Data processing terms

You decide what to ask your guests and what the answers are for: you are the controller. We store the answers for you and act only on your instructions: we are your processor.

Even if data protection law does not apply to you as private people organising your own wedding, these terms bind us in full.

• Subject: receiving and storing your guests’ RSVP answers for your event.
• Duration: from publishing your invitation until the answers are deleted (see Deletion at the end).
• Nature and purpose: hosting the invitation, receiving answers through its form, storing them in a Google Sheet shared with you, emailing you each answer, and deleting them on time.

Data subjects: your guests, including children whose details their parents enter.

Data: the answers to the questions you chose, typically names, whether the guest comes and with how many people, children and their ages, travel, coach and hotel needs, a song wish and a message; the time of each answer and a random code from the guest’s browser.

If you add a question whose answer may reveal health or religion, such as dietary needs, it is optional for guests, and its label says that you and your venue will see the answer.

Your instructions are these terms, your order and what you ask of us in writing (by email). If we believe an instruction breaks data protection law, we tell you.

We never use the answers for our own purposes: no marketing, no profiling, no statistics across events.

Only the people who work on your invitation can see the answers, and they are bound to keep them confidential.

How we keep the answers safe:

• Everything travels over HTTPS.
• Guests’ answers never go into an invitation’s code. The RSVP form only accepts answers and never shows stored ones.
• The answer sheet is private: apart from us, only the couple can open it.
• Invitations are on private links that search engines do not index.
• Only the people working on an order can see its data.

You authorise us to use, for your guests’ answers, the providers listed in our Privacy policy: Vercel (hosting) and Google (Sheets and Apps Script). Each is bound by data protection terms that give the same level of protection as these.

Before we add or replace one, we tell you by email. You can object; if we cannot find a solution together, you may end the contract.

Vercel and Google may process data in the United States and other countries, under the EU Standard Contractual Clauses.

If a guest asks to see, correct or delete their answer, we help you respond. If the request comes to us, we pass it to you within 2 working days.

Your standing instruction to us: if you do not reply within 10 days, we act on the guest’s request ourselves, for example by deleting their answer.

If we learn of a breach affecting your guests’ answers, we tell you within 48 hours what we know and what we are doing about it, and we help you with any notice you must give.

Where needed, we also help you with security questions and data protection impact assessments.

You can copy or export the answers from your Google Sheet at any time.

We delete the answers 3 months after the wedding. If you ask, we keep them until the end of your hosting period instead. Copies in our backups are deleted within the next 30 days.

On request, we give you what you need to show that these terms are kept: this appendix, the list of providers and a description of our security measures. Any further inspection, where the law requires one, is agreed with you in advance.

Ask only what you need for the event, and let your guests know who receives their answers. We add a short notice under the RSVP form that says so: the answers go to you, we store them for you and delete them 3 months after the wedding.