Privacy policy

1. Personal data controller

The controller of your personal data is Mazowieckie Przedsiębiorstwo Usług Pogrzebowych “Terra Levis” Alicja Kępczyk based in Warsaw, ul. Opaczewska 15 lok. U3, 02-368 Warszawa, NIP 522-167-19-36, REGON 140153732 (referred to as the “Controller” or “Terra Levis”).

For data protection matters, contact us by phone on 660 950 600 (available around the clock) or by email: alicja.kepczyk@terralevis.pl.

2. Data we process

Depending on the form of contact and services requested, we process in particular:

contact details of the person making the enquiry: name, phone number, email address and enquiry text;
data needed to provide funeral services - the client's details and information in documents (e.g. the death record and medical death certificate) needed to arrange the funeral and complete formalities;
payment-related data: invoice details and information needed to help with a funeral allowance application and settlement, within the relevant authorisation.

The GDPR does not apply to deceased persons' data. We process living persons' data, such as the client's or family members', as needed to provide the service.

2a. Where we obtain your data

We receive some data from the person arranging the funeral rather than directly from you: for example, contact details of a family member, someone authorised to collect documents or a person designated to contact the cemetery or parish. These are usually a name and phone number, and sometimes an address and relationship to the deceased. We process them only as necessary to organise the ceremony and complete formalities, under Article 6(1)(b) and (f) GDPR (performance of a contract and our legitimate interest in carrying out the assignment efficiently). You have all the rights described under “Your rights”, including the right to object. Contact us if you wish to know who supplied your details; we will provide that information.

3. Purposes and legal bases

We process your data for the following purposes and on the following GDPR legal bases:

answering an enquiry and preparing a quote - Article 6(1)(b) and (f) GDPR (steps taken at a person's request and the Controller's legitimate interest);
entering into and performing a funeral services contract - Article 6(1)(b) GDPR;
meeting legal obligations (including tax and accounting obligations) - Article 6(1)(c) GDPR;
establishing or defending claims - Article 6(1)(f) GDPR;
statistics and advertising measurement (analytics and advertising measurement cookies) - Article 6(1)(a) GDPR, based on the consent you give in the privacy settings.

4. Providing data is voluntary

Providing data is voluntary but necessary to answer an enquiry and enter into and perform a contract. Not providing the data may prevent the service from being carried out.

4a. Special categories of data

We do not ask for health information, the cause of death or religious beliefs, and these are not needed to accept an enquiry from the website. A first name and phone number are enough; we discuss the rest in conversation. If you nevertheless include such information in a message field, we use it only to respond to the enquiry and delete it with the correspondence within the period in section 5.

When entering into and performing a contract, some such information is unavoidable; for example, choosing a religious or secular ceremony can reveal religious beliefs. We process it only as needed for the contract and, where necessary, under Article 9(2)(f) GDPR (establishing, exercising or defending legal claims).

The GDPR does not apply to deceased persons' data (Recital 27). We protect living family members' data according to this Policy.

5. Retention periods

Website form enquiries reach us only by email; their contents are not stored on the website server. Enquiries that do not result in a service order are deleted from the mailbox no later than 12 months after the last contact. If a contract is made, further retention follows the rules below.

We retain data for the time needed to provide the service, then for the period required by law (including tax and accounting rules, generally up to five years from the end of the year in which the service was provided) and the limitation period for possible claims. Data processed on consent is retained until that consent is withdrawn.

6. Data recipients

Recipients may only be organisations supporting the service, and only to the extent necessary. These include cemetery administrations, cremation providers, parishes and celebrants, ZUS (for the allowance), accountants, IT and hosting providers, and postal and courier services. They process data under data processing agreements or applicable law.

Recipients also include the hosting provider, LH.pl sp. z o.o. based in Poznań (servers in Poland), and the email provider receiving form enquiries; Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, for Google Analytics 4, Google Ads and Google Maps (details below); and LINK Mobility Poland sp. z o.o. (SMSAPI), where SMS notifications are used to help our team handle an enquiry. Such notifications may include the first name, phone number, enquiry reference, location and language; they do not include the email address or message contents. Where required, data processing is governed by an agreement under Article 28 GDPR.

