Who is the data operator
The personal data operator (controller) is Echipa De Tocilari SRL (Tax ID/CUI 47591744, Trade Register J40/2298/2023), the funeral house operating under the name Agenția Funerară Sobru (website: sobru.ro). It determines the purposes and means of the data processing described in this policy.
For any personal data request (GDPR rights), contact us at dpo@sobru.ro or by phone (see /contact/).
What data we collect
- Family personal data: name, phone, email, address (for delivery/contact)
- Deceased data: name, ID number, birth date, death date, cause of death, place of death
- ID documents (copies) — for obtaining official documents
- Pension stub — for CNPP funeral aid file
- Financial details — for invoicing and payment (bank account, amounts)
- Ceremony details: church, cemetery, priest, date, guests
- Communications with our team (calls, WhatsApp messages, email)
Data collected through the website (online forms)
In addition to data from the direct relationship (contract, documents, ceremony), sobru.ro collects data through public forms. We use it solely to respond to your request or to moderate content published with the family's consent.
- Contact / callback / consultation form: name, phone, email (optional), message, city, service of interest, urgency, page language
- Technical metadata on submission: IP address, user-agent (browser), referrer (source page) — for anti-spam security and technical logging
- Condolence messages (obituary pages): author name, message text, obituary identifier — published only after moderation, with explicit consent
- Memorials sent by families (the memorial publishing page): about the person who died — name, dates of birth and death, town, faith, the memorial text, a photo (optional) and the signature; these are published only after we have read them
- About the person who sends a memorial: name, relationship to the person who died, email, phone (optional), the text of the consent given and the time it was sent — these are never published
- Analytics cookies (Google Analytics 4) — only with consent via banner; details in /cookies/
| Service | Role | Data transferred |
|---|---|---|
| ServiceSupabase (EU) | RoleSecure storage of leads, condolences and memorials | Data transferredForm data + photo + IP + user-agent |
| ServiceResend (transactional email) | RoleInternal notification on a new lead or memorial; the email that tells the family their memorial is published | Data transferredName, phone, email, message or memorial text (no IP in email) |
| ServiceTypeSafe | RoleAutomated check of a memorial's text before a member of our team reads it (it flags, for example, a complaint or unsuitable text) | Data transferredThe memorial text, the name of the person who died and the signature (not the sender's contact details) |
| ServiceVercel | RoleSite hosting + cookieless analytics | Data transferredAggregated technical logs (no direct identification) |
| ServiceGoogle (GTM/GA4) | RoleTraffic analytics — consent only | Data transferredAnalytics identifiers (cookies) |
We do not sell data to these providers; they process on our behalf under contract and GDPR. TypeSafe processes data under its data processing agreement; where data leaves the European Economic Area, the transfer relies on the European Commission's standard contractual clauses (Decision 2021/914). The provider states that it does not use customer data to train its models.
How we use data
- To deliver contracted funeral services (transport, formalities, ceremony)
- To issue official documents (death certificate, sanitary clearance) on family's behalf
- To submit funeral aid file to CNPP (via assignment)
- To issue invoices and collect payment
- To coordinate with necessary third parties (church, cemetery, crematorium, DSP)
- For post-ceremony assistance (if family contacts us with questions)
- For legal obligations (Tax Code, Law 102/2014, ANPC)
Legal basis for processing
We process your data on the following Art. 6 GDPR legal bases:
- Performance of a contract (Art. 6(1)(b)) — delivering funeral services, issuing documents, organizing the ceremony
- Legal obligation (Art. 6(1)(c)) — invoicing and tax reporting (Tax Code), the CNPP funeral aid file, records required by Law 102/2014
- Legitimate interest (Art. 6(1)(f)) — operational communications about the case and post-ceremony assistance
- Consent (Art. 6(1)(a)) — marketing communications, only where you explicitly grant it; you may withdraw it anytime
- Consent (Art. 6(1)(a)) — submitting online forms, obituary condolence messages and memorials on the website, including the automated check of the memorial text and the email telling you it is published
- Legitimate interest (Art. 6(1)(f)) — anti-spam security (IP, rate limiting) on public forms
Whom we share data with
Data is shared only with parties strictly necessary for service delivery:
- Romanian National Pension House (CNPP) — for funeral aid
- Romanian Public Health Directorate (DSP) — for sanitary clearance
- Civil Status office — for official death certificate
- Church chosen by family — for service organization
- Cemetery or crematorium — for ceremony scheduling
- Service suppliers (catering, florist, monuments) — only relevant elements
- Our banks — for payment collection
- Tax authorities — on request, per Tax Code
How long we keep data
Financial data (invoices, payments) — 10 years, per Romanian Tax Code.
Contract data (funeral services contract) — 5 years from contract closure.
Marketing data (newsletter, promotional messages, if consented) — until consent withdrawal.
Communication data (calls, WhatsApp, email) — 2 years from last communication.
Memorials sent through the website — stay online for as long as the family wishes; on request we correct or remove them. The sender's name, relationship to the person who died, email and consent are kept while the memorial is published, as proof of consent. The phone number, IP address and user-agent are deleted 30 days after publication.
Rejected memorials — the photo is deleted at once; the text and the sender's details are deleted 30 days after rejection.
After these periods, data is deleted or irreversibly anonymized.
Your rights
- Right of access — you may request a copy of data we have about you
- Right of rectification — correcting incorrect or incomplete data
- Right of erasure („right to be forgotten”) — under certain conditions
- Right to restrict processing — in certain cases
- Right of portability — receiving data in a structured format
- Right to object to direct marketing
- Right to lodge complaint with Romanian National Authority for Personal Data Protection (ANSPDCP)
Cookies and similar technologies
The site uses one technical cookie (to remember the chosen language). For analytics we use Vercel Analytics and Speed Insights (without cookies) and Google Analytics 4, loaded via Google Tag Manager — the latter only with your consent (Consent Mode v2): without consent no cookies are set and no identifiers are stored. Full details at /cookies/.