Data processing agreement (GDPR article 28)

1. Purpose and duration

The processor processes guest data only to provide the service: invitations, replies, sending, organization of the celebration day, keepsake and thank-you notes. The agreement lasts as long as the event exists, then until the data is erased.

2. Data and data subjects

Data subjects: the host’s guests and people who register through the host’s public link. Data: identity, contact details, language, replies, menus and, if the host asks, allergies and kashrut preferences entered by the guest; photos, messages and gifts posted during the celebration.

3. Processor’s obligations

The processor acts only on the controller’s documented instructions, given through the controller’s settings in the service. It ensures the confidentiality of the people authorized to process the data and implements appropriate security measures: encrypted connections, signed personal links stored as hashes, per-event access control, logging of sensitive actions, hosting in the European Union.

It helps the controller respond to data subjects’ requests (each guest can erase their data from their invitation) and ensure the security of processing.

It notifies the controller of any personal data breach without undue delay, and no later than 48 hours after becoming aware of it.

4. Sub-processors

The controller authorizes the providers listed in the privacy policy. The processor informs the controller of any planned change; the controller may object by deleting the event.

5. End of processing

Guest data is erased automatically at the end of the chosen retention period (6 to 12 months after the event), or immediately when the event is deleted (permanent erasure within 30 days). Before that, the host can export their lists and keepsake.

6. Audit

The processor makes available to the controller the information needed to demonstrate compliance with these obligations, upon written request to contact@simha.example.