WedlySite privacy policy
Last updated: October 2026
WedlySite is a wedding website and digital invitation studio based in South Africa, run by Juan Theron and Emma Théron. WedlySite is operated by Wedlysite (Pty) Ltd, a private company registered in South Africa, registration number 2026/242854/07. In this Privacy Policy, "WedlySite", "we", "us", or "our" refers to Wedlysite (Pty) Ltd.
This Privacy Policy is for wedlysite.com, our website for couples anywhere in the world. It explains what personal information we collect, why we collect it, the lawful basis we rely on, who receives it, where it goes, how long we keep it, and what rights you have. It is written to meet the EU General Data Protection Regulation (GDPR), the UK GDPR, and South Africa's Protection of Personal Information Act (POPIA). It should be read together with our Terms and Conditions and our Cookie Policy.
By submitting an enquiry, completing a form, paying a deposit, approving a quotation, using our website, engaging our services, or submitting personal information to WedlySite, you confirm that you have read and understood this Privacy Policy.
1. Who this policy applies to
This Privacy Policy applies to visitors to wedlysite.com, clients who enquire about or book WedlySite services, both partners of the couple, guests who submit RSVP or guest forms through a WedlySite website, anyone who contacts us through our website, email, WhatsApp, social media, or Meta lead forms, and anyone whose personal information is provided to us as part of a project.
2. Who is responsible for your information
WedlySite decides how and why your personal information is used, so we are responsible for it. The GDPR and UK GDPR call this the "controller". POPIA calls it the "responsible party".
The one exception is guest information collected through a couple's RSVP or guest forms. There, the couple decides what is collected and why, and we handle it on their behalf. Section 4 explains how.
You can reach us by email at wedlysite@gmail.com or on WhatsApp at +27 68 616 5498.
Our address: 365 Kings Highway, Lynnwood, Pretoria, 0081, South Africa.
Information Officer under POPIA: Juan Theron.
3. What personal information we collect
We collect personal information only when it is provided to us directly, submitted through a form, or required to provide our services.
From the forms on wedlysite.com:
- Contact form: your names, email address, WhatsApp number, and message.
- Quote calculator: your names, email address, WhatsApp number, wedding date, the package and items you chose, your guest count, the number of small signs, and the quote total.
- With both forms, we also record the time you sent it and which form you used.
From clients, during a project, this may include: names, email addresses, phone numbers, WhatsApp details, wedding date, venue, guest count, package preferences, style and design preferences, enquiry messages, questionnaire answers, wedding day schedules, and images, videos, and other media supplied for the project.
From guests, through RSVP and guest forms, we collect only what the wedding needs: guest names, attendance responses, dietary requirements, and any other field the couple specifically requests. We do not collect guest email addresses or phone numbers unless the couple explicitly asks for a form field that does.
When you visit our website, our host receives your IP address and browser details so it can send you the pages. Vercel Analytics counts visits without cookies. If you accept, Google Analytics and Microsoft Clarity also collect how you use the site. Section 5 and our Cookie Policy explain each one.
When you submit a lead form through a Meta advertisement, Meta may pre-populate certain fields from your profile. This is handled by Meta under Meta's own privacy policy.
4. Information about wedding guests
Clients may ask WedlySite to create forms that collect guest information. The client is responsible for ensuring they are allowed to collect and use this information from their guests.
WedlySite processes guest information only on the couple's behalf, to provide the wedding website, RSVP, invitation, or related service the couple requested. Guest responses are stored in a spreadsheet shared only with the couple, are used solely for their wedding, and are deleted or handed over to the couple within 3 months after the wedding date. Unless a separate guest management service has been agreed, the couple remains responsible for reviewing and using the guest information collected through their website. Our Terms and Conditions (clause 19) set out what we promise the couple about their guests' information.
Dietary requirements can sometimes show something about a guest's health (an allergy) or religion (halal or kosher). We collect only what the guest chooses to share in that field.
5. How we use your information, and why
The law asks us to name a lawful basis for each use. These are the ones we rely on:
- Contract: we need the information to give you the quote you asked for, or to do the work you booked (GDPR and UK GDPR Article 6(1)(b), POPIA section 11(1)(b)).
