Privacy Policy
Last updated: 25 June 2026
This Privacy Policy explains how ANCVAJ s. r. o., company ID (IČO) 56 298 731, Tax ID (DIČ) 2122266388, VAT ID SK2122266388, registered office at Lúčna 1014/9, 014 01 Bytča, Slovakia ("we", "us", "our"), processes your personal data when you use mindelund.com (the "Mindelund" service; the "Service"). We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and Slovak data protection law (Act No. 18/2018 Coll.).
1. Data controller
The data controller for your personal data is:
ANCVAJ s. r. o.
Lúčna 1014/9, 014 01 Bytča, Slovakia
Company ID (IČO): 56 298 731 — registered in the Commercial Register of the District Court Žilina, section Sro, insert No. 85196/L
Tax ID (DIČ): 2122266388 — VAT ID: SK2122266388
Email: [email protected]
Data Protection Officer (DPO): not appointed — contact us at [email protected]
2. What personal data we process
| Category | Examples | Source |
|---|---|---|
| Account data | Email address, chosen language, account creation date | You |
| Authentication data | Magic-link tokens, login timestamps, IP address | You / automatic |
| User content | Pet photos, pet names, dates, epitaphs, stories | You |
| Payment data | Limited transaction metadata (order ID, amount, status, email); full card details are processed by Link/Stripe as the merchant of record — we neither receive nor store them | You / Link/Stripe (seller) |
| Technical data | IP address, browser/device type, cookies (see Cookie Notice) | Automatic |
| Communications | Emails you send us, support requests | You |
| Guest book (condolences) | Message text, author's email address, chosen language, time of creation | You |
We do not intentionally collect special-category (sensitive) personal data. Please do not include such data in photos or text.
A guest-book message is published on the memory's page (the page may be indexed by search engines) and signed with the author's initials only (e.g. "J. N."); we never publish the author's email address.
3. Purposes and legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Creating and managing your account; passwordless login | Performance of a contract (Art. 6(1)(b)) |
| Hosting and displaying your memorials and photos | Performance of a contract (Art. 6(1)(b)) |
| Keeping records of paid orders for accounting and tax purposes | Legal obligation (Art. 6(1)(c)) — accounting and tax rules, including the retention period |
| Activating and granting access to a paid feature (linking the payment to your account, unlocking a memory/garden) | Performance of the contract for using the Service between us and you (Art. 6(1)(b)) |
| Reconciling payouts, resolving disputes with the payment provider (Link/Stripe), and fraud prevention | Legitimate interests (Art. 6(1)(f)) |
| Security, fraud prevention, maintaining the Service | Legitimate interests (Art. 6(1)(f)) |
| Sending service emails (e.g. magic links, transactional notices) | Performance of a contract (Art. 6(1)(b)) |
| Marketing emails, if any | Consent (Art. 6(1)(a)) — withdrawable at any time |
| Publishing a guest-book message and the related automatic creation of the author's account | Consent (Art. 6(1)(a)) — withdrawable at any time |
| Email notification to the memory's owner about a new message (with opt-out) | Legitimate interests (Art. 6(1)(f)) |
| Non-essential cookies/analytics | Consent (Art. 6(1)(a)) |
| Complying with legal/accounting obligations | Legal obligation (Art. 6(1)(c)) |
Sales of premium features run through Stripe Managed Payments, in which the seller towards you (the merchant of record) is Sold through Link, LLC (a Stripe affiliate). The purchase contract for a given feature is therefore concluded between you and Sold through Link, LLC; we (ANCVAJ s. r. o.) are not a party to that purchase contract. We have a separate contract with you for using the Service, on the basis of which we activate and grant you access to the relevant paid feature once payment is received.
4. Processors and recipients
We use the following categories of processors, who act on our instructions under data processing agreements:
- Hosting / cloud infrastructure: Contabo GmbH, Aschauer Straße 32a, 81549 Munich, Germany (EU) — stores account data, photos and database.
- Email provider (SMTP): Webglobe, s. r. o. (`mail.webglobe.sk`), Slovakia (EU) — sends magic-link and transactional emails.
