This Privacy Notice ("Privacy Notice") explains how The Lasting Echo Kft. (seat: 1016 Budapest, Hungary, Naphegy utca 21. 2. em. 1A. a.; company reg. nr.: 01-09-363191 in the registry of the Budapest Capital Regional Court), the operator of the LastingEcho platform (hereinafter the "Company", "we", "our" or "us") collects, uses, stores, shares and otherwise processes personal data in connection with the operation of the online memorial platform available through the Service.
The Company is committed to protecting the privacy and personal data of its Users and all other individuals whose personal data may be processed through the Service.
This Privacy Notice has been prepared in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation – "GDPR"), together with any applicable national data protection legislation implementing or supplementing the GDPR.
This Privacy Notice forms an integral part of the Company's legal documentation and should be read together with the Terms and Conditions, the Cookie Policy and any other policies referenced therein. The undefined capital expressions used in this Privacy Notice shall have the meaning defined in the Terms and Conditions.
Unless expressly stated otherwise in this Privacy Notice, the data controller responsible for the processing of personal data is:
The Lasting Echo Kft.
Registered office: 1016 Budapest, Hungary, Naphegy utca 21. 2. em. 1A. a
Company registration number: 01-09-363191 in the registry of the Budapest Capital Regional Court
Email: support@lastingecho.com
Website: www.thelastingecho.com
This Privacy Notice applies to all personal data processed by the Company in connection with:
This Privacy Notice applies regardless of whether personal data are collected directly from the data subject or indirectly from another User or another lawful source.
The primary purpose of the Service is to enable Users to preserve and share memories relating to deceased individuals. The Company acknowledges that, under the GDPR, the personal data of deceased persons are generally not protected as personal data. Accordingly, information relating solely to deceased persons does not fall within the material scope of the GDPR.
However, the Service frequently processes personal data relating to living individuals in connection with Memorial Profiles, including but not limited to:
This Privacy Notice applies exclusively to the processing of personal data relating to living natural persons.
Nothing in this Privacy Notice shall be interpreted as limiting any personality rights, copyright, image rights, confidentiality obligations or other legal protections relating to deceased persons under Applicable Law.
For the purposes of this Privacy Notice, unless the context otherwise requires:
"Applicable Law" means all applicable data protection, privacy and related legislation, including the GDPR and any national legislation implementing or supplementing it.
"Company" means the operator of the Service identified in Section 1. The Company is also the controller of the personal data.
"Personal Data" means any information relating to an identified or identifiable natural person within the meaning of Article 4(1) GDPR.
"Processing" means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means.
"User" means any person using the Service, whether registered or not.
"Account Owner" means a User who has created a registered account.
"Memorial Profile" means an online memorial page dedicated to a deceased person.
"Recovery Contact" means a person designated by a User to perform limited administrative functions after the User's death, as described in the Terms and Conditions.
"User Content" means any photographs, videos, audio recordings, texts, comments or other content uploaded through the Service.
Terms defined in the Terms and Conditions have the same meaning in this Privacy Notice unless expressly stated otherwise.
The Company processes personal data in accordance with the principles set out in Article 5 GDPR.
Accordingly, personal data shall be:
The Company also implements appropriate technical and organizational measures designed to demonstrate and ensure compliance with these principles.
The Service enables Users to upload information relating to both deceased persons and living individuals. Each User is solely responsible for ensuring that any personal data submitted through the Service have been collected and disclosed in accordance with Applicable Law. Where a User uploads photographs, videos, audio recordings or other information containing personal data relating to living persons, the User is responsible for ensuring that an appropriate legal basis exists for such processing.
