Privacy Policy — QR Memorial

1. Data controller

The data controller is:

MEMORIAL QR DI NICOLÒ FORESTI
VAT number (P.IVA): 04917250161
Registered office: Via Sandro Pertini 40, Bonate Sopra (BG) 24040, Italy
Email: info@qrmemorial.com

To exercise your GDPR rights or for any privacy request, email info@qrmemorial.com.

2. Scope

This Policy explains how we collect, use, protect, and share personal data when you use the QR Memorial website and related digital memorial, order, account, and support services.

3. Data we collect

Depending on how you use the service, we may process:

Contact and order data: name, email, phone (if provided), shipping address, order notes.
Payment data: handled by Stripe; we do not store full card numbers on our site.
Memorial content: photos, videos, texts, dates, messages, and the family-chosen PIN.
Account data: identifiers and authentication tokens (Amazon Cognito).
Comments and contributions on memorial pages (display name, text, optional images).
Technical browsing data: IP address, browser type, pages visited, security logs.
Cookies and analytics data: only with your consent, via Google Tag Manager / Google Analytics 4. See the Cookie policy.

4. Purposes and legal bases

We process data only for specific purposes and under Art. 6 GDPR legal bases:

Contract performance (Art. 6.1.b): orders, payments, shipping, memorial hosting, service-related support.
Legal obligation (Art. 6.1.c): tax and accounting duties related to sales.
Legitimate interest (Art. 6.1.f): site security, fraud/abuse prevention, non-invasive technical improvement.
Consent (Art. 6.1.a): analytics cookies (GA4 via GTM) and other optional processing where we ask for specific consent.

5. Recipients and processors

Data may be shared, within the purposes above, with:

Stripe — payments and checkout-related communications.
Amazon Web Services (eu-south-1, Milan) — API hosting, storage (e.g. S3), and authentication (Cognito).
Google (Google Tag Manager / Google Analytics 4) — only if you accepted analytics cookies.
Technical or legal consultants bound by confidentiality, when needed to run the service.

6. International transfers

Memorial content and core application data are hosted on AWS servers in the European Union (eu-south-1).

Some providers (especially Stripe and, if consented, Google) may process data outside the EEA. In those cases transfers rely on Standard Contractual Clauses and/or other safeguards under Arts. 44 et seq. GDPR.

7. Retention

We keep data for as long as needed for the purposes collected:

Order and billing data: for the periods required by applicable tax/accounting law.
Account and memorial content: for the life of the service until deletion/closure is requested, unless law requires longer retention.
Contact requests: for the time needed to handle the request and a limited follow-up period.
Analytics cookies: as described in the Cookie policy and until consent is withdrawn.
Security logs: for limited periods proportionate to system protection.

Detailed retention schedules may be refined with legal counsel; if in doubt, ask at info@qrmemorial.com.

8. Security

We apply appropriate technical and organisational measures to protect data against unauthorised access, loss, or alteration. Memorial pages may be protected by a family-set PIN.

9. Your rights

Under Arts. 15–22 GDPR you may request access, rectification, erasure, restriction, objection, data portability, and withdrawal of consent (without affecting prior lawful processing).

You may also lodge a complaint with the Italian Data Protection Authority (Garante) at www.garanteprivacy.it, or with your local supervisory authority.

To exercise your rights: info@qrmemorial.com.

10. Cookies

Details on cookie types, purposes, and consent management are in the Cookie policy.

Go to Cookie policy

11. Updates

This policy may be updated. The date at the top of the page shows the latest revision.