- Legitimate interests: we have a fair business reason, and it does not override your rights. You can object at any time (Article 6(1)(f), POPIA section 11(1)(f)).
- Consent: you said yes. You can take it back at any time (Article 6(1)(a), POPIA section 11(1)(a)).
- Legal obligation: the law requires it (Article 6(1)(c), POPIA section 11(1)(c)).
5.1 Answering your enquiry or quote
- What: the details from our contact form or quote calculator (section 3).
- Why: to reply, check your date, and talk through your quote. When you send a form, we receive an email about it, and you receive a confirmation email, with your quote if you used the calculator. We usually reply first on WhatsApp. We may also send reasonable follow-ups after an enquiry. If we talk on a call, we may record it with Fathom to keep a record of what we discussed. We tell you before a call is recorded, and you can ask us not to record it.
- Lawful basis: contract (steps you asked for before a contract). Follow-ups and call recordings: legitimate interests.
- Who receives it: Google (our enquiry spreadsheet, through Google Apps Script, and our Gmail inbox), Resend (sends both emails), Vercel (hosts the website and runs the form), Fathom (call recordings), and Meta when we reply on WhatsApp.
- How long: up to 12 months from our last contact if no project goes ahead. Resend keeps a copy of each email for 30 days.
5.2 Leads from our Meta ads
- What: the details you submit in a Meta lead form.
- Why: the same as 5.1.
- Lawful basis: contract (steps you asked for before a contract).
- Who receives it: Meta, and our enquiry spreadsheet at Google.
- How long: up to 12 months from our last contact if no project goes ahead.
5.3 Planning and building your website and invitations
- What: the client information in section 3: names, contact details, wedding details, questionnaire answers, wording, images, videos, and other media.
- Why: to create the wedding website and digital invitations, build RSVP and guest forms, manage feedback and approvals, connect custom domains, provide support, and keep internal project records.
- Lawful basis: contract.
- Who receives it: Google (Gmail, Drive, Sheets and Calendar), Notion (our client records and project notes), Fathom (call recordings, as in 5.1), Jotform (onboarding questionnaires), Canva (designing invitations and stationery), GitHub (the code of your website), Vercel (hosts the finished website), domains.co.za (registers a domain we buy on your behalf), your own domain provider when we connect a domain you already own, and Meta (WhatsApp, Instagram, Facebook) when we talk there.
- How long: until 2 years after your wedding date, or 2 years after your last year of hosting ends if you renew it, whichever is later, then deleted. Invoices and payment records are kept longer, as in 5.4.
5.4 Invoices and payments
- What: your names, invoice details, the amounts, the payment reference, and the payment details that reach our bank when you pay through Wise: the payer's name, the amount, the date, the reference, and the transaction number. Wise does not show us the payer's bank or account details.
- Why: to invoice you, receive your payment, and keep accounting records.
- Lawful basis: contract. Keeping records: legal obligation under South African tax law, which for GDPR and UK GDPR purposes we treat as a legitimate interest.
- Who receives it: our bank in South Africa, which receives the payment, and Wise, which sends any refund from our Wise Business account. Wise also acts for you when you pay through it. Wise handles payment details under its own privacy policy.
- How long: 5 years, as South African tax law requires.
5.5 Guest RSVP and guest forms
- What: the guest information in section 3.
- Why: to run the couple's website and RSVP.
- Lawful basis: we act on the couple's instructions. The couple is responsible for having a lawful basis to collect it.
- Who receives it: the couple, Google (the RSVP spreadsheet, through Google Apps Script), and Vercel (hosts the couple's website).
- How long: deleted or handed over to the couple within 3 months after the wedding date.
5.6 Showing our work
- What: completed websites, invitations, previews, and screenshots. Sensitive details are never included.
- Why: for our portfolio, social media, and marketing.
- Lawful basis: legitimate interests, after the wedding has taken place. Before the wedding, only with the couple's consent (the early sharing opt-in in our Terms and Conditions).
- Who receives it: anyone who sees our website or social media.