The Company does not verify, prior to publication, whether the User has obtained any consent or other authorization required under Applicable Law.
| Processing | Categories of personal data | Purpose of procession | Legal basis |
|---|---|---|---|
| Account registration and User Account management | full name; username; email address; password (stored in encrypted or hashed form only); profile photograph (optional); language preferences; country of residence; account settings; login history; IP address; device identifiers; browser information; security logs; account creation date; account status; authentication records | creating and maintaining User Accounts; authenticating Users; providing access to the Service; administering User preferences and account settings; enabling the use of Memorial Profiles, Legacy Profiles and other functionalities; communicating with Users regarding their Accounts; ensuring the security and integrity of the Service | for the performance of the contract between the User and the Company pursuant to Article 6(1)(b) GDPR; and to pursue the Company's legitimate interests under Article 6(1)(f) GDPR, consisting of protecting the Service against fraud; ensuring network and information security; preventing unauthorized access; and maintaining reliable operation of the Service |
| Authentication and Account Security | login credentials; encrypted passwords; authentication tokens; password reset requests; IP addresses; timestamps of authentication events; device information; browser information; operating system information; approximate geolocation derived from IP address; failed login attempts; security alerts; other technical security logs | User authentification; detection of suspicious login attempts; prevention of unauthorized access; monitoring account security; protection against fraud; management of password resets; implementation of multi-factor authentication, where available; integrity ensurance of User Accounts | for the performance of the contract pursuant to Article 6(1)(b) GDPR; and for the purposes of the Company's legitimate interests under Article 6(1)(f) GDPR in ensuring the confidentiality, integrity and security of the Service |
| Communications Relating to the Service | name; email address; Account identifier; language preference; communication history; support reference numbers; and delivery status of communications | Account administration; security incidents; password resets; Subscription status; payment confirmations; service notifications; updates to the Terms and Conditions; updates to this Privacy Notice; important technical announcements; other communications necessary | for the performance of the contract pursuant to Article 6(1)(b) GDPR; and to comply with legal obligations pursuant to Article 6(1)(c) GDPR where the communication is required by Applicable Law |
| Memorial Profiles | name of the Account Owner; username; profile photograph of the Account Owner; relationship to the deceased (where voluntarily provided); photographs or videos depicting living persons; audio recordings containing identifiable voices; comments, tributes and guestbook entries; usernames of contributors; dates and timestamps of contributions; moderation history; reports submitted by Users; correspondence relating to the Memorial Profile; technical metadata associated with uploaded Content. | create and publish Memorial Profiles; identify the creator or administrator of the Memorial Profile; enable contributions from other Users; facilitate commemorative interactions through the Service; administer visibility settings and permissions; respond to reports, legal requests and moderation actions; and operate, secure and improve the Service. | Article 6(1)(b) GDPR, where processing is necessary for the performance of the contract with the Account Owner. The Company also relies on Article 6(1)(f) GDPR for its legitimate interests in: operating and maintaining the memorial platform; enabling collaborative remembrance; protecting the security and integrity of the Service; preventing abuse; resolving disputes concerning Memorial Profiles; exercising and defending legal claims; and protecting the rights of Users and third parties. |
| Legacy profiles | identification details; photographs; videos; audio recordings; written memories; personal messages; family information voluntarily provided by the User; biographical information; instructions concerning publication; Recovery Contact details; visibility settings; and associated technical metadata. | enabling future publication of commemorative materials; preserving digital memories; administrate User instructions relating to the Legacy Profile; facilitating the transition of the Legacy Profile following the User's death; and enabling designated Recovery Contacts to perform administrative functions where applicable. | Article 6(1)(b) GDPR, where processing is necessary for the performance of the contract with the Account Owner. The Company also relies on Article 6(1)(f) GDPR for its legitimate interests in securely maintaining Legacy Profiles; preventing unauthorized access; ensuring continuity of the Service; administering Recovery Contact requests; protecting the rights of Users and third parties; and establishing, exercising or defending legal claims |
| Recovery Contacts | full name; email address; telephone number (where provided); relationship to the User (where voluntarily provided); authentication and verification records; communications with the Company; records of requests submitted through the Service; technical identifiers associated with the use of the Service. | record the User's designation; contact the Recovery Contact where appropriate; verify the identity of the Recovery Contact; administer posthumous account management procedures; prevent unauthorized access to User Accounts; comply with legal obligations; establish, exercise or defend legal claims | Article 6(1)(f) GDPR, based on the Company's legitimate interests in ensuring secure succession of account administration, preventing unauthorized access and protecting the interests of Users and third parties. |
| Delivery services | name, postal address, phone number | Delivering the physical objects ordered e.g. the Echo Plaque | Article 6(1)(b) GDPR where processing is necessary for the performance of the contract with the Account Owner. |
| Direct Marketing | name, e-mail address | Informing customers about latest developments, updates and special offers regarding the Service | Article 6(1)(a) GDPR, based on the data subject’s expressed consent. |
The Company does not intentionally collect special categories of Personal Data.
