Privacy policy

Last updated: 22 September 2026

1. General information

This privacy policy explains how personal data is processed when using the GraveAtlas system.

When processing personal data, we comply with applicable legislation, including Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the General Data Protection Regulation, hereinafter – GDPR).

2. Who we are

The GraveAtlas system is a cemetery management and public deceased search system.

The GraveAtlas system provides information about cemeteries, graves and the persons buried in them. The system also allows users to light a digital candle and to report inaccuracies or missing information they have noticed in the data on graves or buried persons.

The controller of the data of a specific cemetery is the relevant municipal administration or another organisation administering the cemetery (hereinafter – the data controller). The data controller determines the purposes and scope of personal data processing.

MB „Geografinės informacinės technologijos“ acts on behalf of the data controller(s) as a data processor within the meaning of the GDPR and ensures the technical operation, administration and maintenance of the GraveAtlas system.

3. What data we collect

Depending on the GraveAtlas system feature used, the following personal data may be processed.

Digital candle

When using the “Light a digital candle” feature, we collect:

  • first name;
  • email address.

The name provided may be displayed publicly next to the selected grave for 7 days, after which it is removed from public display. The email address is not displayed publicly.

Information update

When using the “Update information” feature, we collect:

  • email address;
  • the message submitted by the user;
  • photos submitted by the user (up to 3).

The email address is used to contact the user about the information submitted and, where necessary, to inform them about its review. The email address is not displayed publicly.

Photos submitted by the user may show graves, headstones or data belonging to third parties shown on them (e.g. surnames, dates). Such data is processed only for the purposes set out in Section 5. The user is responsible for ensuring that the information and photos submitted are accurate and submitted lawfully.

Technical data

When using the GraveAtlas system, the following technical data may be collected automatically:

  • IP address;
  • browser technical data;
  • technical activity log data;
  • other technical information necessary to ensure the operation, security and technical maintenance of the system.

We process personal data on the following legal bases set out in the GDPR:

  • consent (Article 6(1)(a) GDPR) – when lighting a digital candle and when submitting an information update request;
  • legitimate interest (Article 6(1)(f) GDPR) – to ensure the security, operation and technical maintenance of the GraveAtlas system (processing of technical data);
  • legal obligation (Article 6(1)(c) GDPR) – where we are required to process or retain data under applicable legislation.

The user may withdraw consent-based processing at any time by contacting us using the details in Section 12; this does not affect the lawfulness of processing carried out before the withdrawal.

5. How we use data

Personal data is used to:

  • light a digital candle and display its information;
  • receive and review information submitted by users;
  • update information on cemeteries, graves and buried persons;
  • contact the user about the information they submitted;
  • inform the user about the review of the information submitted;
  • ensure the operation, administration and maintenance of the GraveAtlas system;
  • ensure the security of the GraveAtlas system;
  • prepare aggregated statistics on the use of the GraveAtlas system.

The GraveAtlas system does not make automated decisions, including profiling, that produce legal or similarly significant effects.

6. Information submitted by users

The GraveAtlas system allows users to report inaccuracies or missing information they have noticed in the data on cemeteries, graves or buried persons.

When submitting information, an email address and a message must be provided. Up to 3 photos may also be submitted.

Information submitted by the user is used to assess it, to update cemetery data and, where necessary, to contact the user.

The purposes and scope of cemetery data processing are determined by the relevant data controller. MB „Geografinės informacinės technologijos“, as the data processor, provides the technical means to submit, store and administer the information.

7. Data recipients

Personal data may be transferred to:

  • the relevant data controller (a municipal administration or another organisation administering the cemetery) – where the data relates to specific cemeteries it administers;
  • service providers maintaining the technical infrastructure of the GraveAtlas system (servers, hosting) – only to the extent necessary to ensure the operation of the system;
  • competent public authorities – in cases provided for by law.

Data is not transferred outside the European Union or the European Economic Area.

8. Data security

We apply appropriate technical and organisational measures to protect the data processed in the GraveAtlas system against accidental or unlawful destruction, loss, alteration, disclosure or unauthorised access.

Access to data in the GraveAtlas system is granted only to the extent necessary for system administration, technical maintenance, security or other functions related to the operation of the GraveAtlas system.

9. Data retention

Personal data is kept no longer than necessary to achieve the specified processing purposes and in cases provided for by law.

  • digital candle data (name) is displayed publicly for 7 days after lighting, and the email address is kept for up to 1 year after submission, after which it is deleted unless there is a legal basis to keep it longer;
  • information update requests (message, photos, email) are kept until the request has been reviewed and for up to 6 months afterwards, to ensure a proper review process;
  • technical activity log data is kept for up to 12 months;
  • retention periods for data on cemeteries, graves and buried persons are set by the relevant data controller.

10. Cookies and similar technologies

The GraveAtlas system may use cookies and similar technologies necessary to ensure the operation, security and functionality of the system.

Technologies for collecting and analysing aggregated statistics on the use of the GraveAtlas system may also be used.

Users can manage cookie settings in their web browser.

11. Your rights

Under the GDPR, you have the right to:

  • receive information about the processing of your personal data;
  • access the personal data processed about you;
  • request the correction of inaccurate or incomplete data;
  • request the erasure of your personal data;
  • request the restriction of the processing of your personal data;
  • object to the processing of your personal data where permitted by the GDPR;
  • withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal;
  • lodge a complaint with the State Data Protection Inspectorate (L. Sapiegos g. 17, LT-10312 Vilnius, ada@ada.lt, www.ada.lt) if you believe that your data is being processed in breach of the GDPR.

If you submitted data to a specific municipality or another organisation, we recommend contacting the relevant data controller to exercise your rights. For data processed by MB „Geografinės informacinės technologijos“ (digital candle, information update requests, technical data), you can contact us using the details in Section 12.

12. Contact us

MB „Geografinės informacinės technologijos“
Company code: 304604887
Jonažolių g. 7, LT-04138 Vilnius, Lithuania
Tel. +370 648 33086
Email: info@graveatlas.lt

The GraveAtlas system may contain links to other websites. The GraveAtlas system is not responsible for the privacy practices of those websites.

14. Final provisions

This privacy policy may be updated when the functionality of the GraveAtlas system, personal data processing practices or applicable legislation change.

The current version of the privacy policy is published in the GraveAtlas system.