- How long: for as long as we show the work, or until you ask us to take it down.
5.7 Running and protecting the website
- What: your IP address, browser and device details, the pages you request, and the time.
- Why: to send you the pages and keep the site safe and working.
- Lawful basis: legitimate interests.
- Who receives it: Vercel, our host.
- How long: 1 day, after which Vercel deletes these logs.
5.8 Counting visits with Vercel Analytics
- What: the page visited, the site you came from, your country, region and city, your device type, operating system, and browser. No cookies are used. Vercel tells visitors apart with a code made from the incoming request, which resets every day, so you cannot be followed from one day to the next or across websites.
- Why: to see which pages people read.
- Lawful basis: legitimate interests. Vercel keeps only anonymous, combined figures.
- Who receives it: Vercel.
- How long: the daily code is discarded after 24 hours. The combined figures: 12 months.
5.9 Google Analytics (only if you accept)
- What: the pages you view, how long you stay, how you found us, your general location at city level, your device and browser, and a few steps on our quote calculator: which package you picked, the quote total, and whether the quote was sent. Never your name or contact details. Google says Google Analytics 4 does not log or store IP addresses.
- Why: to see how the website performs and which channels bring couples to us.
- Lawful basis: consent. Google Analytics loads only after you say yes. Before you choose, it does not load at all.
- Who receives it: Google. wedlysite.com has its own Google Analytics property, separate from our South African website. We have not turned on Google's advertising features or Google signals.
- How long: information about individual visits is kept for 2 months, the shortest setting Google offers. The combined reports hold nothing about individual visitors. The cookies are listed in our Cookie Policy.
5.10 Microsoft Clarity session recording (only if you accept)
- What: pages viewed, clicks, scrolling, and mouse movement, which Clarity turns into heatmaps and session replays. Text typed into form fields is hidden: Microsoft masks form fields in every Clarity setting.
- Why: to see which parts of the site work and where visitors get stuck.
- Lawful basis: consent. Clarity loads only after you say yes, on our main pages and on our example websites. Before you choose, it does not load at all.
- Who receives it: Microsoft. wedlysite.com has its own Clarity project, separate from our South African website. Microsoft stores Clarity data in its Azure cloud service. Under Microsoft's Clarity terms, Microsoft and WedlySite are each independently responsible for this information (each is a "controller").
- How long: Microsoft keeps recordings for 30 days. Recordings we mark as favourites, and a random sample, are kept for up to 9 months.
5.11 Our example websites
- What: the example websites on our Our Work page serve their fonts from wedlysite.com itself, so no request goes to Google Fonts. Most of them have a venue map from Google Maps, which loads only when you tap "Show map". From that point, Google receives your IP address and browser details, and Google's own cookies may apply. Microsoft Clarity runs there only if you accepted it, as in 5.10.
- Why: to show the venue maps the designs use.
- Lawful basis: consent. The map loads only when you ask for it by tapping "Show map".
- Who receives it: Google, once you tap "Show map".
- How long: under Google's own policies.
5.12 Legal duties
We may use or share personal information where we must to comply with legal, accounting, or administrative obligations.
We do not sell, rent, or trade personal information to third parties for marketing purposes.
