Skip to content
Invitette
ROEN

Data Processing Agreement (DPA)

Version 2026-11-01

This agreement under Article 28 GDPR is between you, the Couple (the “Controller”), and Invitette (the “Processor”). You accept it before publishing an Invitation, and it is part of the Terms. Even where your own use of your Guests’ data is purely private, we handle that data as this agreement says.

1. Subject and duration

The Processor hosts your Invitation and collects your Guests’ RSVPs on your behalf, for as long as the Invitation exists and until the Guest data is deleted on the Retention Date (wedding date + 3 months).

2. Data and data subjects

  • Data subjects: your Guests, and people named or shown in your Invitation (for example parents and godparents).
  • Personal data: names, attendance, number of people, menu choice, messages, the answers to the questions you write for the reply form (which may hold health data if you ask about allergies), the guest list you keep in your Dashboard (names, attendance, number of people, menu, names of the people in a household, also answers given to you in person), and the photos and videos you upload.
  • Purpose: showing your Invitation, receiving RSVPs, and showing them to you in your Dashboard and exports.

3. Your responsibilities as Controller

You decide which data to collect. You are responsible for being allowed to collect it, for telling your Guests about it (for example with a short note on your Invitation), and for answering their requests. Ask about health (allergies) only if you need to.

4. The Processor’s obligations

  • Process Guest data only on your documented instructions, which are the Terms, this DPA and your settings in the service, including for transfers outside the EU/EEA. If the law obliges us to process it otherwise, we tell you first, unless the law forbids that.
  • Tell you without delay if we think an instruction breaks data protection law.
  • Make sure everyone who handles the data is bound by confidentiality.
  • Apply appropriate technical and organisational measures (Art. 32 GDPR): encryption in transit, access limited to the owning Couple, hashed sign-in codes and sessions, rate limiting, and automatic deletion.
  • Help you answer Guests’ requests to exercise their rights, and help you with security, breach notifications and impact assessments where they are needed.
  • Notify you without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting your Guests’ data.
  • Delete all Guest data on the Retention Date, or earlier when you ask, unless the law requires us to keep it. You can export it before then.
  • Give you the information needed to show that these obligations are met, and allow reasonable audits by you or by an auditor you appoint.

5. Sub-processors

You give general authorisation for the following sub-processors. They are bound by the same data protection obligations as we are, and we remain responsible to you for what they do:

  • Hosting and servers: Vercel Inc., USA (the site runs in Frankfurt, Germany)
  • Database: Supabase Inc., USA (the database is in Frankfurt, Germany)
  • Photo and video storage and delivery: Cloudflare, Inc., USA
  • Emails about your account and orders: Resend (Plus Five Five, Inc.), USA
  • Payments, VAT and invoices: our payment partner, named on the checkout page before you pay

We tell you by email at least 14 days before we add or replace a sub-processor. If you object for a good reason and we can’t offer an alternative, you may end the contract and get back the part of the price for the time that remained.

Transfers outside the EU/EEA rely on an adequacy decision (such as the EU–US Data Privacy Framework) or on Standard Contractual Clauses.

6. Liability and contact

Each party is liable under Art. 82 GDPR. The liability rules of the Terms apply as well.

Data protection questions: write to us through the contact form on this site (“Contact”, at the bottom of every page).