Fotia Weddings Privacy Policy

1. Who handles the data

• Account data (whoever signs up to create wedding websites): Fotia is the controller.
• Website content and guests' replies: the controller is whoever creates the wedding website — usually the wedding planner, on behalf of the couple — who decides what to publish and which replies to collect. Fotia processes this data on their behalf, as processor under Article 28 GDPR.

The roles depend on the data:

2. What data

• Account: name, email address, password (stored encrypted), login dates.
• Website content: the couple's names, the date, venues, schedule, accommodation, photos and, if the controller adds them, gift details (for example an IBAN).
• Guests' replies: first and last name of the person replying and of the attendees, attendance, who is a child, the chosen menu, any message to the couple.
• Dietary needs: allergies, intolerances and other needs entered by guests. These are health data (Article 9 GDPR): they are collected only with the explicit consent of the person replying, and the date of consent is recorded.
• Technical data: the IP address, used to limit abusive form submissions, and error logs.

We only process what the service needs:

3. Why, and on what basis

• Providing the service to the planner (account, websites, managing replies): performance of a contract (Art. 6(1)(b)).
• Collecting guests' replies on behalf of the controller: the legitimate interest of the couple and the guests in organising attendance at the wedding (Art. 6(1)(f)), assessed by the controller.
• Dietary needs: the guest's explicit consent (Art. 9(2)(a)), which can be withdrawn at any time.
• Security and abuse prevention: Fotia's legitimate interest (Art. 6(1)(f)).
• Legal obligations: Art. 6(1)(c).

We do not use the data for advertising, and we do not sell or hand it over to third parties.

4. Who sees it

• The wedding planner who controls the website, who may share it with the couple and, as far as needed, with the caterer and the venue.
• Guests see the website content, not other people's replies.
• Fotia, only for the necessary technical operations and at the controller's request.

A wedding website can be reached by whoever has its address, only once it has been published and activated, and it is not indexed by search engines.

5. Where, and with whom

Data is stored in data centres in the European Union. To provide the service we rely on providers of hosting, database, photo storage, email delivery and abuse protection, appointed as processors (Article 28 GDPR). The current list is available on request. Some providers belong to groups based outside the EU: any transfer takes place only with the safeguards of Articles 44 et seq. GDPR (adequacy decisions or standard contractual clauses).

6. How long

• Dietary needs: deleted automatically 30 days after the wedding.
• Guests' replies: deleted automatically 180 days after the wedding.
• Website content: until the controller deletes the wedding or the account.
• Account: until it is closed.
• Error logs: 30 days.

7. Your rights

Anyone can ask to access, correct or delete their data, restrict or object to its processing, or receive it in a readable format (Articles 15–22 GDPR), and withdraw consent for dietary needs at any time, without affecting what was done before.

Guests can contact the wedding planner who created the website, or write to us: we will forward the request to the controller. You can always lodge a complaint with your data protection authority (in Italy, the Garante per la protezione dei dati personali, garanteprivacy.it).

8. Cookies

Fotia Weddings only uses technical cookies, needed for login and preferences (for example the language). Details are in the cookie policy.

9. Changes

We may update this policy if the service or the law changes. The date at the top shows when it was last changed; we notify planners of significant changes by email or in the app.

10. Contact

For any question about privacy at Fotia Weddings: support@fotia.events.