ENES

Data Processing Addendum

Last updated: November 5, 2026

1. About this addendum

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between you, the host who uses InviteTous (“you” or the “Customer”), and Spacode, an Israeli sole proprietorship, Authorized Dealer No. 205674500, Isser Harel 1, Or Akiva, Israel (“we” or “us”).

It applies automatically, without a signature, whenever you use InviteTous to upload or manage personal data about other people, such as your guests.

This DPA contains the processor terms required by Article 28 of the EU General Data Protection Regulation (GDPR) and the UK GDPR, the service provider terms required by the California Consumer Privacy Act (CCPA), processor terms under other US state privacy laws, and the obligations of an encargado under Mexico’s Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP).

If this DPA conflicts with the Terms of Service, this DPA prevails on data protection matters. If the Standard Contractual Clauses apply and conflict with this DPA, the Standard Contractual Clauses prevail.

2. Definitions

  • “Customer Personal Data” means personal data about your guests and co-hosts that you or your co-hosts upload to InviteTous or collect through it, including guests’ RSVP replies.
  • “Data Protection Laws” means all privacy and data protection laws that apply to the processing of Customer Personal Data, including the GDPR, the UK GDPR, the CCPA and other US state privacy laws, the LFPDPPP and the Israeli Privacy Protection Law, 5741-1981.
  • “Sub-processor” means a third party we engage to process Customer Personal Data.
  • “Security Incident” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
  • “Standard Contractual Clauses” or “SCCs” means the standard contractual clauses for the transfer of personal data to third countries approved by European Commission Implementing Decision (EU) 2021/914.
  • Other terms, such as “controller”, “processor”, “data subject”, “personal data” and “processing”, have the meanings given in the GDPR; “service provider”, “sell” and “share” have the meanings given in the CCPA; and “responsable” and “encargado” have the meanings given in the LFPDPPP.

3. Roles of the parties

For Customer Personal Data, you are the controller and we are your processor. You are also responsible for the co-hosts you share an event with.

If you act on behalf of someone else, for example as an event planner organizing a client’s event, you confirm that your client has authorized you to use InviteTous, and we act as your sub-processor.

If you use InviteTous only for a personal or household activity, such as planning your own family celebration, some Data Protection Laws may not apply to you as a controller. We still process Customer Personal Data in line with this DPA.

We are the controller of the personal data in your own account, such as your account details and payment records. Our Privacy Policy covers that processing.

4. Details of the processing

  • Subject matter: providing InviteTous to you.
  • Duration: for as long as your account exists, plus the deletion period in section 12.
  • Nature and purpose: storing and organizing guest lists; sending invitations, reminders and other messages by WhatsApp (through the Meta WhatsApp Business Cloud API), by link or by email; collecting RSVPs; building seating plans; and processing with AI features; in each case on your instructions.
  • Data subjects: your guests and co-hosts.
  • Categories of personal data: names, phone numbers, email addresses, group tags, RSVP status, headcount, dietary notes, seat or table assignments, and message content, delivery status and replies.
  • Special categories of data: dietary notes may reveal information about health or religion. Keep them to the minimum needed for the event (see section 15).
  • Frequency: continuous, for as long as you use InviteTous.

5. Processing on your instructions

We process Customer Personal Data only on your documented instructions, unless the law requires us to do otherwise. In that case, we will tell you about that legal requirement before processing, unless the law prohibits us from doing so.

Your documented instructions are the Terms of Service, this DPA, and the actions you take and settings you choose in InviteTous, such as adding guests, sending invitations or using an AI feature. Any additional instructions must be consistent with these and agreed with us in writing.

We will tell you promptly if, in our opinion, an instruction infringes Data Protection Laws.

We do not use Customer Personal Data for our own purposes, and we do not use it to train our own AI models.

6. Confidentiality

We ensure that everyone we authorize to process Customer Personal Data has committed to confidentiality or is under an appropriate legal obligation of confidentiality, and accesses the data only as needed to provide InviteTous.

7. Security measures

Taking into account the nature of the processing and the risks to data subjects, we maintain technical and organizational measures to protect Customer Personal Data, including:

  • encryption of data in transit using TLS;
  • access controls, with staff access limited to what each person needs (least privilege);
  • one-time codes and tokens that are hashed and short-lived; and
  • bot protection on sign-in.

We may update these measures over time, provided the overall level of security does not decrease.

8. Sub-processors

You give us general authorization to engage sub-processors. Our current sub-processors are:

  • Hyp: payment processing. Location: Israel.
  • Google Cloud: hosting and infrastructure. Location: Israel.
  • Google LLC: Gemini AI models, Google Places for vendor search, Google Sign-In, Gmail for sending emails, and Google Fonts on our marketing site. Location: United States.
  • Anthropic: AI models. Location: United States.
  • OpenAI: AI models. Location: United States.
  • Meta Platforms: WhatsApp Business messaging (Cloud API). Location: United States.
  • Cloudflare: Turnstile bot protection. Location: United States.
  • MongoDB, Inc.: database hosting (MongoDB Atlas on Google Cloud). Location: Israel.

Sub-processors may also process data in other countries where they operate. Our cache (Redis) runs on our own cloud infrastructure.

We bind each sub-processor by a written contract to data protection obligations that are, in substance, the same as those in this DPA, and we remain fully responsible to you for their performance.