7. Transfers outside the EEA

We use Google Analytics 4, Google Ads and Google Maps. Google Ireland Limited in Dublin provides these services to EEA users, but data may be transferred to Google LLC in the United States.

The transfer basis is European Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 on the adequate level of protection under the EU–U.S. Data Privacy Framework; Google LLC is listed as certified under this programme. European Commission-approved standard contractual clauses are used as an additional safeguard (Article 46(2)(c) GDPR). Contact alicja.kepczyk@terralevis.pl for a copy of the safeguards used.

Using Google Analytics 4 and Google Ads for analytics and advertising measurement requires consent in the privacy settings. Without it, Google does not store cookies in your browser through these tools. Google Maps loads only after you click “Load Google map”. Loading a map or opening a Google Maps link connects the browser to Google, which receives technical data including your IP address and may store or read cookies. See Google's privacy policy for details.

8. Cookies

Privacy settings distinguish three categories of cookies and similar technologies:

necessary - needed for the website to work correctly; no consent is required;
analytics - visit statistics (e.g. Google Analytics); enabled only with consent;
advertising measurement - measuring advertising performance; separate consent is required. This does not include ad personalisation or remarketing.

Cookies and identifiers we use

Necessary (no consent required): tl_cookie_consent_v2 stores privacy choices for the Polish, English and Ukrainian versions in browser localStorage for 12 months. LocalStorage values are not sent to the website server as cookies. Older tl_cookie_consent_v1 and tl_cc entries are not used by the new mechanism and are not automatically treated as consent.

Analytics (only with consent; set by Google): _ga and _ga_J2X1CDFBL2 — distinguishes sessions and users in Google Analytics 4; Google Analytics' default retention is up to 24 months.

Advertising measurement (only with separate consent; set by Google): _gcl_au associates a visit with a Google Ads click, and _gcl_aw stores the ad click identifier used to attribute a contact action (a phone-number click or a submitted form) to an ad. Google's default duration is up to 90 days. We do not use remarketing or ad personalisation: ad_personalization remains denied regardless of your choice. We grant ad_user_data only after you consent to advertising measurement. This allows Google to receive information that a phone number was clicked or a form was submitted following an ad visit, solely to measure advertising effectiveness, without the content of the form.

Google Maps (only after clicking “Load Google map”): after a map is loaded, Google may store its own cookies in the browser. Google determines their names and lifetimes; they can be managed in browser and Google account settings.

You can change or withdraw consent at any time using (in the footer) or by changing your browser settings.

Google Maps

Embedded maps are initially disabled. “Load Google map” connects to Google only for the chosen map on the current page. This choice is not remembered when the page is reopened and is not replaced by consent for analytics or advertising measurement. You can use the written address or open Google Maps through a separate link instead.

“Disable map” removes the embed from the current page. It does not reverse data already sent to Google or delete cookies set by that service. These can be managed in browser and Google account settings. Google's information about data from sites using its services.

8a. Form safeguards and logs

To protect the form from abuse, we limit submissions from a single IP address. We do not store the IP address itself, only its irreversible salted hash. We also use a hidden bot-trap field and a key preventing duplicate submissions. The server log contains only the date and time, submission number, branch code and acceptance status, not names, phone numbers or message contents. The basis is Article 6(1)(f) GDPR, our legitimate interest in website security. Separately, the hosting provider maintains its own access logs under its policy.

9. Your rights

You have the right to access and receive a copy of your data, rectification, erasure, restriction of processing, portability and objection to processing based on legitimate interests. For data processed on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing.

You also have the right to complain to the supervisory authority, the President of Poland's Personal Data Protection Office (ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl).

10. Automated decision-making

Your data is not used for automated decision-making, including profiling that produces legal effects.

11. Changes to this Privacy Policy

The Controller may update this Policy. The current version is published on this page. Last updated: 15 September 2026.