, including children, that a funeral home uploads with the family's consent; we process those only on the funeral home's instructions. If you believe a child has given us personal information directly, email us and we will delete it.
14. Changes
We update this policy when the service or the law changes. You can see the date of the latest version at the top. We will notify you by email in advance of any important change, such as a new party processing data.
Questions about this document? Email us at info@funeralinvitations.com. We reply on business days.