Privacy statement

1. Who's behind this

This site is made and run by My Last Record (Mijn Laatste Plaat). There's no separate company behind it and no chamber-of-commerce number. Questions about your data go to info [at] mijnlaatsteplaat.nl or through the contact form on this site.

For this statement, My Last Record is the data controller under the GDPR.

2. What is kept, and why

Your account details: your email address, the name you fill in yourself, and your language preference. Needed to sign you in and to address you properly.

Your music: the five records, the order you put them in, and any note you add. That is what the site is for.

Your trusted contacts: their name and email address, and whether they have opened the list yet. Needed to invite them.

The log of your consent: the time, the version of the terms, a fingerprint of the exact text you saw, your IP address and your browser details. Needed to show that you agreed, and when.

Your message if you use the contact form, along with your name and email address.

Your IP address when you submit a form, and a counter for the number of attempts. Needed to keep spam and misuse out.

Nothing else. No profiles, no advertising, and nothing sold on to anyone.

3. Why your records need separate permission

A list of funeral music can say something about your beliefs or your faith: a psalm, a hymn, or the deliberate absence of both. The law calls that a special category of personal data, and it asks for your explicit consent.

That is why creating your account includes a separate checkbox for storing your choice of records. It stands apart from accepting the terms, and it is never pre-ticked.

This site is not meant for children under 16. If you're younger than that, storing your choice of records also needs a parent's or guardian's consent: get that before you turn the checkbox on.

You can withdraw that consent by deleting your records or closing your account, and both are yours to do without asking anyone. What was done before you withdrew it stays lawful.

4. Who can see it

You.

The trusted contacts you add, through their own link. They see your list, not your account details.

The administrator of this site, for account support only. That includes your choice of records. Never for commercial purposes, never shared with anyone else. Every action the administrator takes is logged.

The parties that keep the site running and act only on instruction: Supabase (database, London), Brevo (sending the sign-in email), Resend (sending invitations, reminders and other email), and Vercel (hosting; the functions run in London). There is a data processing agreement with each of them.

Apple, when you search for music: your search term goes to the iTunes Search API. Your name and your list never do.

5. How long it stays

Your account and everything in it: for as long as you keep your account. Delete it and it is gone at once.

Messages sent through the contact form: twenty-four months.

The log of your consent stays, even after you delete your account. What is left is an irreversible fingerprint of your email address, the version, the fingerprint of the text, and the time. No name, no address, no IP address. It is there only to show that consent was validly given.

Technical counters for forms: a few hours at most.

After a death, the list stays and the trusted contacts' links keep working, exactly as intended. If a family wants an account deleted, that can be arranged through the contact form; you will be asked for something that shows the death and your relationship to the person.

6. Your rights

You have the right of access, rectification, erasure, restriction, objection and data portability.

Access and portability are already built in: under Account there is a button that downloads everything in one file. Deletion is there too, and it takes effect immediately.

For anything else: the contact form, subject "My data". You will get an answer within thirty days.

If you disagree with the way your data is handled, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

7. Cookies and security

This site sets two kinds of cookies: one that keeps you signed in, and one that remembers which language (Dutch or English) you last viewed the site in. Both are strictly necessary for the site to work the way you've set it up, so no consent is required for them. There are no analytics, no ad networks and no trackers here, which is why you see no cookie banner.

Every connection runs over HTTPS, and all data is stored encrypted.

The database enforces, row by row, that you can only reach your own data. That is not a check in the website but a rule in the database itself, and it holds even if the website has a bug.

There are no passwords, so there is no password to leak.