Data Processing Agreement

01Parties and scope

The customer determining why and how guest data is used acts as controller. The service operator identified in the Legal Notice acts as processor. Where the customer acts for another controller, they must have authority to appoint us as a subprocessor. Roles depend on the actual circumstances; personal or household activities may fall outside GDPR.

Processing lasts for the service relationship and the time needed to return or delete data on documented instructions. It covers storage, organisation, retrieval, delivery of invitations, RSVP, seating, dietary arrangements, private letters, documents and AI-assisted responses.

02People and data

Data subjects include invited guests, accompanying people and individuals mentioned in wedding content. Data may include names, contact details, attendance, invitation identifiers, seating, messages, uploaded files and conversation content. Dietary or accessibility details may reveal health or religious information.

The customer must establish a lawful basis, provide notices, minimise data, and obtain any required explicit consent before adding sensitive data. Do not upload unnecessary sensitive information or use guest data for unrelated marketing.

03Instructions and confidentiality

We process customer data only on documented instructions, including the use of configured service features, and only to provide the service. We notify the customer if an instruction appears to infringe data protection law. If law requires other processing, we inform the customer beforehand unless legally prohibited.

People authorised to process data must be bound by confidentiality and limited to necessary access.

04Security and incidents

We maintain appropriate technical and organisational measures, including TLS in transit, hashed passwords, wedding-scoped access controls, restricted service credentials and access checks for guest sessions. Measures must be reviewed as risks and the service evolve.

We notify the customer without undue delay after becoming aware of a personal-data breach affecting their data, and provide available information and assistance for the customer’s notification obligations.

05Subprocessors and transfers

The customer generally authorises the infrastructure and delivery providers listed in the Privacy Policy: Vercel, Supabase, Heroku, Resend, and OpenRouter plus the model providers selected for AI processing. Stripe handles payments under its applicable controller/processor terms.

We must bind subprocessors to equivalent data-protection obligations and remain responsible for their performance. We will notify customers of intended additions or replacements before they process customer data, allowing an objection on data-protection grounds via contacto@tudiadeblanco.com. If the objection cannot be resolved, the affected processing must stop or the affected service may be terminated.

Transfers outside the EEA require a valid GDPR Chapter V mechanism and appropriate supplementary measures where needed. Contact us for the current provider locations, downstream AI providers and applicable safeguards.

06Assistance and audit

Taking account of the nature of processing and information available, we assist with data-subject rights, security, breach notifications, impact assessments and regulator consultations. Guest requests are referred to the customer unless law requires us to act directly.

We make available information necessary to demonstrate compliance and allow and contribute to reasonable audits, including inspections by the customer or an appointed auditor, while protecting other customers’ information.

07Photo pool in the couple’s Google Drive

Enabling the Photo pool instructs TDB to arrange direct uploads into the Google Drive account connected for the wedding. Google receives photos and videos directly from guest browsers; TDB stores only connection credentials encrypted at rest and upload metadata, not photo or video contents.

The customer is responsible for choosing this storage destination, informing guests and establishing any required lawful basis, notices, permissions and transfer safeguards. Google’s applicable terms govern the connected account. The customer controls access, sharing, retention, export and deletion of Drive files. Disconnecting TDB does not delete them; requests concerning those files must also be addressed in that account. TDB assists with requests about metadata it holds under this agreement.

08Task sync to a member’s Google Calendar or Google Tasks

When a member connects their own Google account and selects Workbook tasks, TDB copies each selected task’s title, due date, completion state and a link back into a calendar or task list TDB created in that account, and keeps the copies updated. TDB stores the connection credentials encrypted at rest, the ids of the containers and copies it created and sync status; it reads nothing else from the account.

TDB removes a copy when the member stops syncing the task, loses access to it under the Workbook’s sharing rules, or leaves the wedding. On disconnection the member chooses whether copies are kept or removed. Copies kept in Google are governed by Google’s applicable terms and controlled by that member; requests concerning them must also be addressed in that account.

09A planner's Agenda in calendar apps and Google Calendar

When a planner turns on their Agenda's calendar address, TDB serves the planner's dated Agenda entries of the chosen kinds (name, day and a link back; never notes, amounts or contact details) to whichever calendar app fetches that private address, re-checking on each fetch what the planner may see. Entries fetched by a calendar provider are governed by that provider's terms and controlled by the planner, who can stop further fetches by making a new link or turning the address off.

When a planner connects their own Google Calendar, TDB reads the title, times, location and link of events in its main calendar for the days on screen, only to show them to that planner, and does not store them. TDB stores the connection credentials encrypted at rest and the connection status.

10Return and deletion

At the end of service, the customer may instruct us to return or delete personal data and delete remaining copies, except where law requires retention. Contact contacto@tudiadeblanco.com to arrange export or deletion and confirm the scope and completion. Any data retained because of legal requirements must be isolated from ordinary service use.

A wedding website’s expiry disables public delivery; it is not automatic deletion of stored wedding data. Backup handling and any recovery period must be confirmed with the customer rather than inferred from website expiry.