Data Processing Terms (guest data)

Effective: 3 October 2026Version: 1.2

All legal documents
On this page

When you enter your own data, the Provider is the controller. When you enter data about your guests and other third parties - names, contact details, dietary needs, accommodation, photos - the roles reverse: the decision about whose data goes into the system and why is yours. In that case you are the controller and the Provider is the processor.

Article 28(3) GDPR requires that relationship to be set out in writing. This document serves that purpose: by accepting the Terms you and the Provider enter into a data processing agreement on the terms below. No separately signed instrument is needed, but the Provider will issue a signed copy on request.

The In short summaries are informational and are there to help you follow the section. The full text always prevails legally.

This document is available in Hungarian and English. In case of any discrepancy, the Hungarian version prevails, except where the English version is more favourable to a Consumer.

1. Subject matter and duration

In shortThe Provider processes Guest Data for as long as your account exists and only as far as providing, securing and supporting the Service requires.

Guest Data means the personal data of guests, their companions, contact persons, vendor contacts and other third parties that you enter into, upload to or otherwise process through the Service, or that guests enter themselves through a link you share (RSVP, photo upload). The same rules apply to vendor contacts as to guests.

Subject matter
Storage and processing of Guest Data in order to operate the wedding planning features.
Duration
For as long as the user account exists, or until you delete the data. Deleting the account deletes the Guest Data with it, including uploaded photographs.
Nature and purpose
Only what providing, securing, maintaining and supporting the Service requires: storage, organisation, display, search, export, AI analysis that you start through a feature of the Service, serving the shared guest page, the RSVP flow and the photo collection, backups, and handling support requests you send.
Categories of data subjects
Guests and their companions, contact persons (witness, master of ceremonies, relative), vendor contacts, and people who upload or appear in guest photos; for a planner, also the planner's clients.
Types of personal data
Name, email address, phone number, relationship, RSVP status, dietary requirements, seating and accommodation assignment, travel and transfer details, photographs and uploader names, the token assigned to a guest, and anything else you enter in a free-text field.

Special category data. The Service is not designed to ask for or collect special category data under Article 9 GDPR about guests: the dietary field asks for a preference, and the RSVP page asks guests not to give medical details. A free-text entry or a photograph can nevertheless reveal health, religious or other special category information. You must not enter such data unless you have a valid legal basis and an Article 9 condition; if it is entered, the Provider processes it only on your instructions, with the same measures. (The couple's OWN cultural and religious background is not Guest Data: it is governed by your explicit consent and Section 2.2 of the Privacy Policy.)

Planners. Where the User is a professional wedding planner, the planner remains responsible for determining the purposes and means of processing client data and Guest Data entered for a client, or for being authorised by the client to do so. The planner must ensure that it is entitled to give instructions to the Provider.

2. Your obligations as controller

In shortYou need a legal basis for the Guest Data you enter, you inform those people, and you decide how long to keep it. The Provider has no visibility into that.

As controller you undertake that:

  • you enter only personal data for which you have an appropriate legal basis - typically the data subject's consent, or a legitimate interest in organising the wedding - and only what is adequate, relevant, accurate and necessary for that purpose;
  • you inform the data subjects that their data goes into a wedding planning application, and who they can turn to in order to exercise their rights;
  • you publish a phone number, address or other contact detail on a published guest page only with that person's prior knowledge and agreement;
  • you do not distribute personal invitation and upload links in a circle where the data could reach unauthorised recipients;
  • you decide how long Guest Data is kept, and delete what you no longer need through the interface;
  • you handle data subject requests (access, rectification, erasure) yourself through the interface wherever it allows you to, and carry out any data protection impact assessment, consultation or breach notification required of you as controller.

The Provider has no visibility into any of this, and should not have: it does not inspect the content of Guest Data.

3. Provider obligations as processor

In shortWe process only on your instructions, under confidentiality, with Article 32 security measures; we forward data subject requests to you and notify you of a breach without undue delay.