6. Who receives your information
We do not sell, rent, or share personal information with third parties for their own marketing. Personal information is processed through the platforms we use to run the business and deliver our services:
| Provider | What for | Where the data is held | Safeguard for the transfer |
|---|---|---|---|
| Enquiry and RSVP spreadsheets (through Google Apps Script), Gmail, Drive, Calendar, Google Analytics, and maps on our example websites once you tap "Show map" | Google's servers, including in the United States | Google LLC is certified under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss framework. Google Analytics runs under Google's data processing terms. Our Gmail, Drive, Sheets and Calendar are on a free Google account, which Google runs under its own terms. | |
| Microsoft | Clarity session recording, on our main pages and example websites | Microsoft's Azure cloud service | Microsoft Corporation is certified under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss framework. Under the Clarity terms, Microsoft and WedlySite are independent controllers. |
| Vercel | Hosting wedlysite.com and our clients' websites, running our forms, Vercel Analytics | Pages come from Vercel's worldwide network, from the location nearest you. Forms run in the United States. | Vercel Inc. is certified under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss framework. Its data processing addendum, with the EU Standard Contractual Clauses and the UK Addendum, applies to our account automatically. |
| Resend | Sending the emails from our forms | The United States | Resend is certified under the EU-U.S. Data Privacy Framework and its UK Extension. Its data processing addendum, with the EU Standard Contractual Clauses, applies to our account automatically. |
| Our bank | Receiving payments | South Africa | Bound by POPIA and South African banking law. |
| Wise | Sending your payment to us if you pay through Wise, and sending refunds from our Wise Business account | Wise's own systems | Wise handles payment details under its own terms and privacy policy. |
| Meta | WhatsApp, Instagram, Facebook, and Meta lead forms | Meta's data centres, including in the United States, Ireland, Denmark and Sweden | Meta Platforms and WhatsApp LLC are certified under the EU-U.S. Data Privacy Framework. Meta handles information under its own terms and privacy policy. |
| Notion | Client records and project notes | The United States | Notion Labs is certified under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss framework. Its data processing addendum, with the EU Standard Contractual Clauses and the UK Addendum, is part of our agreement with Notion. |
| Fathom | Call recordings | The United States | Fathom is certified under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss framework. Its data processing addendum applies to our account automatically. |
| Jotform | Onboarding questionnaires | The United States (South Carolina) | Jotform Inc. is certified under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss framework. Our signed data processing addendum with Jotform includes the EU Standard Contractual Clauses and the UK Addendum. |
| Canva | Designing invitations and stationery | Canva's servers in several countries, including the United States, Australia and the EU | Canva handles information under its own privacy policy. Canva US, Inc. is certified under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss framework. |
| GitHub | The code of our clients' websites | GitHub's servers in the United States and other countries | GitHub handles information under its own privacy statement. GitHub is certified under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss framework, and also uses the Standard Contractual Clauses. |
| domains.co.za | Registering domains we buy on a client's behalf | South Africa (DiaMatrix cc, trading as Domains.co.za) | Bound by POPIA. |
Some of these providers work only on our behalf, under data processing terms: Notion, Fathom, Resend, Google for Google Analytics, Vercel, and Jotform. The others handle information under their own terms and privacy policies, as independent controllers: Google for our Gmail, Drive, Sheets and Calendar, Microsoft for Clarity, Meta, Canva, GitHub, domains.co.za, our bank, and Wise.
7. International transfers
WedlySite is based in South Africa. When you send us your details, they come to us in South Africa. Some of the platforms we use, including Google and our hosting provider, store information on servers in other countries, mainly the United States.
The EU and the UK have not recognised South Africa as giving adequate protection. Where your information goes to a provider in another country, we rely on the safeguards in the table in section 6: the EU-U.S. Data Privacy Framework and its UK Extension where the provider is certified, or the Standard Contractual Clauses in the provider's data processing terms. For POPIA, these providers are bound by law or by agreements that give protection consistent with POPIA's rules for cross-border transfers.
8. Client responsibility for information supplied
The client is responsible for ensuring that all information supplied to WedlySite is accurate, complete, lawful, and approved for use, including names, dates, venue details, guest details, images, videos, photographer images, personal stories, family information, and banking or registry information. The client must have permission to use any content they supply. WedlySite is not responsible for copyright, privacy, or permission issues in client-supplied content.
9. Website content and public display
Wedding websites are created to be shared, and anything on a website is visible to anyone who holds the link. If the couple chooses to display banking or registry details, personal addresses, or other sensitive information on their website, they do so willingly and at their own risk. It is the client's responsibility to tell WedlySite in writing if any information should not be displayed or should be removed. Once content is approved, WedlySite is not responsible for information displayed because the client supplied and approved it.
10. Promotional use
As set out in our Terms and Conditions, WedlySite may use completed websites, invitations, previews, and screenshots for portfolio, social media, and marketing purposes after the wedding has taken place. Couples may also opt in at acceptance to allow sharing before the wedding. Sensitive details are never included in promotional material, and anything the couple does not want shown can be excluded by telling us in writing.
