Privacy Policy

Last updated: May 24, 2026

In compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, GDPR) and the Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), users and clients of the www.luminamemorials.com platform are hereby informed regarding the processing of their personal data.

1. Data controller

• Identity: Pedro Sanz Bruguera (hereinafter, “Lumina Memorials”)
• Tax Identification Number (NIF): 43503332M
• Registered Address: Ronda Guinardó 68, 08025 Barcelona, Spain
• Contact Email: info@luminamemorials.com

2. Purposes of data processing

Personal data provided through the website will be processed for the following purposes based on user interaction:

• B2B client management: To manage the registration of funeral sector professionals, grant access to the administration panel, process the purchase of credits through the authorized payment gateway, and issue the corresponding invoices and tax receipts.
• Provision of digital services: To process basic identifying information and multimedia content provided by users and collaborators for the sole purpose of generating, rendering, and temporarily hosting the digital memory capsules (“Time Capsules”).
• Customer support: To manage, respond to, and process inquiries or technical issues submitted through the website’s contact forms.
• Commercial communications: To send information regarding platform updates, pricing, or new related services, provided that explicit consent has been granted in advance.
• Analytics and technical optimization: To conduct aggregate statistical analysis on browsing behavior in order to improve the usability, security, and performance of the platform.

3. Legal basis for processing

The legal foundation for processing your data depends on the specific interaction:

• Execution of a contract (Art. 6.1.b GDPR): Necessary for purchasing credits, maintaining a professional account, and the automated generation of the requested video capsules.
• Consent of the data subject (Art. 6.1.a GDPR): Applicable for sending operational commercial communications, submitting contact forms, and deploying analytics and marketing cookies.
• Compliance with legal obligations (Art. 6.1.c GDPR): Mandatory processing of billing and accounting identification data in accordance with Spanish tax and commercial regulations.
• Legitimate interest (Art. 6.1.f GDPR): Applicable for ensuring platform security, preventing fraud, and conducting technical performance audits of the site.

4. Data retention periods

• Commercial relationship data: Retained for as long as the account is active and, upon termination, during the legal limitation periods established by Spanish tax and commercial laws (up to 6 years for accounting records and invoices).
• Multimedia content and capsule data: Once a memory capsule is activated, all video files, photographs, audio files, and associated identifying data will remain accessible for a strict maximum period of thirty (30) calendar days. Upon expiration of this period, the system will execute an automated, definitive, and irreversible deletion from the servers. No backup copies of this material are retained.
• Marketing and analytics data: Retained until you withdraw your consent or request deletion.

5. Data recipients and international transfers

Your data will not be disclosed to unauthorized third parties unless required by law. To optimally provide our services, information is shared with the following data processors under strict confidentiality agreements:

• Cloud infrastructure: Amazon Web Services (AWS), utilizing data storage servers configured within the European Union.
• Payment gateway: Lemon Squeezy, acting as our Merchant of Record to securely process external payments.
• Analytics and optimization tools: Google Ireland Limited (Google Analytics 4, Google Tag Manager, and Google Search Console). The use of these tools involves technical data flows. In instances where information may be processed on servers in the United States by parent companies (Google or LinkedIn’s tracking pixel), these international transfers are fully safeguarded by the providers’ adherence to the EU-U.S. Data Privacy Framework (DPF) and the prior execution of Standard Contractual Clauses (SCCs) approved by the European Commission.

6. User rights

Users may exercise their rights of access, rectification, erasure (“right to be forgotten”), restriction of processing, objection, and data portability before the Data Controller.

• Procedure to exercise rights: To exercise any of these rights, simply send a written request via email to info@luminamemorials.com, detailing the right you wish to exercise and the context of the affected data.
• Identity verification: In strict compliance with the data minimization principle enforced by supervisory authorities, we do not systematically require a copy of your ID or passport. Lumina Memorials will only request additional documentation to verify the identity of the applicant in cases where there are reasonable doubts regarding the legitimacy of the request (e.g., if the request is sent from an email address not previously registered in our system).
• Right to lodge a complaint: If you believe that the processing of your personal data violates current regulations or that your rights have not been adequately addressed, you have the explicit right to lodge a complaint with the competent supervisory authority, the Spanish Data Protection Agency (Agencia Española de Protección de Datos - AEPD), through its official electronic headquarters at www.aepd.es.

7. Security measures

Lumina Memorials has implemented all necessary technical and organizational measures to guarantee the security of personal data and prevent its alteration, loss, unauthorized processing, or access. All data transmission and multimedia file uploads are encrypted using standard security protocols (HTTPS/TLS). Additionally, the specific web pages designed for the temporary collection of files and viewing of the capsules include explicit non-indexing directives to keep them completely hidden from public search engines.

8. Changes to this privacy policy

This privacy policy may be updated to reflect legislative or jurisprudential developments, as well as technical or operational changes to the platform. We recommend that users review this policy periodically before conducting transactions or using the platform’s tools.