This policy describes how ILAB24 STUDIO SRL (“we”, “the platform”) processes personal data in the context of providing a digital service for creating and managing memorial pages accessible via QR code, available in Romania and the European Union.

We are committed to complying with Regulation (EU) 2016/679 (“GDPR”) and applicable data protection legislation.

1. Who we are
ILAB24 STUDIO SRL is a legal entity registered in Romania, with its registered office at Intrarea Gheorghe Simionescu, Nr. 19, Ap. B26, Sectorul 1, Bucharest, and acts as a data controller within the meaning of the GDPR.

For any requests regarding personal data, you may contact us at:
memory@inmysoul.eu

2. Categories of data we process
We process the following categories of data:
a) User data (living persons):
- name, email address
- authentication data
- payment information (processed by authorized providers)
- contact and communication data
b) User-provided content:
- texts, images, biographical data
- commemorative messages
- other information voluntarily uploaded

3. Data relating to deceased persons
The platform allows users to enter information about deceased persons exclusively for memorial purposes.
Under the GDPR, data relating to deceased persons does not constitute personal data. However, we reserve the right to intervene with respect to published content if it:
- infringes the rights of other living persons
- contains sensitive data of third parties
- is contrary to the law or public morals
Responsibility for the legality and accuracy of the published content lies with the user who publishes it.

4. Purposes and legal bases of processing
We process data for the following purposes:
- creation and management of the user account
- provision of the memorial page and QR code service
- payment processing and subscription management
- ensuring the technical operation and security of the platform
The legal bases for processing are:
- performance of a contract
- user consent
- the legitimate interest of the controller

5. Public nature of memorial pages
Memorial pages associated with QR codes are public and may be accessed by any person who scans the code.
The user is informed of and accepts the public nature of the published information.

6. Data retention period
Data is stored:
- for the duration of the account and subscription
- until an explicit deletion request is received
- or in accordance with applicable legal obligations

7. Data recipients
Data may be disclosed to:
- IT and hosting providers within the EU
- payment processors
- public authorities, where a legal obligation exists

8. International data transfers
As a rule, data is stored within the European Union.
If data is transferred outside the EU, such transfers will be carried out in accordance with the GDPR, based on standard contractual clauses.

9. Data security
We implement appropriate technical and organizational measures, including:
- encryption
- controlled access
- secure servers

10. User rights
Users benefit from the rights provided by the GDPR:
- right of access
- right to rectification
- right to erasure
- right to restriction of processing
- right to object
- right to data portability
Requests may be sent to the contact address indicated above.

11. Online payments and data processing
For processing online payments on this website, we use the services provided by NETOPIA Payments.
At the moment a payment is initiated, certain personal data may be transmitted to the payment processor, including but not limited to:
- first and last name
- email address
- phone number
- order details (products, amount, transaction identifier)
Bank card details are NOT processed and are NOT stored by us; they are handled exclusively by the payment processor under secure conditions, in accordance with applicable standards.
The purpose of processing this data is to complete payment transactions and to perform the contract between the user and the website operator, in accordance with Article 6(1)(b) of the GDPR.
In the context of payment processing, both we and the payment processor act as independent data controllers, each being responsible for their own data processing activities.
For more information on how your data is processed by the payment processor, please refer to its privacy policy available on its website.

12. Users rights
Users have the following rights regarding their personal data:
- the right of access
- the right to rectification
- the right to erasure (“right to be forgotten”)
- the right to restriction of processing
- the right to object
- the right to data portability
To exercise these rights, you can contact us at the email address указан on the website.
You also have the right to lodge a complaint with the competent data protection authority.

13. Contact
For any questions regarding data protection:
memory@inmysoul.eu