Skip to content

Privacy policy

Last updated: April 15, 2026

In compliance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on Personal Data Protection and guarantee of digital rights (LOPDGDD), we inform users about the processing of their personal data.

1. Data controller

  • Operator: Lifetime Weddings
  • Address: C/ Mare Molas, 26, 43204 Reus
  • Email: [email protected]

2. Purposes and legal basis

  • Handling enquiries received via the contact form or quiz (basis: consent).
  • Preparing and tracking wedding photography/video proposals, including sending personalised links to the couple (basis: pre-contractual measures at the request of the data subject).
  • Formalising and executing the contract when you book the service, including collecting tax data (DNI/NIE, address) required to issue invoices (basis: contract performance and legal obligation under Spanish tax law).
  • Audit and abuse prevention: recording IP address and user agent on booking-form submission, limited to what is necessary to detect fraud or automated use (basis: legitimate interest).

3. Data retention

The following periods apply from the date each record is created, unless legislation requires a longer period or the data subject has requested earlier erasure:

  • Leads (enquiries not converted into a contract): 12 months.
  • Quote proposals not accepted: 6 months.
  • Bookings archived without contract: 6 months from archival.
  • Tax and billing data of contracted weddings: 6 years from the wedding date, per art. 30 of the Spanish Code of Commerce and Spanish tax regulations.
  • Activity logs (visits, events): 12 months.

Purging is performed automatically on the system on a periodic basis.

4. Recipients and processors

We do not share your data with third parties for their own commercial purposes. We do use processors strictly necessary to operate the service, all under contractual safeguards compliant with the GDPR:

  • Railway, Inc. (USA) — web and database hosting. Sub-processor.
  • Resend, Inc. (USA) — transactional email delivery (confirmations, internal alerts, auto-replies).
  • Cloudflare, Inc. (USA) — captcha (Turnstile) for abuse prevention on public forms.
  • Telegram FZ-LLC (United Arab Emirates / United Kingdom) — internal notifications to our team; only a minimal summary is transmitted (couple, date, venue), no tax data or DNI.
  • Behold Inc. (United Kingdom) — proxy that renders the Instagram feed on the home page; only your IP is processed when loading the page.
  • Google LLC / YouTube LLC (USA) — web fonts (Google Fonts), video embeds (YouTube) and web analytics (Google Analytics 4, with anonymised IP, conditional on cookie consent). Your IP is processed when loading these resources.
  • Google Maps Platform (USA) — one-off lookup of the Google Business Profile rating shown on the home page; called from the server, your IP is not transmitted.

5. International transfers

Some of the above processors are established outside the European Economic Area, mainly in the United States. These transfers are made under Standard Contractual Clauses (SCC) approved by the European Commission and/or under the EU-U.S. Data Privacy Framework, depending on the provider.

6. Cookies

We use first-party cookies that are strictly necessary (admin session, your preference choice on the cookie banner). Third-party resources loaded on the site (YouTube videos, Instagram feed, Google Fonts) may set their own cookies when activated. More information at /cookies.

7. Data-subject rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time by writing to [email protected] proving your identity. If you believe your rights have not been properly addressed you can file a complaint with the Spanish Data Protection Agency (aepd.es).

8. Security measures

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, loss or destruction. Admin passwords are stored as bcrypt hashes; communications between the browser and the server are encrypted with HTTPS; backups are made on the persistent volume hosted at Railway.

Chat with us