Privacy policy

Your privacy matters to us. This policy explains in plain language what data we collect, why, how long we keep it, and how you can change or delete it.

Who's the controller

The data controller is the team running epozivnice.me — registered as a sole proprietor in Montenegro. For questions, objections or deletion requests, email info@epozivnice.me.

What data we collect

• Event organisers: couple/celebrant names, contact email and phone, event date and venue.
• RSVP guests: full name, party size, optional message.
• Guests uploading photos: the photos themselves, optional uploader name, IP address.
• Technical logs: IP address, user-agent, timestamps (for abuse prevention).
• Contact form: name, email, phone, event type, message — sent through the website form.

Why we process it

Solely to provide the service — render the invitation, receive RSVP responses, host photos and contact you or the organiser if needed. We do not sell, do not share for third-party marketing, and do not profile users.

Legal basis

• Contract (GDPR 6.1.b): when an organiser orders an invitation and enters guest data.
• Consent (GDPR 6.1.a): when a guest voluntarily RSVPs or uploads a photo.
• Legitimate interest (GDPR 6.1.f): technical logs to prevent attacks and spam.

How long we keep it

• Event content (RSVP, photos): per package — 90 or 160 days after event date, then auto-deleted.
• Contact form: 12 months from submission, or until you request deletion.
• Technical logs: 90 days.

Who we share with

Data is never sold. It's shared only with the technical providers we use to deliver the service:

• Hetzner Online GmbH — server and photo hosting (Germany / Finland, GDPR-compliant).
• Resend, Inc. — transactional and contact email delivery.
• Cloudflare — DNS, security and Turnstile (bot protection).

Your rights

Under the Montenegrin Personal Data Protection Act and GDPR you have the right to:

• Access the data we hold about you.
• Correct inaccurate or outdated data.
• Deletion ("right to be forgotten") — anything not legally required to retain.
• Portability — receiving data in a machine-readable format.
• Object to processing based on legitimate interest.

Send all requests to info@epozivnice.me — we respond within 30 days.

Cookies and local storage

We use only essential (functional) cookies and localStorage entries strictly needed for the site to operate. We do not load Google Analytics, Facebook Pixel, or other tracking tools. We do not share data with advertising networks.

• epoz.cookie-consent.v1 (localStorage) — remembers your "OK" click so the banner does not reappear.
• epoz.uploader-name.<slug> (localStorage) — only on the photo upload page; remembers the guest name so it doesn't need re-entry per upload.
• Keycloak SSO (cookies on auth.epozivnice.me) — authentication for owners and planners; set only after panel login.
• Cloudflare Turnstile (cf_clearance, _cfuvid) — antibot protection for the contact form; without these cookies the form cannot distinguish humans from bots.

Since all entries are strictly necessary for the site to function, we do not request explicit per-entry consent (in line with ePrivacy Directive Article 5 and EDPB guidance on "strictly necessary" cookies).

Policy changes

If we make material changes, we'll notify organisers with active events by email. The last-updated date is shown at the top of this page.

Supervisory authority

If you believe we have not respected your rights, you can file a complaint with the Montenegrin Agency for Personal Data Protection.