The provision of the Personal Data identified as mandatory during registration is necessary for the conclusion and performance of the contract. Failure to provide such data will prevent the Company from creating or maintaining a User Account.
Where a User voluntarily publishes Personal Data relating to themselves or another living individual through a Memorial Profile, the User is responsible for ensuring that an appropriate legal basis exists for such publication.
Personal Data may be shared with data procecssors, such as cloud hosting providers; authentication service providers; IT infrastructure providers; customer support providers; security service providers.
Recipients – including data processors - shall process Personal Data only to the extent necessary for the relevant services and subject to appropriate contractual safeguards where required by the GDPR.
Personal Data contained in or relating to Memorial Profiles may be disclosed to:
The Company shall not sell Personal Data contained in Memorial Profiles.
Account-related Personal Data are retained for the duration of the User Account. Following deletion or termination of the Account, the Company may retain certain information where necessary:
After expiry of the applicable retention periods, Personal Data shall be securely deleted or irreversibly anonymized.
Authentication logs shall be retained only for as long as reasonably necessary for security, fraud prevention and compliance purposes, unless a longer retention period is required by Applicable Law or necessary in connection with legal proceedings.
Communications relating to the administration of the Service shall be retained only for the period necessary to demonstrate contractual performance, resolve disputes or comply with Applicable Law.
Information concerning the deceased may also be stored within the Memorial Profile. Such information is generally outside the material scope of the GDPR unless it also constitutes Personal Data relating to an identifiable living individual.
Memorial Profiles shall remain available for the period determined by:
Where a Memorial Profile is removed, the Company may retain limited copies for backup, security, dispute resolution or legal compliance purposes for the period reasonably necessary for those purposes.
Legacy Profiles shall be retained for the duration of the User's Account and thereafter in accordance with:
Where continued retention is no longer justified, Personal Data shall be securely deleted or irreversibly anonymized.
Personal Data relating to Recovery Contacts shall be retained for the duration of the relevant User Account and thereafter only for as long as necessary to:
Depending on the settings selected by the Account Owner or administrator, a Memorial Profile may be:
Users are solely responsible for selecting the appropriate visibility settings.
The Company cannot guarantee that publicly available information will not be viewed, indexed or copied by third parties, subject to the technical safeguards implemented by the Company.
Publication of a Legacy Profile following the User's death shall occur only in accordance with:
The Company may require reasonable evidence of the User's death before activating any posthumous publication features.
The Service is intended primarily for adults and is not directed to children. The Company does not knowingly collect Personal Data directly from children in connection with the creation of User Accounts.
Where Applicable Law requires parental consent for the processing of a child's Personal Data, the Company reserves the right to request evidence of such consent before providing the relevant functionality.
Users remain solely responsible for ensuring that they have an appropriate legal basis for uploading photographs, videos or other content depicting children or containing Personal Data relating to children.
Where the Company becomes aware that Personal Data have been collected from a child in violation of Applicable Law, it shall take appropriate steps to delete or otherwise lawfully process such data.
Nothing in this Section prevents the inclusion of lawful commemorative information relating to deceased children within Memorial Profiles, provided that the processing of Personal Data relating to living individuals complies with Applicable Law.
Where Personal Data are transferred outside the European Economic Area ("EEA"), the Company shall ensure that an appropriate transfer mechanism under Chapter V GDPR is implemented, including, where applicable:
Further information regarding international transfers may be requested using the contact details provided in this Privacy Notice.
The Company respects the rights of data subjects under the GDPR and is committed to facilitating the exercise of those rights in accordance with Applicable Law.
Requests relating to Personal Data may be submitted using the contact details provided in this Privacy Notice.
The Company may request reasonable information necessary to verify the identity of the requester before acting upon a request.
