1. Controller
The controller of personal data is Brutuscore s. r. o., Lermontovova 911/3, 811 05 Bratislava, Slovakia, company ID 57 114 129. For anything concerning personal data, write to ahoj@handfast.wedding.
2. What we process and why
Account: name, e-mail and password (stored as a hash), to run your account. The legal basis is performance of the contract.
Wedding: names, date, venue, texts and photographs you put into the planner, to provide the service. Performance of the contract.
Translation: when you ask for a translation, the site's texts (headings, story, the day's schedule, questions and answers) are sent to be translated. The guest list and photographs are never sent. Performance of the contract.
E-mails: the addresses we send invitations, reply confirmations and account messages to. Invitations to guests are sent on the couple's behalf (section 4).
Suppliers: the details of a catalogue listing (name, contact details, regions, description, photographs), to show it to couples in the planner. Performance of the contract.
Partners: name or business name, the details needed to pay a reward, and a record of the weddings paid for with the code (without couples' personal data), to calculate and pay rewards. Performance of the contract, and a legal obligation for accounting records.
Payments: for a wedding, the coordinator plan and Memories forever, processed by Creem as the merchant of record. We see the payment's status, never card details.
Operational records: IP address and technical logs, for security and abuse detection. Legitimate interest.
Measurement and advertising: only with your consent, given in the cookie banner.
3. Who we share data with
Creem (Armitage Labs OÜ, Estonia): payment processing as the merchant of record.
Hetzner Online GmbH (Germany): servers, and storage of data and photographs in the EU.
Zoho Corporation B.V. (the Netherlands): sending e-mail.
Anthropic PBC (USA): draft translations of the site's texts, only when you ask for a translation. The transfer outside the EU relies on the European Commission's standard contractual clauses.
Crisp (Crisp IM SAS, France): the support chat, only once you open it.
Google: analytics and advertising, strictly after consent (Consent Mode v2).
Couples in the planner: suppliers' catalogue listings.
Public authorities, where the law requires it.
4. Guests' data: the couple as controller
The guest list, replies to the invitation and photographs uploaded by guests are entered by the couple or their coordinator, and they decide their purpose. For that data the couple is the controller and we are the processor under Art. 28 GDPR: we process it only to make the service work, on the couple's instructions, using the recipients listed in section 3, and delete it when the wedding is deleted. Guests exercise their rights with the couple whose wedding the data belongs to. We gladly help the couple answer.
5. How long we keep data
Account and wedding data for the life of the account. The wedding site stays online after the wedding. Photographs and films in the wedding's album are kept for 2 years after the wedding day and, while the couple subscribe to Memories forever, to the end of the period paid for. After that we remove them within 90 days. After the account is closed we delete everything within 30 days. Backups roll over within 90 days. Accounting records for payments are kept by Creem for as long as the law requires. Records of rewards paid to partners are kept for 10 years, as the Slovak Accounting Act requires. Operational logs are kept at most 12 months.
6. Cookies and consent
Essential cookies (sign-in, security, remembering your choice) run without consent, because the service does not work without them. Analytics and advertising start only after your consent in the cookie banner. Until then they store no identifiers. You can change your decision at any time via the link in the footer. Withdrawing consent is as easy as giving it.
7. Your rights
You have the right of access, rectification, erasure, restriction, portability, and to object to processing based on legitimate interest. Consent can be withdrawn at any time. Write to ahoj@handfast.wedding. We answer within 30 days. You may lodge a complaint with the Office for Personal Data Protection of the Slovak Republic (dataprotection.gov.sk).
8. Security
Transfers are encrypted, passwords are stored only as hashes, access to production data is limited to authorised persons, and photographs awaiting approval are kept outside public storage.
9. Changes to this policy
We announce substantial changes by e-mail or in the service. The current version is always at this address.