Privacy Statement

We handle personal information in accordance with applicable privacy laws, including Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25 / Loi 25), Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), and, where applicable, the EU General Data Protection Regulation (GDPR).

We collect the personal information you provide as you use our service. The sections below describe what we collect at each point in your journey with us.

When you register for an account

Our site's registration form requires users to give us contact information (such as their name and email address).  Your member registration and contact information (such as your name and email address) is stored in your member profile. 

When you place an order

Memorials are free to create and to publish; time and space beyond what is included are paid for. Our order forms collect the billing information a payment needs: the name, billing address and email address of whoever is paying, and their card details. Nothing is posted to anyone, so we never ask for a shipping address.  We do not store any customer credit card information on our website, in our databases, or on our web servers.

When you create a memorial

A memorial holds what you choose to put on it: the name of the person who has died, the dates and places you enter, their story in your own words, photographs and keepsakes, and the notes visitors leave. Some of that is personal information about the person the memorial is for, and some of it may be about you or about other people you name.

A published memorial is meant to be read. Once you publish it, everything on it can be seen by anyone who visits, and search engines may index it. That is the purpose of the service, and it is the one place where what you give us is public by design rather than kept confidential. You choose when it is published, what it says and who may add to it, and you can change it or take it off the public pages at any time.

When you use our website

We also collect information about your visits to our website using cookies and similar technologies. This is described in the Cookies, Tracking & Analytics section below.

We use the personal information we collect for the following purposes:

• To provide you with the services you have requested, and to contact you about your orders or the services you use.
• To send you information about our company and promotional material from some of our partners, but only if you have requested to receive such information.
• With your permission, PartingWishes.com may use this personal information to contact you, your Keyholders® or your message recipients for various reasons relating to the services offered through the site.  For example, you may receive a reminder that your membership is approaching its renewal date, or a reminder to update your message recipient email addresses.  In addition, we may wish to inform you about new features we have added to the website, or we may wish to find out more about how useful you find particular features or services.
• To maintain the website and process customer service requests.  Your member registration and contact information can be accessed by the owners, administrators and support staff of PartingWishes.com for the purposes of maintaining the website and processing customer service requests.  This information may be used to contact our customers if they have requested us to do so.
• To process orders, which requires sharing information with the third parties involved in order processing (described in the Sharing section below).
• For other standard business purposes such as maintaining records, enforcing our agreements, detecting and preventing fraud, and meeting our legal and regulatory obligations.

We will not resell, trade, lease or rent to third parties any personally identifiable information about you or about any of your designated Keyholders®, message recipients, or anybody you identify in the course of using any of the services provided here at PartingWishes.com.

Service providers involved in order processing

We use this information solely to process customer orders and, if any questions or issues should arise, to contact customers about their order.  We share this information, and only that information which is absolutely necessary, with those third parties that are involved in the processing of customer orders.  For example, in the normal course of doing business we may be required to contact the financial institution that issued a customer's credit card and to provide shipping address information to the shipping carrier that delivers customer orders.

Referring partners

Some users will be referred to us from a third party after having established a customer relationship with that third party. If a client of a third party uses any of our services, having been referred to us by the third party, that third party may from time to time be granted access to personally identifiable information, including data entered by the client into the services used at PartingWishes.com.

Business transactions

Although there are no plans in place, in the event that our company is acquired by another company, then it is likely that the databases managed by us would be included as part of that acquisition. All customers would be notified of this event, and would be given the opportunity to remove their data from our systems.

Legal disclosures

We may disclose personal information as required or permitted by law, including in response to lawful requests from courts, law enforcement, and regulators.

No unsolicited communications

We send transactional communications (such as order confirmations, payment receipts, and service notifications) as a necessary part of providing our services. These do not require a separate opt-in.

Aside from the aforementioned third parties involved in the processing of customer orders, we do not share personally identifiable customer information with any other entities.