Right of Access: Data subjects have the right to obtain confirmation as to whether the Company processes their Personal Data and, where that is the case, to request access to such Personal Data together with the information required under Article 15 GDPR.
Right to Rectification: Data subjects have the right to request the correction of inaccurate Personal Data and the completion of incomplete Personal Data without undue delay. Where technically feasible, certain Personal Data may be corrected directly through the User Account.
Right to Erasure: Data subjects may request the deletion of their Personal Data where one of the grounds set out in Article 17 GDPR applies. The Company may refuse or postpone deletion where continued processing is necessary:
Deletion of Personal Data may result in the inability to continue using certain features of the Service.
Right to Restriction of Processing: Data subjects may request restriction of processing where the conditions set out in Article 18 GDPR are satisfied. During the period of restriction, the Company may continue processing Personal Data only where permitted by the GDPR.
Right to Data Portability: Where processing is based on Article 6(1)(b) GDPR or consent and carried out by automated means, data subjects may request to receive their Personal Data in a structured, commonly used and machine-readable format or request that such data be transmitted to another controller where technically feasible. This right applies only to Personal Data provided by the data subject and only where the GDPR grants such right.
Right to Object: Where Personal Data are processed on the basis of the Company's legitimate interests pursuant to Article 6(1)(f) GDPR, the data subject may object to such processing on grounds relating to their particular situation. The Company shall cease processing unless it demonstrates compelling legitimate grounds which override the interests, rights and freedoms of the data subject or where processing is necessary for the establishment, exercise or defence of legal claims. Where Personal Data are processed for direct marketing purposes, the data subject has the right to object at any time and free of charge.
Withdrawal of Consent: Where processing is based on consent pursuant to Article 6(1)(a) GDPR, the data subject may withdraw such consent at any time. Withdrawal of consent shall not affect the lawfulness of processing carried out before the withdrawal.
Automated Decision-Making: The Company does not make decisions producing legal or similarly significant effects based solely on automated processing within the meaning of Article 22 GDPR, unless expressly stated otherwise and permitted by Applicable Law. Should such processing be introduced in the future, the Company shall provide the information required by the GDPR.
Exercising Rights: The Company shall respond to requests without undue delay and, in any event, within one month of receipt of the request, unless the GDPR permits an extension. Where a request is manifestly unfounded or excessive, particularly because of its repetitive character, the Company may:
to the extent permitted by Article 12 GDPR.
The Company encourages data subjects to contact it first if they have any questions or concerns regarding the processing of Personal Data.The Company will make reasonable efforts to investigate and resolve concerns promptly and fairly. Without prejudice to any other administrative or judicial remedy, every data subject has the right to lodge a complaint with the competent supervisory authority if they consider that the processing of their Personal Data infringes the GDPR.
Where the Company is established in the European Union, the competent supervisory authority will generally be the supervisory authority of the Member State in which the Company has its main establishment or the data subject habitually resides as provided by the GDPR. The main supervisory authorithy according to the controller’s establishment is the Hungarian authorithy:
Nemzeti Adatvédelmi- és Információszabadság Hatóság (seat: 1055 Budapest, Hungary, Falk Miksa utca 9-11.; e-mail: ugyfelszolgalat@naih.hu; web: www.naih.hu).
Nothing in this Privacy Notice limits the right of any data subject to seek judicial remedies available under the GDPR or Applicable Law. As per the laws of Hungary – where the data controller is established – the data subject has the right to seek judicial remedy at the regional courts (törvényszékek). The procedure can take place either before the court with jurisdiction over the data controller’s registered office or the data subject’s place of residence.
The Company may amend this Privacy Notice from time to time where reasonably necessary, including to reflect changes in the Service, introduce new functionalities, comply with Applicable Law, reflect changes in data processing activities, implement security improvements, or improve transparency regarding the processing of Personal Data. Where required by Applicable Law, the Company shall provide appropriate notice before material changes become effective.
The latest version of this Privacy Notice shall always be made available through the Service and shall indicate its effective date.
Continued use of the Service following the effective date of this Privacy Notice shall not affect any rights granted to data subjects under the GDPR and shall not constitute consent where consent is required under Applicable Law.
