Data Processing Addendum

This Data Processing Addendum ("DPA") is part of the agreement between Elena Kravtsova (the "platform", "we") and the organiser of an event on https://inviteberry.com (the "organiser", "you"). It applies from the moment you accept it in the organiser panel, and the current version covers every event you administer. It exists because running your event means handling other people's personal data, and the law requires the split of responsibility to be in writing: Articles 28 and 26 of the GDPR where EU law applies, and the outsourcing rules (regulation 15, מיקור חוץ) of Israel's Privacy Protection (Data Security) Regulations 5777-2017.

Responsibility is allocated per operation, not per party. The plain-language version is the "Who is responsible for what" section of our Privacy Policy; Annex B below is the full matrix. Questions: [email protected]

Part 1: processing on your instructions (Art. 28)

This part applies where you are the controller of guest data and we process it for you: the guest contacts you upload, RSVP answers, event messages sent on your instructions, and seating, task, gift and event-finance records (the "instructed processing").

• We process the instructed data only on your documented instructions, given through the panel and this DPA, and for no other purpose. If we believe an instruction breaches data-protection law, we tell you and do not carry it out.
• Everyone we authorise to process it is bound by confidentiality.
• We protect it with the technical and organisational measures described in our Privacy Policy (Art. 32), and we assist you with your own security, breach-notification and assessment duties (Art. 32-36). If a breach affects your guest data, we notify you without undue delay.
• We assist you in answering data-subject requests. In practice we go further: anyone may send their request directly to us and we handle it (see Part 2).
• When the event data is deleted (your deletion, or the retention deadline), the instructed data is deleted with it. We retain only what law requires or what evidences this agreement; the Privacy Policy names those records and their periods.
• We make available the information needed to demonstrate these duties are met and answer reasonable audit enquiries in writing; the registers behind this DPA are published or available on request.

Subprocessors. You give general authorisation to the service providers we use; the current list, with each provider’s role, processing location and transfer safeguard, is published on the Subprocessors page (/legal/subprocessors). We add or replace a subprocessor that touches guest data only after notifying organisers at least 30 days in advance, to the organiser account email, so you can object before it starts; if we cannot resolve an objection, you may end the relationship and have the event data deleted.

Israeli layer. For your guest-list collection you are its owner and we act as its holder (מחזיק). This DPA is the written instrument regulation 15 (מיקור חוץ) requires, and the duties above apply to the Israeli databases with the same content.

Part 2: what we decide together (Art. 26)

For exactly one operation you and we are joint controllers: storing the photographs and videos your guests upload and showing them to the authenticated guests of your event, including who counts as that audience and how long the gallery stays open within our cap, together with the aggregated like-counts published inside it. Nothing else is joint: everything under "Where we act in our own right" below is ours alone.

The essence of this arrangement is public, in the Privacy Policy section "Who is responsible for what". Whichever of us a guest approaches, we handle the request and do not send them away; a guest may nonetheless exercise their rights against either of us.

Where we act in our own right

Platform security, upload screening and moderation, decisions on removal requests and their appeal, the outside retention limits, metadata stripping, the re-upload blocklist, the "find photos of me" feature and its consent, the thresholds on published like-counts, analytics and legal compliance are processing we alone control. An instruction from you cannot require us to keep a photograph up, to skip screening, to extend retention beyond our limits, or to disregard a request from a person who appears in a photograph.

Your side

• You confirm you may lawfully share each guest’s details with us and that each guest has agreed to receive messages about this event, and you tell us without delay of any opt-out, correction or removal request you receive yourself.
• You use guest data and the gallery for this event only, and you do not turn event messages into advertising material (דבר פרסומת) under Section 30A of the Communications Law (Bezeq and Broadcasts) 5742-1982.
• You answered whether you organise privately or professionally when accepting this DPA, and you keep that answer accurate. If you organise professionally (as a planner, photographer, venue, agency or other business), you are a controller in your own right for your client work and this DPA binds you as one.
• When you accept this DPA you also confirm that you may act for the organisers of the events you administer, and that each event’s public address, which cannot be changed once the event exists, is agreed with them. We keep a record of that confirmation with the wording you were shown.

Annex A: the instructed processing

The operations Part 1 covers, kept current in our internal processing register: guest-list intake (manual entry, file import or WhatsApp), RSVP collection, event messaging with delivery statuses, and seating, tasks, gifts and event finance. Field-level detail, purposes and retention are summarised in the Privacy Policy.

Annex B: role matrix

Version 2026-08. Your acceptance is recorded with the version, a fingerprint of the exact wording shown, the time and your organiser-type answer; when the wording changes, you are asked again at your next sign-in and the earlier record is kept.