Privacy Policy

Valora Foundation, 2000 Antwerpen Belgium — info@valorafoundation.com — is the data controller responsible for the personal data described in this Policy. Data protection contact: dpo@valorafoundation.com.

• Identity & contact: first name, last name, date of birth, address, phone, email, preferred language.
• Membership data: membership number, status, family members you add, contribution history.
• Payment data: transaction ID, amount, date, payment method type (card / SEPA). Card numbers are handled by Stripe and never stored on our servers.
• Special-category data (GDPR Art. 9): your burial / cremation preference and, indirectly, information from which religious or philosophical beliefs may be inferred. Processed only with your explicit consent.
• Technical data: IP address, browser, essential cookies for authentication and, if you consent, analytics cookies.

• Providing the membership service — performance of a contract (Art. 6(1)(b)).
• Processing burial / cremation preference — explicit consent (Art. 9(2)(a)).
• Complying with Belgian accounting, tax and anti-money-laundering law — legal obligation (Art. 6(1)(c)).
• Optional service updates — consent (Art. 6(1)(a)), withdrawable at any time.

We share personal data only with sub-processors bound by a written Data Processing Agreement:

• Supabase (EU region) — database, authentication.
• Lovable — hosting and platform.
• Stripe Payments Europe, Ltd. — payment processing.
• Local funeral, repatriation and administrative partners in the country of service, strictly for fulfilling your membership.

Personal data is stored in the European Union. Where a sub-processor requires a transfer outside the EEA (e.g. Stripe), that transfer is covered by the European Commission's Standard Contractual Clauses.

• Membership and family data: for the duration of your membership + 12 months.
• Payment and invoicing records: 7 years (Belgian bookkeeping law, W.Venn./W.C.O.).
• Marketing consent logs: until you withdraw consent + 3 years for evidence.

You have the right to access, rectify, erase, restrict, object to and port your personal data, and to withdraw consent at any time. You can exercise access, portability and erasure directly from your member dashboard (Security → Your data). For any other request, contact dpo@valorafoundation.com.

When you add a spouse, child, parent or sibling to your membership, you confirm that you have the authority to share their data and that you have informed them of this Policy. They may contact us at any time to exercise their rights.

We apply industry-standard organisational and technical measures, including encryption in transit (TLS 1.2+), row-level authorization, verified webhook signatures and audited access controls. In the event of a personal data breach likely to result in a risk to your rights, we will notify the Belgian Data Protection Authority within 72 hours in line with GDPR Art. 33 and, where required, inform you directly.

You have the right to lodge a complaint with the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit), Rue de la Presse 35, 1000 Brussels — www.autoriteprotectiondonnees.be.

We will announce material changes on this page and, where required, notify members by email. The effective date at the top always reflects the current version.