1. Controller
The controller of personal data is Brutuscore s. r. o., Lermontovova 911/3, 811 05 Bratislava, Slovakia, company ID 57 114 129. For anything concerning personal data, write to ahoj@handfast.wedding.
2. What we process and why
Account: name, e-mail and password (stored as a hash) — to run your account. The legal basis is performance of the contract.
Wedding: names, date, venue, texts and photographs you put into the planner — to provide the service. Performance of the contract.
Payments: processed by Creem as the merchant of record. We see the payment's status, never card details.
Operational records: IP address and technical logs — for security and abuse detection. Legitimate interest.
Measurement and advertising: only with your consent, given in the cookie banner.
3. Who we share data with
Creem (Armitage Labs OÜ, Estonia) — payment processing as merchant of record. An EU server infrastructure provider — storage of data and photographs. Google — analytics and advertising, strictly after consent (Consent Mode v2). Public authorities may be recipients where the law requires it.
4. Guests' data — the couple as controller
The guest list, replies to the invitation and photographs uploaded by guests are entered by the couple or their coordinator, and they decide their purpose — for that data the couple is the controller and we are the processor under Art. 28 GDPR: we process it only to make the service work, on the couple's instructions, and delete it when the wedding is deleted. Guests exercise their rights with the couple whose wedding the data belongs to. We gladly help the couple answer.
5. How long we keep data
Account and wedding data for the life of the account. After the account is closed we delete everything within 30 days. Backups roll over within 90 days. Accounting records are kept by Creem for as long as the law requires. Operational logs are kept at most 12 months.
6. Cookies and consent
Essential cookies (sign-in, security, remembering your choice) run without consent — the service does not work without them. Analytics and advertising start only after your consent in the cookie banner. Until then they store no identifiers. You can change your decision at any time via the footer link — withdrawing consent is as easy as giving it.
7. Your rights
You have the right of access, rectification, erasure, restriction, portability, and to object to processing based on legitimate interest. Consent can be withdrawn at any time. Write to ahoj@handfast.wedding. We answer within 30 days. You may lodge a complaint with the Office for Personal Data Protection of the Slovak Republic (dataprotection.gov.sk).
8. Security
Transfers are encrypted, passwords are stored only as hashes, access to production data is limited to authorised persons, and photographs awaiting approval are kept outside public storage.
9. Changes to this policy
We announce substantial changes by e-mail or in the service. The current version is always at this address.