Data Processing (GDPR)

1. Roles

You decide which wedding content is entered, who can access it, which functions are used and when content is deleted. We process that content on your behalf as your processor and use it for nothing of our own. If you use the Service as a business, such as a wedding planner, you are responsible for your lawful basis and for giving the people concerned the information they are entitled to. Data-protection law does not apply to the couple’s own processing of personal data in the course of purely personal or household activities. Our processing remains subject to that law, and we apply these terms even when the couple’s own processing is exempt. Our suppliers’ roles depend on the purpose, so not every payment or support provider is a sub-processor for your wedding content.

2. Subject matter & duration

We process the personal data you enter to plan your wedding. We do so while your wedding workspace is active, unless you delete the data sooner or one of the periods in the retention section of the Privacy Policy applies.

3. Nature & purpose

We collect, store, organise, retrieve, transmit, display, export and delete wedding content to provide the planning, invitation, RSVP and photo functions you use. Processing also covers the optional AI actions you ask for. The Privacy Policy describes their limits and the providers we use for them.

We process the content only on your documented instructions, including on transfers outside the EEA. Your instructions are these terms and anything you write to us at the contact address below. What you do in the Service is also an instruction, for example when you add guests, send invitations, change settings or delete photos. If EU or Member State law requires us to process the content differently, we tell you before we do, unless that law prohibits it. We tell you immediately if we believe an instruction breaks data-protection law.

4. Categories of data & data subjects

• Data subjects: you, the people you invite to your wedding workspace, your guests, including children, and contact persons at the suppliers you add.
• Data: names and contact details, household relationships, invitations and RSVP answers, photos and greetings, gift wishes and who reserved them, emails and messages to guests and suppliers, and planning content such as suppliers, seating plans, schedules, budgets, notes, attachments and designs. Dietary and allergy notes are optional and may reveal health or religion. The RSVP form asks for separate consent to them, as described in the Privacy Policy. You must not ask us to process sensitive data that is not needed, for example by writing it in other free-text fields.

5. Providers and sub-processors

• Hetzner: hosting of the Service and its database, and storage of photos and files. Both in Finland (EU).
• Resend: sending emails, for example invitations and reminders to guests. May process outside the EEA.
• Google (Gemini): Lucia AI if you turn it on, importing supplier details from a link, and language help with a message to a supplier. May process outside the EEA.
• TypeSafe (Jev): suggestions for where Quick add text belongs, in weddings with the Wedding Pass. Guests’ and suppliers’ names are replaced before the text is sent. May process outside the EEA.
• OpenRouter: access to AI models for the AI features described in the Privacy Policy. We send requests only through OpenRouter’s European routing, so they are processed in the EU/EEA.

You give general written authorisation for the sub-processors on this list. We only choose providers that give sufficient guarantees for security and data protection. We impose on them by contract the same data-protection obligations we have under these terms, and we remain fully liable to you for their compliance. We email the workspace owner at least 30 days before we add or replace a sub-processor, so you can object. We also notify the owner the same way when these terms change. If we cannot find a reasonable solution to your objection, you can stop the affected processing or end the Service and ask for your data to be returned or deleted. This authorisation does not make an otherwise unlawful transfer lawful.

Stripe, Apple and GitHub are not sub-processors for your wedding content. We use them for payments, internal notifications to administrators and support cases, as described in the Privacy Policy.

6. Security measures

We protect the data with measures appropriate to the risk. All traffic between your browser or app and the Service is encrypted with HTTPS. Only members of a wedding workspace can access it, and guests see only what their own link gives access to. Administrative access is limited to the administrators who need it. Photos and files are shown through signed links that expire after a short time. The database cannot be reached from the internet, and access to backups is restricted. Everyone at FRAIM with access to your content is bound by confidentiality. We review the measures regularly and test that we can restore from backups. We may change the measures, but not in a way that lowers the protection. You can ask for the information you need to assess security, as long as sharing it does not harm other customers or the security of the system.

7. Data-subject requests

You can handle most requests yourself in the Service. You can correct and delete individual guests, and the workspace owner can delete all guests or all photos in settings. You can download the photo album, export the seating plan and delete your account. Guests can remove their dietary notes and their other details themselves through their link. If a request cannot be handled with these functions, for example when a guest asks for a copy of all their data, we help you find and provide it.

If we receive a request about your wedding content, we pass it to the workspace owner without undue delay. We do not answer it ourselves unless you ask us to or the law requires it. We also give you the information about the processing and its security that you need for an impact assessment or a prior consultation with the Danish Data Protection Agency (GDPR Articles 35–36). Section 8 describes what we do in case of a personal data breach.

8. Breach notification

If we become aware of a personal data breach affecting your wedding content, we email the workspace owner without undue delay. We do not wait until we know every detail. As we learn more, we tell you what happened, which data and people are affected, the likely consequences, what we are doing to deal with it and who you can contact. That lets you assess your own duties.

If you are a private couple and the breach is likely to result in a high risk to your guests or others whose details you entered, we also inform the people affected directly and notify Datatilsynet. You get a copy of what we send.

9. Return & deletion

You can correct and delete individual guests at any time. The workspace owner can delete all guests, all photos or the whole wedding workspace in settings. A photo that is hidden is deleted after 30 days unless it is restored before then.

When the Service ends, you decide whether your data should be returned before it is deleted or simply deleted. You do this by deleting the workspace yourself or by writing to the contact address below. You can download the photo album and export the seating plan yourself, and we help with the rest. When we delete data at your request, we confirm it by email. We handle backups as described in the Privacy Policy. If we restore a backup, we delete again what was already deleted before the data is used. If EU or Member State law requires us to keep something, we keep only what is necessary for as long as necessary, and we tell you.

10. International transfers

Hosting and file storage are with Hetzner in Finland (EU). Resend and Google can process data in the United States. Both are certified under the EU–US Data Privacy Framework, which the European Commission has found provides an adequate level of protection. TypeSafe and OpenRouter may process data outside the EEA under the European Commission’s standard contractual clauses. We transfer your content outside the EEA only on your instructions in these terms and with a valid transfer basis. If a basis ceases to apply, we find another or stop the transfer, and we tell you. You can write to us for more information about the recipients and safeguards. A supplier’s own terms do not change our obligations under these terms.

11. Information and audit

You can get the information needed to show that we comply with these terms. You, or an auditor you choose, can also carry out audits, including inspections, and we contribute to them. We agree scope, timing, confidentiality and security with you in advance, but this does not limit your rights or a supervisory authority’s powers. If an audit reveals shortcomings, we fix them. For our sub-processors, we give you their own audit reports or certifications where available. Write to us to arrange this.

12. Governing law

These terms are governed by Danish law. The section on applicable law and courts in the Terms & Conditions also applies to these terms.

13. Contact

Write to hej@fraim.dk if you have questions about these terms or want to give us instructions, for example about deletion, return of data or audits.