Data-processing agreement (Article 28 GDPR)

Version: 2026-08-21 (draft, before the service goes on sale, without a lawyer's review — said openly). This agreement is accepted by checkbox at booking; the time of acceptance and the version are stored with the order.

1. Parties and subject matter

Controller: the host who books the party. Processor: Marc Adrian Peters, Heinrichsallee 22–24, 52062 Aachen, Germany. The subject matter is hosting, displaying and keeping available the photos and videos uploaded by party guests, for the duration of the booked party including its retention window.

2. Nature, purpose, categories of data, data subjects

Processing: storing, displaying, serving and deleting guest media. Categories: guests' photos and videos, random device identifiers, session state. Data subjects: party guests and the people shown in the media.

3. Instructions

We process party content only within this contract and the functions of the service (showing, hiding and deleting by the host). Independently of that we remain the controller for platform-level processing — moderation, abuse prevention, statutory preservation and reporting — and that processing is not open to instruction.

4. Confidentiality and security

Only the provider has access to production data; guest-related identifiers are hashed before any durable log entry; guest media sits in an EU bucket and party state in EU-pinned instances. Further technical and organisational measures are described in the privacy notice.

5. Sub-processors

The further processors engaged are the ones in the versioned list in the privacy notice (version 2026-08-07). Changes are announced with a version; where there is a legitimate objection, the contract may be terminated as of the announced date.

6. Assistance with data-subject rights

We give the host tools for discharging data-subject rights (hiding, deleting by device identifier, the report flow) and otherwise assist to a reasonable extent.

7. Deletion at the end of the contract

When the 90-day retention window expires — or the extended window, if one was booked — the party's content is deleted; the privacy notice explains what stays restorable and for how long. Content under a statutory preservation duty and records that must be kept by law are excluded.

8. Evidence and audit

On request we demonstrate compliance with this agreement in a reasonable form (documentation, information). For a service of this kind, on-site audits are replaced by documented evidence to the extent the law permits.