Data processing agreement

This data processing agreement ("DPA") is part of the terms of service between the organizer who uses Wanrak ("you", the controller) and the company that operates Wanrak ("we", the processor). It applies whenever we process personal data for you, and it is accepted when you accept the terms. If this DPA and the terms disagree about personal data, this DPA wins.

Scope

• Subject and purpose: hosting your event sites and providing the studio and the tools you use: guest lists, replies and questions, messages, photos and moderation, check-in, seating, the wedding party, games, singles, planning and exports.
• Data subjects: your guests (including children you list), your team members and wedding party, and vendors you give task links to.
• Data: names, household details, contact details you add, replies and answers (which may include meal and access needs), photos, voice and written messages, check-in and seating records, planning data and, if singles is on, singles profiles.
• Duration: for as long as you use Wanrak, plus the deletion periods below.

Our duties

• We process personal data only on your documented instructions. You give those instructions by how you set up and use Wanrak, and through this DPA. If we believe an instruction breaks data protection law, we tell you.
• Everyone who works on Wanrak and can access personal data is bound to confidentiality.
• We keep appropriate technical and organizational security measures, including encryption in transit, private file storage shared only through short-lived links, tested separation between events, role-based access, two-step sign-in available to organizers, records of sensitive actions and limited, recorded staff access. We may improve them, but never lower the overall level of protection.
• We help you answer requests from the people concerned. The studio lets you export one guest's data, erase a guest with their photos, answers and messages, and delete an event. If a request reaches us, we pass it to you and do not answer it ourselves, unless the law requires otherwise.
• We help you with security, breach notification, impact assessments and consultations with authorities, as far as our role and the information we have allow.

Sub-processors

You authorize us to use the sub-processors listed in the privacy policy. We bind each of them in writing to data protection terms that protect the data at least as well as this DPA, and we remain responsible to you for them. We give you at least 30 days' notice before adding or replacing a sub-processor that handles your data. If you object on reasonable data protection grounds and we cannot solve it, you may stop using the affected feature or end the terms for that part.

Personal data breaches

If we become aware of a personal data breach that affects your data, we tell you without undue delay, and we aim to do so within 24 hours. We give you the information you need to meet your own duties (such as notice to the Thai PDPC or another authority within 72 hours, and to the people concerned) as it becomes available, and we take reasonable steps to contain the breach. Telling you is not an admission of fault.

Deletion and return

You can export your data and delete events yourself at any time. A deleted event can be restored for 30 days and is then deleted for good, files included; database backups expire within 7 days after that. When the terms end, we delete your data in the same way unless the law requires us to keep it.

Audits

On request, we give you the information reasonably needed to show that we meet this DPA, such as our security description and our sub-processors' certifications. If that is not enough, or an authority requires it, you may audit us once a year at your own cost, with 30 days' notice, during business hours, under confidentiality and without access to other customers' data.

International transfers

Data is stored in Singapore and some sub-processors work in other countries. Where the GDPR applies to a transfer to us, the European Commission's standard contractual clauses (Decision 2021/914, module two for you as controller, module three where you are a processor) are part of this DPA, with you as data exporter and us as data importer, the optional clause 7 and option 2 of clause 9 (general authorization, with the notice period above), and the law and courts of Ireland. Where the UK GDPR applies, the UK addendum to those clauses applies too. Where Thai law applies, transfers follow the PDPA and the PDPC's rules on appropriate safeguards. The annexes of the clauses are filled in by this DPA and the privacy policy.

California and other US state laws

Where the CCPA or another US state privacy law applies, we act as your service provider or processor. We do not sell or share the personal data, do not keep, use or disclose it for any purpose other than providing Wanrak to you or as the law permits, do not use it outside our direct business relationship with you, and do not combine it with personal data from other sources except as the law allows. We comply with those laws, give the same level of protection they require, tell you if we can no longer meet them, and let you take reasonable steps to stop and fix unauthorized use. We certify that we understand and will comply with these restrictions.

Liability

Each party's liability under this DPA is subject to the limitations in the terms, as far as the law allows. Nothing limits a person's rights under the standard contractual clauses.