- Analytics (consent only): Google Ireland Ltd. — Google Analytics 4 (Ireland, EU). Measures aggregated use of the Service (IP anonymised, advertising signals off). No analytics cookies are stored without consent (Consent Mode v2).
- Payments (seller / merchant of record): Payments run through Stripe Managed Payments (active since 9 July 2026). The seller towards you is Sold through Link, LLC (USA), a Stripe affiliate; the technical processing of payments is provided by Stripe (including Stripe Payments Europe, Ltd., Ireland, EU). This entity processes payments and full card data. We receive only limited transaction metadata (order ID, amount, status, email) and do not store your card details. As Sold through Link, LLC is a US company, this involves a transfer to a third country (USA) — see the "International transfers" section.
We do not sell your personal data. We may disclose data where required by law or to protect our legal rights.
5. International transfers
Our main processors are located in the EU/EEA. Where a processor (or its sub-processor) carries out a transfer outside the EU/EEA, such transfer is safeguarded by an adequacy decision or EU Standard Contractual Clauses. Details available on request at [email protected].
Payments run through Stripe Managed Payments, where the seller towards you is Sold through Link, LLC, established in the USA. These payments therefore involve a transfer of limited transaction data to the USA (a third country). Such a transfer must be safeguarded by an appropriate GDPR mechanism (for example, the EU-US Data Privacy Framework or EU Standard Contractual Clauses). We are verifying which specific mechanism Stripe/Link uses for this transfer; details available on request at [email protected].
6. Retention
- Account and user content: retained while your account is active; you can delete it at any time via the "Delete account" feature (right to erasure), unless longer retention is legally required.
- Payment/accounting records: retained for the period required by Slovak accounting law (Act No. 431/2002 Coll.), generally 10 years. Audit records of purchases and candle/credit movements are retained for accounting and legitimate-interest purposes beyond the log-data period below.
- Authentication/log data (login tokens, sessions, security logs): retained for security for a maximum of 3 months, then automatically deleted.
- Guest book (condolences): a published message is retained until it is deleted by the author, the memory's owner, or us, or until the author's account is deleted; an unconfirmed message is retained for at most 24 hours and then deleted automatically. Deleting the author's account also removes all of the author's guest-book messages (including those on other people's memories).
7. Your rights
Under the GDPR you have the right to: access your data; rectification; erasure ("right to be forgotten"); restriction of processing; data portability; objection to processing based on legitimate interests; and to withdraw consent at any time (without affecting prior processing).
You may withdraw your consent to publishing a guest-book message at any time using the permanent "delete my message" link in the confirmation email (without signing in), or by deleting your account.
If you request erasure of your data directly from the payment provider (Link/Stripe), Stripe, under its Managed Payments rules, deletes your data from the payment objects (Customer, PaymentMethod, Invoice, PaymentIntent, Subscription and Charge) also in our Stripe account and cancels any subscription. Please note that some accounting documents may be subject to a statutory retention obligation; we are verifying how these rules interact.
To exercise these rights, contact [email protected]. We will respond within one month.
8. Right to complain
As the controller is a Slovak company, the competent supervisory authority is:
Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov SR)
Hraničná 12, 820 07 Bratislava, Slovakia
Website: https://dataprotection.gov.sk
You may also complain to the supervisory authority in your EU country of residence. Danish users may also contact the Danish authority Datatilsynet (https://www.datatilsynet.dk).
9. Security
We apply appropriate technical and organisational measures (e.g. encryption in transit, access controls) to protect your data. No system is completely secure; please keep your email account secure since login relies on it.
10. Children
The Service is not directed at children under 16. If you believe a child has provided us personal data, contact us and we will delete it.
11. Changes to this policy
We may update this Privacy Policy. Material changes will be communicated by email or in-app, and the "Last updated" date will be revised.
12. Contact
ANCVAJ s. r. o. — Lúčna 1014/9, 014 01 Bytča, Slovakia — Email: [email protected] — DPO: not appointed (contact us at [email protected])