Beyond transactional communications, we do not send to customers any marketing or promotional communications that they do not explicitly request from us.  For example, the only way for a member to receive our email news updates is if they explicitly choose to subscribe, either when joining as a new member, or by checking the appropriate box in their member profile when they are logged in.

This site uses strong encryption and security technologies to protect the privacy and security of our member information and has specific security measures in place to protect the loss, misuse and alteration of the information under our control.

Encryption in transit

All data passing from your computer to PartingWishes.com is authenticated and encrypted using 256-bit Transport Layer Security (TLS) encryption. This is the most advanced level of encryption available today, and it means that any information sent from your computer is scrambled in a way which makes it completely unintelligible if intercepted. When you are on a secure section within the PartingWishes.com site (i.e. after you have logged in as a member), a padlock will appear on your web browser. This is your assurance that the encryption is in place and that you are communicating across a secure link.

Encryption at rest and restricted access

Furthermore, all sensitive personal information is stored in a highly encrypted format on our server. We use industry-standard AES-256 encryption to protect all sensitive personal information before it is stored. This encryption ensures that only the account holder, or those they have expressly authorized, can access their information once it has been entered into our system. Even our own operators cannot see sensitive personal information without the member's consent. Our customer support staff will ask for your consent before accessing the information you have entered, and only to assist with support-related issues or inquiries. Some services require your information to be decrypted for as long as it takes to provide them. Publishing a memorial is the clearest example: what you have entered is decrypted so that it can be shown on the memorial page you asked us to publish.

Two-factor authentication

We also provide 2-Factor Authentication (2FA) and recommend that all members turn on this feature within their account, to protect against unauthorized access. 2FA works by adding an additional layer of security to your online account. It requires an additional login credential (beyond just the UserID and Password) to gain account access. Getting that second credential requires access to something that belongs to you, such as a cell phone and/or a personal email address.

Login monitoring

As an additional security measure, all successful and unsuccessful attempts to login to a member's account are logged in our database along with date/time stamps, IP addresses, and other detectable information from the user.  This information will be used for law enforcement purposes and for the protection of our members should there be any suspicion of unauthorized access to our database.

Where your information is stored

Your account information is stored in an enterprise-grade Tier-1 cloud hosting environment, with our primary database hosted in Canada. To operate the website and provide our services, some personal information may be stored or processed outside Canada by reputable service providers.

Before entrusting personal information to a provider outside Canada, we assess whether it will receive protection adequate to Canadian standards and put a written agreement in place. Our providers are contractually required to protect your information, use it only to provide services to us, and keep it confidential.

The most important security element of any service is the team that runs it. Our support team consists of dedicated, long-tenured employees who are fully trained in our security and privacy practices.

We use cookies and similar technologies for a few different purposes:

• Strictly necessary: these make the website work (keeping you logged in, remembering your shopping cart, and recording your cookie choices). They are always active because the site cannot function without them. They include short-lived session cookies and a small number of persistent first-party cookies (for example, your saved cookie-consent choice, the cookie_consent_level cookie, kept for about 62 days).
• Analytics: these help us understand how the site is used so we can improve it. They are used only if you consent, and include third-party cookies such as Google Analytics (its _ga cookie lasts about two years).
• Advertising: these help us measure and target our marketing. They are used only if you consent, and include cookies from Google, Microsoft (Bing), Meta (its _fbp cookie lasts about 90 days) and Rakuten.

We use Google Tag Manager to load and manage the technologies described above. Tag Manager does not set cookies or collect personal information itself. It loads on every page so that your consent choices can be applied to the technologies it manages, and Google receives technical request information (such as your IP address and browser type) when it loads.

When you first visit, a consent banner lets you accept or refuse each category, and nothing in the analytics or advertising categories runs until you accept it. You can change or withdraw your choice at any time using the "Cookie preferences" link in the website footer. If you refuse, only the strictly necessary cookies are used.

Our site provides visitors the opportunity to opt-in and opt-out of receiving email communications from us and our partners at the point where we request information about the visitor. Members can also opt-in and opt-out of receiving future email communications by visiting https://www.partingwishes.com/, logging in with their member UserID and Password, and changing their "Member Email" preferences in their member profile. In order to comply with privacy regulations including GDPR, PIPEDA, and other international privacy laws, by default the member preference is set to "opt-out".

