Legal notice

Personal data

Who is responsible for what

The service handles two kinds of personal data, and each kind has its own controller.

For an organiser's account and for the use of the site, Grand Oui is the controller.

For guest data — the list, the addresses, the answers — the couple organising the wedding is the controller. Grand Oui stores it on their behalf and touches it only to run the service. A guest who wants to exercise their rights writes to the couple first; writing to us works too, and we answer.

What the service handles

For an organiser: the e-mail address, optionally a name, a password kept as a hash or sign-in by e-mail link, and the browsing sessions.

For a guest: first and last names, age group, the answers (coming or not, and to which parts), the menu choice, allergies or dietary needs, the note left for the couple; for the household: the postal address, the e-mail address, the phone number and the language. The address carries the printed invitation, the e-mail carries the online one.

The rest is technical: a hash of the IP address, never kept in the clear, to limit attempts on the public forms; the change log on guest data; the e-mail delivery statuses, delivered or bounced.

Why, and on what basis

Running the service: the contract with the organiser and, for a guest, the organisation of the wedding they take part in.

Rate limiting and abuse prevention: our legitimate interest in keeping the service safe.

Allergies and dietary needs are health data. They are typed in voluntarily, by the guest or on their behalf, so they can be fed safely: the basis is consent, withdrawn by clearing the note.

The e-mails — invitation, confirmation, reminder — go out in the organising couple's name. Every reminder carries an unsubscribe link, honoured immediately.

How long

As long as the wedding stays active. An organiser can ask for the export and then the complete deletion of the event; a guest can write to us for the same. Sessions expire on their own.

Who sees the data

The organising couple, first of all. Our only processors: our e-mail delivery provider. Nothing is sold, nothing goes to advertising, and there are no third-party trackers.

The data is hosted in the European Union.

Your rights

Access, rectification, erasure, restriction, portability, objection, withdrawing consent: write to the contact address above. For a wedding's data the couple is your first point of contact; we pass the rest on.

You can also go to the ICO (ico.org.uk) in the United Kingdom or the CNIL (cnil.fr) in France.

Cookies

The site sets a single strictly necessary cookie: a signed-in organiser's session, closed to JavaScript and valid for ninety days at most. Guest pages set none. No analytics, no advertising, no trackers: that is why there is no consent banner.