1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
dkisoft
Daniel Kielmann-Hartung
Lützner Str. 16 B
04177 Leipzig
Email: dkielmann@dkisoft.de
2. General information on data processing
As a matter of principle, we process our users' personal data only to the extent necessary to provide a functioning platform along with our content and services. The legal bases are Article 6 (1) (b) GDPR (contract), Article 6 (1) (c) GDPR (legal obligation) and Article 6 (1) (f) GDPR (legitimate interests).
3. Processing when visiting the website
Each time the website is accessed, our hosting provider automatically records technical data (server logs):
- IP address (truncated/anonymised)
- Date and time of the request
- URL accessed and HTTP status code
- User agent and referrer
This data is stored on the basis of Article 6 (1) (f) GDPR in order to ensure operation and to defend against attacks. Logs are deleted after 30 days at the latest.
4. Account and authentication data
To use the platform, funeral homes create an account. The following data is processed:
- First and last name, business email address
- Password hash (BCrypt/Argon2 - plain text is never stored)
- Optional: two-factor authentication secret (TOTP)
- Login and security events (time, IP address, device)
The legal basis is Article 6 (1) (b) GDPR (performance of a contract) and Article 6 (1) (f) GDPR (IT security).
5. Fingerprint images and order data
In the course of order processing, the platform processes the following data on behalf of the funeral homes:
- Fingerprint images of the deceased (captured digitally or uploaded)
- Data on the deceased person (name, date of birth and date of death, order reference)
- Order metadata (workshop assignment, status, approvals)
This data is processed exclusively on the instructions of the respective funeral home (commissioned processing pursuant to Article 28 GDPR). A corresponding data processing agreement (DPA) is available for every funeral home.
Retention period: for the duration of order processing and for statutory retention periods. Once an order has been completed, the funeral home can delete the associated data itself at any time.
6. Disclosure of data to partner workshops
When a funeral home approves an order, selected data (fingerprint image, order reference) is transmitted to the partner workshop chosen by the funeral home. No disclosure beyond this takes place. Confidentiality and data protection are governed by contract.
7. Hosting and third countries
The platform is operated in European data centres. No data is transferred to third countries outside the EU/EEA. The data centres are certified to ISO 27001. Data is encrypted in transit (TLS 1.3) and at rest (AES-256); tenants are separated at database level.
8. Cookies
The platform uses strictly necessary cookies only (session, CSRF protection, language setting). There is no third-party tracking and no processing for advertising or analytics purposes.
9. Your rights
You have the right at any time to:
- Access (Article 15 GDPR)
- Rectification (Article 16 GDPR)
- Erasure (Article 17 GDPR)
- Restriction of processing (Article 18 GDPR)
- Data portability (Article 20 GDPR)
- Objection (Article 21 GDPR)
- Lodging a complaint with a supervisory authority (Article 77 GDPR)
To exercise your rights, an informal email to dkielmann@dkisoft.de is sufficient.
10. Amendments to this privacy policy
We reserve the right to adapt this privacy policy so that it always complies with current legal requirements or in order to reflect changes to our services. The version in force at the time of your visit applies.