Furthermore, this site allows users to remove all of their information from our database, to not receive future communications, or to no longer receive our service, either by sending an email to support@partingwishes.com, or by sending postal mail to the company address listed on our Contact Us page.

Subject to the limits allowed by law, you may:

• Access the personal information we hold about you and receive a copy. In accordance with all applicable law, you may request a report of all of the personal information we have collected from you and stored in our database by contacting us. We will require you to verify your identity before providing you with such a report. This may include identity verification through a secure third-party service, and a reasonable administrative fee may apply to cover the cost of processing and verification.
• Correct information that is inaccurate, incomplete, or out of date. Members can simply visit https://www.partingwishes.com/, login, and modify any information using the link available on the Member Home Page.
• Withdraw consent to a use or disclosure (for example, marketing, or non-essential cookies).
• Delete your account and information (self-service, under your account, or by contacting us).
• Be informed if a decision about you is based exclusively on automated processing.

If you are a Quebec resident, under Law 25 you also have the right to:

• Data portability: receive the computerized personal information you provided in a structured, commonly used technological format. Contact us to request a copy.
• De-indexing or cessation of dissemination: As a Quebec resident, you have the right under Law 25 to ask a company to stop disseminating your personal information or to de-index a hyperlink. We do not disseminate personal information to the public as part of our services, so this right is unlikely to be needed, but we will honor it if it applies.

To exercise a right, contact our Privacy Officer. We may verify your identity first and will respond within the time the law requires (generally 30 days).

We keep your personal information only as long as we need it for the purposes described here, or as long as the law requires. In general:

• Account and document data: kept while your account is active and for as long as needed to provide the service to you.
• After you delete your account: your identifying personal information is destroyed or anonymized promptly. Records we are required to keep (in particular your order and payment records) are separated from your profile, moved to a restricted "deleted members" record used for no other purpose, and retained for seven (7) years to meet tax, accounting and audit obligations, then destroyed.
• Backups: overwritten on our normal backup cycle (up to 10 years).
• Consent and communication-preference records: kept until you withdraw them, plus a short period so we can show the choice you made.
• Security and access logs: (sign-in and account-access records) kept up to 10 years.

When information is no longer required, we destroy or anonymize it so it can no longer identify you.

This policy may be updated from time to time, and we have procedures in place for confidentiality incidents and automated processing.

Privacy policy updates

This policy is effective as of the date stated at the top. We may change it from time to time. When we do, the revised policy will be posted on our website with a new effective date, and we will notify members by email.

Confidentiality incidents

If a confidentiality incident (such as unauthorized access, use, disclosure, or loss of personal information) occurs and presents a risk of serious injury to you, we will notify you and the Commission d'accès à l'information du Québec (CAI) with reasonable promptness, take steps to reduce the risk, and act to prevent similar incidents. We keep a register of confidentiality incidents.

Automated processing and profiling

We use website analytics that may profile how visitors use the site, and an AI-assisted chat and support tool to help answer questions and process support email. We do not make any decision about you exclusively by automated means. If that ever changes, we will tell you and provide the rights the law gives you, including review by a person.

This site contains links to other sites.  We are not responsible for the privacy practices or the content of such Web sites.

If you have a question, concern, or request about your personal information, please contact our Privacy Officer.

Our Privacy Officer

PartingWishes Inc. has designated a person in charge of the protection of personal information (our "Privacy Officer"). You may contact our Privacy Officer with any question, request, or complaint about your personal information, or to exercise any of the rights described in this statement:

Privacy Officer
PartingWishes Inc.
2420 Bank Street, Suite 45
Ottawa, Ontario
K1V 8S1
Canada

Email: privacy@partingwishes.com

If you have any questions about this privacy statement, the practices of this site, or your dealings with this Website, feel free to contact us.