Data processing agreement
This is a translation of the Spanish version, which prevails in case of doubt. Last updated: 9 October 2026
You accept this agreement (article 28 of the General Data Protection Regulation) when you create your account, together with the terms of service.
1. Parties and purpose
Controller: the couple who create their wedding website.
Processor: Daniel Ceballos, contact email hola@webding.es, owner of webding.
On the controller's behalf, the processor processes the data that guests send from the wedding website and what the couple writes down about them in their panel, with the sole purpose of providing the service: storing it, showing it in the couple's panel, allowing it to be downloaded and, if the couple asks, sending their guests the invitation by email.
2. Data and data subjects
- Data subjects: wedding guests and the people coming with them (including children, whose data is provided by the adult guest).
- Data: name, email, phone, attendance, number of adults and children, names of companions, menu, song, message, answers to the couple's questions and, if the guest gives them with explicit consent, allergies, intolerances or a gluten-free menu (health data, article 9 GDPR).
- Data the couple writes down: their guest list (name, group or family, adult or child, email and phone), the replies they receive by phone or in person (with the same data as those from the website), each guest's table, the favour they give them and who has been sent the invitation by email. As controller, the couple guarantees they may process it to organise their wedding; if they enter someone's allergies or gluten-free menu, they do so with that person's permission.
3. Duration
While the website is active. The replies, the guest list, the seating plan, the favours and the record of invitations sent are deleted automatically 90 days after the wedding date (the website is archived after 30 days and the couple is reminded so they can download them), or sooner if the couple deletes them or closes their account.
4. Processor's obligations
- To process the data only on the controller's documented instructions (this agreement and what they indicate from their panel) and not to use it for its own purposes.
- To guarantee the confidentiality of the people authorised to process it.
- To apply appropriate security measures: encryption in transit, access to the replies only for the couple and after a recent login, explicit consent for health data, encrypted backups and automatic deletion.
- Authorised sub-processors: Cloudflare, Inc. (hosting, database, backups and anti-bot protection; a member of the EU-US Data Privacy Framework) and Resend (login emails and, if the couple asks, the invitations by email to their guests; servers in the EU). The controller will be informed of any change and may object.
- To help the controller respond to data subjects' rights (access, rectification, erasure, objection, restriction and portability).
- To notify the controller, without undue delay and within 48 hours at the latest of becoming aware of it, of any security breach affecting their data.
- To delete the data when the service ends, unless there is a legal obligation to keep it.
- To make available to the controller the information needed to demonstrate compliance with these obligations.
5. Controller's obligations
- To use the data only to organise the wedding.
- To deal with guests who ask to access, change or delete their reply (they can do it from their panel).
- To keep any copies they download (for example, the Excel file) under their own responsibility.
6. Contact
For any question about this agreement: hola@webding.es.