As processor the Provider undertakes that it will:

  • process Guest Data only on your documented instructions, including with regard to transfers outside the EEA. Using the Service together with this document constitutes such instructions. If the Provider considers that an instruction infringes the GDPR or other data protection law, it informs you without undue delay, unless the law prohibits this, and may suspend the affected processing until the question is resolved;
  • not use Guest Data for its own purposes - including marketing, profiling or training, fine-tuning or improving AI models; AI analysis of Guest Data happens only when you start it through a feature of the Service;
  • bind everyone with access to confidentiality and limit access to what the task requires;
  • apply the technical and organisational measures required by Article 32 GDPR, which form the agreed security measures of this document: encryption in transit (HTTPS/TLS) and at rest, passwords stored only as bcrypt hashes, row-level access control in the database, server-side validation of sharing tokens, guest photos in private storage reachable only through short-lived signed links, exclusion of tokenised pages from analytics, daily backups, restricted administrative access, and prompt security updates. The Provider may update these measures where the overall level of protection is not reduced; further details are in Section 7 of the Privacy Policy;
  • forward to you without undue delay any request it receives from a data subject about Guest Data, and not answer it on the merits except on your instructions or where the law requires; where a request concerns removing a photograph or other content that can be hidden or deleted without deciding anything about your purposes, the Provider may take that technical step itself and inform you;
  • provide reasonable technical and organisational assistance in meeting data subject requests (access, rectification, erasure, restriction, objection, portability), and in any data protection impact assessment or prior consultation;
  • notify you without undue delay after becoming aware of a personal data breach affecting Guest Data, so that you can meet the 72-hour deadline in Article 33 GDPR. The notice describes, as far as known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point; information not yet available is supplied in phases. Whether and how to notify the supervisory authority and the data subjects remains your decision as controller;
  • inform you before responding to a legally binding request from a public authority for disclosure of Guest Data, where the law permits;
  • at the end of the processing, at your choice, return the Guest Data (through the export in Section 20 of the Terms, available at any time) or delete it, unless EU or Member State law requires storage. When you delete individual items in the interface, the Provider deletes them accordingly. Copies that remain temporarily in the encrypted backups are kept out of active use and disappear from them at the latest 6 months after deletion (daily copies 14 days, monthly archives 6 months).

4. Sub-processors and international transfers

In shortYou give general authorisation for the sub-processors listed on the dedicated page. We give 15 days notice before any change, and you may object.

The Provider engages sub-processors to perform the service. You give general authorisation for this under Article 28(2) GDPR. The full list of engaged sub-processors - with their addresses, activities, storage locations and transfer bases - is on the Subprocessors and recipients page.

The Provider imposes on each sub-processor, by contract, the same data protection obligations as are set out in this document, to the extent relevant to the service the sub-processor performs, and remains liable for their performance as for its own.

Before engaging a new sub-processor or replacing an existing one, the Provider gives at least 15 days notice. You may object within that period on reasonable data protection grounds; the Provider considers the objection in good faith and responds before the change takes effect. If the objection is well founded and no reasonable alternative can be offered, you may terminate free of charge before the effective date and export your data (Section 4 of the subprocessor page).

Where a sub-processor processes Guest Data outside the EEA, the Provider ensures that a valid transfer mechanism under Chapter V GDPR applies - an adequacy decision or the Standard Contractual Clauses - and on request makes available the information reasonably necessary to demonstrate the mechanism and the supplementary safeguards.

5. Audit and liability

In shortWe make available the information needed to demonstrate compliance and allow audits, normally remotely and in writing; an on-site inspection remains possible where that is not enough.

The Provider makes available all information necessary to demonstrate compliance with Article 28 GDPR - a description of the security measures applied, the sub-processor list, the transfer bases and the transfer impact assessment - and allows for and contributes to audits, including inspections, conducted by you or an auditor you mandate.

Taking into account the nature of the processing and that the Provider is a sole trader, an audit is normally carried out remotely: through written answers, security documentation, certifications of the infrastructure providers and other reasonable evidence, within a reasonable time. An on-site inspection may be requested where the remote evidence is insufficient or a supervisory authority requires it. You give reasonable prior notice, avoid disrupting the Provider's operations and keep confidential the information obtained. Each party bears its own audit costs; if the audit reveals a material breach attributable to the Provider, the Provider bears the reasonable additional cost of verifying the remediation.

Liability follows Article 82 GDPR: each party is liable for breaches arising from its own role. Nothing in this document excludes or limits liability to the extent the GDPR or other mandatory law prohibits it; in particular, the limitation of liability in Section 13 of the Terms does not extend to administrative fines under the GDPR or to compensation claims by data subjects.