Aisleful Data Processing Agreement

Last updated: 6 September 2026

This Data Processing Agreement ("Agreement") forms part of the Aisleful Terms and Conditions and applies whenever you (the "Controller", "you", "your") use Aisleful to collect, store, or share photos and videos from your wedding guests.

It is agreed between:

• The Controller: you, the couple who purchased an Aisleful gallery.
• The Processor: Aisleful, a trading name of Matthew McDyer, sole trader, of 82A James Carter Road, Mildenhall, IP28 7DE ("Aisleful", "we", "us").

By creating an Aisleful gallery and accepting these Terms, you agree to this Agreement. If you do not agree, please do not use Aisleful.

1. Why this Agreement exists

When your wedding guests scan your QR code and upload photos or videos, they are giving personal data (their images, and sometimes their names or comments) to you, the couple, for your wedding gallery. You decide why this data is collected and what happens to it. Aisleful is simply the platform that stores and processes it on your behalf.

Under UK GDPR, this makes you the data controller and Aisleful the data processor. Article 28 of UK GDPR requires a written contract between a controller and processor setting out specific terms. This Agreement is that contract.

2. What this Agreement covers

Subject matter: The hosting, storage, processing, and delivery of photos, videos, and any associated data uploaded to your Aisleful gallery by you and your guests.

Duration: From the date your gallery is created until the earlier of: the end of your chosen storage period (6 months, 12 months, 18 months, or Forever), account deletion, or termination of these Terms.

Nature and purpose of processing: Aisleful stores, organises, backs up, transcodes (where needed for video playback), and makes available for viewing and download the photos and videos uploaded to your gallery, purely so you and your guests can view, collect, and preserve them.

Type of personal data processed:

• Photos and videos of your guests and wedding day
• Names or nicknames guests choose to attach to uploads (optional, guest-provided)
• Any captions or comments guests add
• Technical data needed to run the service (upload timestamps, file metadata, device/browser type, IP address at time of upload)

Categories of data subjects: Your wedding guests, you, and any other individuals appearing in uploaded content.

3. Aisleful's obligations as Processor

Aisleful will:

1. Only act on your instructions. We will only process data as needed to run the Aisleful service you signed up for, or as otherwise instructed by you through the platform (e.g. deleting a photo, closing a gallery, transferring ownership). We will not use your guests' photos or data for any other purpose, including marketing, without your separate consent.

1. Keep it confidential. Anyone who could access your data, including us and anyone we bring in to help run the service, is bound by confidentiality obligations.

1. Keep it secure. We use appropriate technical and organisational measures to protect your data, including encryption in transit and at rest, access controls, and regular security review. Our infrastructure runs on Amazon Web Services (AWS), hosted in the UK (London, eu-west-2 region).

1. Only use approved sub-processors. We use AWS as our infrastructure sub-processor for storage, compute, and delivery. All data stays within AWS's UK region and does not leave the UK as part of normal operation. If we ever need to add or change a sub-processor in a way that could affect where or how your data is processed, we will notify you in advance via the email on your account, giving you the opportunity to object.

1. Help you meet your obligations to your guests. If a guest asks you to access, correct, or delete their data, we will provide reasonable tools and assistance (including gallery management features) to let you action that request.

1. Help with security and breach obligations. If we become aware of a personal data breach affecting your gallery, we will notify you without undue delay, and no later than 72 hours after becoming aware, with enough information for you to assess the impact and meet your own reporting obligations.

1. Delete or return data at the end. When your storage period ends (unless you have a Forever plan) or your account is closed, we will delete your gallery data within 30 days in line with our published retention terms, except where we are required to retain it by law.

1. Allow reasonable audit. We will make available the information reasonably necessary to demonstrate compliance with this Agreement, and allow for audits, including inspections, conducted by you or an auditor you appoint, on reasonable notice.

4. Your obligations as Controller

You confirm that:

• You have a lawful basis for collecting your guests' photos and data (for most weddings, this will be your legitimate interest in creating a shared memory of the day, alongside your guests' reasonable expectation that photos taken at a wedding may be shared with the couple).
• You will make sure your guests have a reasonable understanding of how their photos will be used, for example by mentioning the Aisleful QR code and gallery on your invitations, at your venue, or on table cards.
• You are responsible for deciding who your gallery is shared with, and for any decisions about making it public, private, or transferring ownership.
• You will not use Aisleful to collect special category data (such as health or religious information) beyond what is incidentally visible in ordinary wedding photos.

5. International transfers

As of the date of this Agreement, all data is stored and processed within the UK. We do not transfer your data outside the UK as part of the standard service. If this changes in future, we will update this Agreement and notify you, and will only do so on the basis of an appropriate safeguard recognised under UK GDPR (such as the UK International Data Transfer Agreement or an adequacy decision).

6. Liability

Aisleful is operated by Matthew McDyer as a sole trader. Nothing in this Agreement excludes or limits liability for death or personal injury caused by negligence, fraud, or any liability that cannot be excluded by law. Subject to that, Aisleful's total liability arising out of or in connection with this Agreement is limited to the amount you paid for your Aisleful gallery in the 12 months before the claim arose.

Each party remains responsible for its own compliance with UK GDPR and the Data Protection Act 2018.

7. Sub-processor details

We will keep this list up to date and notify you of any changes as described in Section 3.4.

8. General

• This Agreement is governed by the laws of England and Wales.
• If any part of this Agreement is found unenforceable, the rest continues to apply.
• We may update this Agreement from time to time to reflect changes in the law or our service; we will notify you of material changes.