11. Domain access and login details
If a client purchases their own domain, WedlySite may need access to the domain account or DNS settings to connect the website. Any access details provided are used only to connect or manage the website domain, and the client remains responsible for the ownership, renewal, and security of their own domain.
12. Cookies and analytics
Our Cookie Policy lists every cookie and similar storage on wedlysite.com: who sets it, why, and for how long. In short:
- Our cookie banner shows to every visitor, wherever you are.
- Vercel Analytics counts visits without cookies and is always on.
- Google Analytics and Microsoft Clarity load only if you choose "Accept all", or switch them on in "Settings". Before you choose, they do not load at all, not even in a limited or cookieless mode. If you choose "Reject all", they never load.
- Our example websites follow the same choice. Their Google maps load only when you tap "Show map".
- We keep your choice in your browser for 12 months, then the banner asks again. You can change your choice at any time through "Cookie settings" in the footer of every page.
We do not use advertising cookies or cross-site advertising tracking on our website. Google and Microsoft explain how they handle this information in the Google Privacy Policy at policies.google.com/privacy and the Microsoft Privacy Statement at privacy.microsoft.com.
13. How long we keep personal information
We keep personal information only as long as reasonably necessary:
- Enquiries and quotes that do not lead to a project: up to 12 months from the last interaction.
- Invoices and payment records: 5 years, as South African tax law requires.
- Everything else about a client, including project records, call recordings, questionnaire answers, and guest name lists for personalised invitations: until 2 years after the wedding date, or 2 years after the last year of hosting ends if the couple renews it, whichever is later, then deleted. Work we keep showing in our portfolio stays as long as we show it, as in 5.6.
- Guest RSVP information: deleted or handed over to the couple within 3 months after the wedding date.
- Copies of emails sent by Resend: 30 days.
- Google Analytics: 2 months for information about individual visits.
- Clarity recordings: 30 days, or up to 9 months for favourites and a random sample.
Clients may request deletion of their personal information at any time, subject to records we are legally required to keep.
14. How we protect personal information
WedlySite takes reasonable steps to protect personal information from unauthorised access, loss, misuse, or disclosure. Access is limited to the WedlySite team members who need it to provide the service. No digital system can be guaranteed completely secure, but we keep client information organised, access-controlled, and only where the project requires it.
15. Your rights
Wherever you live, you can ask us to:
- tell you what personal information we hold about you, and give you a copy
- correct information that is wrong or incomplete
- delete your information, unless the law requires us to keep it
- limit how we use it while a concern is being checked
- give you the information you gave us in a common digital format, or send it to someone else
- stop using it where we rely on legitimate interests, including showing your website in our portfolio
- stop sending you marketing messages, at any time
- withdraw your consent at any time, for example through "Cookie settings" in our footer. This does not affect anything done before you withdrew it.
The GDPR and UK GDPR give you all of these rights. POPIA gives you the right to access, correct, and delete your information, to object to processing, to withdraw consent, and not to receive direct marketing by electronic message without your consent.
To use any of these rights, email wedlysite@gmail.com or WhatsApp +27 68 616 5498. It is free. We reply within one month, and we may ask you to confirm who you are first.
16. Complaints
If you are unhappy with how we handle your information, please tell us, so we can put it right. You do not have to come to us first. You have the right to complain to the data protection regulator where you live, where you work, or where you think the problem happened:
- In the EU: your national data protection authority. The European Data Protection Board lists them all at edpb.europa.eu.
- In the UK: the Information Commissioner's Office, at ico.org.uk.
- In South Africa: the Information Regulator, at inforegulator.org.za.
- Anywhere else: the data protection regulator in your country.
17. Automated decisions
We do not make decisions about you based only on automated processing.
18. Updates to this policy
WedlySite may update this Privacy Policy from time to time. The date at the top reflects the most recent revision, and the updated version applies from the date it is published on our website.
19. Contact
Email: wedlysite@gmail.com WhatsApp: +27 68 616 5498 Website: wedlysite.com