Privacy Policy and GDPR Information

Introduction

This notice explains how UltimoSaluto® collects, uses, protects, retains and deletes data processed through the website, the self-service journey, the assisted service and the B2B portal. Processing is carried out in accordance with the GDPR, the Italian Personal Data Protection Code and the applicable legislation.

1. Data controller

Suggested subject line: Privacy Request – UltimoSaluto.

2. Scope

This notice applies to families and self-service users, assisted-service customers, funeral agency representatives and operators, people who contact the service, and website visitors in relation to technical data and cookies.

3. GDPR roles in B2B relationships

For account management, security, support, administration and invoicing, UltimoSaluto® acts as data controller. For photographs, details of the deceased person, dedications and materials submitted by funeral agencies, the agency acts as data controller and UltimoSaluto® acts as data processor under Article 28 GDPR, within the limits of the applicable agreement.

4. Data processed

• Identification and contact details.
• Photographs, the commemorated person’s name, dates, dedications, text and design preferences.
• IP address, browser, device, technical logs and cookies.
• Administrative and tax data and payment-related identifiers.

Users should not submit excessive information or information unrelated to the requested service.

5. Purposes and lawful bases

6. How data is processed

Data is processed using IT systems and organisational procedures in accordance with the principles of lawfulness, transparency, data minimisation, accuracy, storage limitation, integrity and confidentiality.

7. Security and encryption

• HTTPS connections.
• Protected transmission and, in the relevant workflows, encryption.
• Temporary encrypted storage according to the service architecture.
• For protected B2B workflows, OpenPGP/GPG encryption and local decryption only for the period required to complete the work.
• Access limited to authorised systems and people.

8. Protecting entrusted memories

UltimoSaluto® does not create a permanent archive of photographs, memorial cards or videos. Content is used only for the requested service, is not sold and is not used for advertising without specific consent.

9. Artificial intelligence

UltimoSaluto® does not use Artificial Intelligence systems in Self services or for ordinary graphic and video work. Photograph enhancement, subject cut-out, background removal or replacement, clothing changes, graphic composition, visual effects and video editing are carried out with graphic and technical tools without AI processing.

Artificial Intelligence is used exclusively in the Assisted Service when the customer requests a change to the expression of the person depicted and when the photograph is technically suitable for the work. In such cases, the change is created from the original photograph and the result is subsequently reviewed and refined by an operator.

UltimoSaluto® does not use customer photographs to train or retrain its own Artificial Intelligence models. Data used for the specific processing are limited to what is necessary to provide the requested service.

Where external infrastructures or technical providers process data on behalf of UltimoSaluto®, the relationship is governed by the applicable terms and agreements. Any transfer outside the European Economic Area is handled in accordance with section 12.

10. Retention

Photographs, working files, previews, memorial cards, death notices, posters and videos are retained for the period strictly necessary to create and deliver them and to manage any requested corrections and, in all cases, for no more than 5 working days from completion of the work.

No permanent archive is maintained, except where there is a documented request from the customer or agency, a temporary need relating to security or the handling of a dispute, a legal obligation, or a request from a competent authority. Tax data, account data and technical logs are retained for the periods required by law or for the period necessary for security and the protection of legal rights.

11. Recipients and providers

Data may be processed by authorised staff, hosting and server providers, technical providers and, only for expressive processing requested within the Assisted Service, infrastructures used for AI processing, email and PEC services, payment providers, advisers and authorities. Where applicable, providers are appointed as data processors under Article 28 GDPR.

12. Transfers outside the EEA

Any transfer outside the European Economic Area is carried out in accordance with Chapter V GDPR through adequacy decisions, Standard Contractual Clauses or other safeguards provided by law.

13. Payments

Payments are handled by specialist providers. UltimoSaluto® may receive the transaction result, amount and identifier, but does not retain full card details where those details are processed directly by the payment provider.

14. Cookies

The website uses technical cookies that are necessary for its operation and may use non-essential cookies or technologies only after obtaining the user’s consent where required. CookieYes manages the cookie banner and cookie preferences. Choices can be changed at any time by reopening the preferences panel available on the website.

15. Your rights

In the cases provided for by Articles 15 to 22 GDPR, the data subject may exercise the rights of access, rectification, erasure, restriction, objection and portability, and may withdraw consent where processing is based on consent.

Requests may be sent to the data controller’s contact details. To protect the data, verification of the requester’s identity and authority may be required. The controller responds within the time limits set out in Article 12 GDPR, generally within one month.

The data subject may also lodge a complaint with the Garante per la protezione dei dati personali, another competent supervisory authority, or seek a judicial remedy.

16. Deceased persons

The GDPR applies to living natural persons. In Italy, Article 2-terdecies of the Italian Personal Data Protection Code allows, in the cases provided for, rights relating to the data of a deceased person to be exercised by a person who has an interest of their own, acts to protect the data subject, or has family reasons worthy of protection.

Anyone who uploads photographs, names, dates, dedications or other information declares that they have the necessary authority, mandate or permission and undertakes to respect the rights of the commemorated person and of any living persons appearing in the content.

17. Automated decisions

No decision is made solely by automated processing where it produces legal or similarly significant effects.

18. Trade mark and project

UltimoSaluto® is a registered trade mark. Unauthorised reproduction of the trade mark, text, images, templates, workflows, interfaces and design solutions is prohibited to the extent permitted by applicable law.

19. Updates

This notice may be updated following legal, technical, organisational or service changes. The current version is identified by the date and version number shown at the beginning of the page.

Current version: 1.2 dated 14 August 2026.

20. Contact