Data Processing Agreement

Last updated: 1 October 2026

Who this agreement is between

This Data Processing Agreement ("DPA") is between you, the customer who buys an AisleReply plan ("you", the controller), and Unavoidable Studio Ltd, a company registered in England and Wales with company number 17367981, which runs AisleReply ("we", the processor). Our registered office address is on the Companies House register.

It forms part of our Terms of Service and applies whenever we handle personal data about your guests on your behalf. It is designed to meet Article 28 of the UK GDPR.

What we process

Subject matter and purpose: collecting, storing and presenting RSVP replies for your wedding events, sending the invitations and reminders you ask for, and producing your guest list exports.
Duration: from when you add guests until your data is deleted or returned, as described below.
People concerned: your guests and their plus-ones, and anyone you give access to your account.
Types of data: names, email addresses, mobile numbers, attendance replies, meal choices, answers to your custom questions, and dietary and allergy information. Dietary and allergy information can be health data, a special category of personal data.

Your responsibilities

You decide which guests are added and what they are asked. You confirm that you have a lawful basis to give us their details and to ask your questions, and that you only ask for what you need. Where you ask for dietary or allergy information, you are responsible for having a lawful condition for collecting it, such as the guest's explicit consent in their reply.

Our commitments

We will:

process your guests' data only on your documented instructions, which are your use of AisleReply, your setup requests and these terms, unless the law requires otherwise, in which case we will tell you first where the law allows;
tell you straight away if we think an instruction breaks data protection law;
make sure everyone who can access the data is bound by confidentiality;
keep the data secure with appropriate technical and organisational measures, including encryption in transit and at rest, access controls, monitoring and regular reviews;
never sell your guests' data or use it for our own marketing;
help you respond to requests from guests who want to use their data protection rights, and pass on any request we receive directly;
help you with security, breach notification and data protection impact assessments, taking into account the nature of our processing;
tell you without undue delay after we become aware of a personal data breach affecting your data, with the information you need to meet your own obligations;
make available the information you reasonably need to show that these obligations are met, and allow reasonable audits on notice, at your cost, no more than once a year unless a breach has occurred.

Sub-processors

You authorise us to use other providers to help deliver AisleReply, such as hosting, email and messaging delivery. We will only use providers who give the same level of protection as this DPA, under a written contract, and we remain responsible for them. A current list is available on request from privacy@aislereply.com. We will tell you before we add or replace a provider that handles guest data, so you have the chance to object.

Transfers outside the UK

If any guest data is processed outside the UK, we will make sure the transfer is protected by UK adequacy regulations or by approved safeguards, such as the UK International Data Transfer Agreement or Addendum.

Deletion and return

You can export and delete your guest data at any time. Your event is archived 12 months after your wedding date. When you ask us to, or when our agreement ends, we will delete or return your guests' data, unless the law requires us to keep it.

Contact

For anything about this DPA, email privacy@aislereply.com. If you need a signed copy for your records, ask and we will send one.