Data Processing Agreement

This Data Processing Agreement is entered into between Ovation Keepsakes, S.L. ("Processor") and the wedding planner or professional event coordinator ("Controller") who has accepted our Planner Partner Terms. This DPA governs the processing of personal data carried out by the Processor on behalf of the Controller.

The Processor processes personal data solely to provide the Ovation guest messaging service on events managed by the Controller. The categories of data subjects are wedding guests, couples, and other individuals who interact with an Ovation event link created by the Controller. Personal data processed includes names, voice recordings, video recordings, photographs, and email addresses.

The Processor shall process personal data only on documented instructions from the Controller; ensure authorised persons have committed to confidentiality; implement appropriate technical and organisational security measures; not engage sub-processors without prior written authorisation; and delete or return all personal data upon termination of the agreement.

The Controller grants general written authorisation for the Processor to engage sub-processors. The Processor maintains a current list of sub-processors at ovation.wedding/sub-processors and will notify the Controller of any intended changes at least 14 days in advance.

The Processor shall promptly notify the Controller of any request received directly from a data subject and shall not respond to such requests itself, except where instructed by the Controller or required by law.

The Processor implements encryption of personal data in transit (TLS 1.2 or higher) and at rest (AES-256); access controls limiting data access to authorised personnel; regular security assessments; and a documented incident response procedure. The Processor will notify the Controller of any personal data breach within 48 hours of becoming aware of it.

This DPA is effective from the date the Controller accepts the Planner Partner Terms and remains in force as long as the Processor processes personal data on behalf of the Controller. Upon termination, the Processor shall delete or return all personal data within 30 days. For questions, contact privacy@ovation.wedding.