Last updated: 2 October 2026
This data processing agreement ("DPA") is part of our terms of service. It applies when you, a couple, wedding planner or venue (the "customer"), put personal data about other people into seatings, mostly your guests. For that data you are the controller and Seatings ("we") is your processor. It follows Article 28 of the EU General Data Protection Regulation (GDPR) and the data protection law that applies to us. You accept it by using the service; you do not need to sign anything.
What we process
- Subject matter and purpose: running seatings for you: guest lists, seating plans, online RSVP, print files and AI seating, as described in our terms and privacy policy.
- People concerned: your guests and anyone else you add to a plan, and guests who reply to your RSVP.
- Kinds of data: names, groups or sides, plus-ones and children (including ages if you or your guests add them), table and seat, meal choices, allergies and dietary needs, notes, RSVP answers and messages, and contact details a guest leaves on an RSVP request.
- Special categories: allergies and dietary needs can reveal health information. We only store them and show them to you; please only collect what your caterer needs.
- Duration: for as long as the plan exists. You can delete a plan, or all your data, at any time in the app.
Our commitments
- Only on your instructions. We process the data only to provide the service you use and as these terms describe, unless the law requires otherwise, in which case we tell you first where we may.
- Confidentiality. Everyone who can access the data is bound to keep it confidential.
- Security. We protect the data with measures that fit the risk, including encrypted connections (HTTPS), encryption of all stored plans, guest data and RSVP answers on our servers and in backups (AES-256), signed session cookies, access controls on every plan and link, rate limits against abuse, and no cookies on your guests' RSVP pages.
- Sub-processors. You authorise the providers listed under "Who else processes your data" in our privacy policy. Each is bound by data protection terms at least as strict as these. We announce changes on that page at least 14 days in advance; if you object, you can stop using the service and delete your data.
- International transfers. We are established outside the European Economic Area. Where a transfer needs a safeguard, ours rely on appropriate safeguards such as the European Commission's standard contractual clauses, and the same applies to any provider outside the European Economic Area whose destination has no adequacy decision.
- Helping you with your guests' rights. The app lets you view, correct, export and delete guest data yourself. If a guest contacts us directly, we pass the request on to you, and we help with anything the app cannot do.
- Breaches. If we become aware of a personal data breach affecting your data, we tell you without undue delay, and in any case within 48 hours, with what we know and what we are doing about it.
- Help with compliance. We give you the information you reasonably need for data protection impact assessments and consultations with authorities.
- Deletion. When you delete a plan or your account, the data is deleted from our live systems right away and from encrypted backups within 30 days. Before that you can download everything with Download my data.
- Audits. We make available the information needed to show we meet this DPA. Write to us for it; audits on site are possible with reasonable notice and at your cost, where the law gives you that right.
Your commitments
You are responsible for having a lawful basis to add your guests' data, for telling your guests how you use it, and for only adding what you need to plan the seating and print the cards.
Contact
Questions about this DPA: our contact form or the contact form.