Changes. We will announce any new or replacement sub-processor by updating the list on this page and emailing the address on your account at least 30 days before it starts processing Customer Personal Data. You may object on reasonable data protection grounds by emailing ben@spacode.co.il within those 30 days. If you object, we will work with you in good faith to resolve your concern. If we cannot, you may stop using the affected feature or delete your account.

9. Data subject requests

Taking into account the nature of the processing, we help you, through appropriate technical and organizational measures, to respond to requests from data subjects to exercise their rights. You can handle most requests yourself in InviteTous, for example by editing or deleting a guest.

If a guest or another data subject contacts us directly about Customer Personal Data, we will forward the request to you without undue delay and help you respond. We will not respond to the request ourselves, except to confirm that we have forwarded it, unless you instruct us to or the law requires it.

10. Impact assessments and consultations

Taking into account the nature of the processing and the information available to us, we give you reasonable help to meet your obligations regarding security, data protection impact assessments and prior consultations with supervisory authorities.

11. Security incidents

We will notify you without undue delay, and in any case within 72 hours, after becoming aware of a Security Incident. We will send the notice to the email address on your account.

Our notice will describe, as far as the information is available: the nature of the incident, including the categories and approximate number of data subjects and records concerned; its likely consequences; the measures we have taken or propose to take to address it and reduce its effects; and a contact point for more information. If we cannot provide all of this information at once, we will provide it in stages as it becomes available.

We will take reasonable steps to contain and investigate the incident, and we will help you meet your own obligations to notify supervisory authorities and data subjects.

12. Deletion and return of data

Customer Personal Data is deleted together with the event or account it belongs to, or earlier at your request.

When you delete your account, we delete Customer Personal Data from our active systems within 30 days, and copies in our backups are overwritten within a further 30 days.

Before you delete your account, you can ask us at ben@spacode.co.il to return a copy of Customer Personal Data in a commonly used electronic format.

We keep Customer Personal Data longer only where the law requires it, and this DPA continues to protect it for as long as we keep it.

13. Audits and information

On request, we will make available to you all information necessary to demonstrate our compliance with this DPA and with Article 28 of the GDPR, such as answers to reasonable security questionnaires and descriptions of our security measures and sub-processors.

If that information is not enough to demonstrate our compliance, or a supervisory authority requires it, we will allow for and contribute to an audit, including an inspection, by you or by an independent auditor you appoint, on reasonable prior notice and subject to appropriate confidentiality obligations.

14. International transfers

We are based in Israel, which the European Commission and the United Kingdom recognize as providing an adequate level of data protection. Some sub-processors process Customer Personal Data in the United States and other countries.

Where Data Protection Laws require a transfer mechanism for a transfer between you and us, the SCCs are incorporated into this DPA by reference: Module 2 (controller to processor) applies when you are a controller, and Module 3 (processor to processor) applies when you act as a processor for another controller. For the SCCs:

  • Clause 7 (docking clause) does not apply;
  • under Clause 9, Option 2 (general written authorization) applies, with the 30-day notice period in section 8;
  • the optional wording in Clause 11 does not apply;
  • the competent supervisory authority is determined in accordance with Clause 13;
  • under Clause 17, Option 1 applies and the SCCs are governed by the law of Spain;
  • under Clause 18, disputes are resolved by the courts of Spain; and
  • Annex I is completed by sections 1 and 4 of this DPA, Annex II by section 7, and Annex III by section 8.

For Customer Personal Data subject to the UK GDPR, the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner is also incorporated by reference, with the SCCs completed as set out above.

We transfer Customer Personal Data to sub-processors outside the European Economic Area and the United Kingdom only under a valid transfer mechanism, such as an adequacy decision, the SCCs or, where the sub-processor is certified, the EU-U.S. Data Privacy Framework.

15. Your obligations as controller

As controller, you are responsible for:

  • having a lawful basis to upload Customer Personal Data to InviteTous and to contact your guests;
  • telling your guests and co-hosts how their data will be used, including that you use InviteTous to manage your event;
  • obtaining your guests’ consent to be contacted by WhatsApp where the law or WhatsApp’s policies require it;
  • making sure that Customer Personal Data is accurate and up to date;
  • not uploading special categories of data, such as information about health or religion, unless they are needed for the event, and keeping dietary notes to the minimum needed;
  • adding guests who are minors only where you are entitled to do so, and with only the information needed for the event; and
  • making sure your instructions to us comply with Data Protection Laws.

16. US state privacy laws

Where the CCPA applies, we act as your service provider for Customer Personal Data and process it only for the business purpose of providing InviteTous to you. We will not:

  • sell or share Customer Personal Data;
  • retain, use or disclose it for any purpose other than providing InviteTous to you, including any other commercial purpose, or outside our direct business relationship with you; or
  • combine it with personal information we receive from or on behalf of others, or collect from our own interactions with consumers, except as the CCPA permits.

We will comply with the obligations that apply to us under the CCPA, provide the same level of privacy protection the CCPA requires, and notify you if we determine that we can no longer meet these obligations. You may take reasonable and appropriate steps to ensure that we use Customer Personal Data consistently with your CCPA obligations, and to stop and remediate any unauthorized use. We certify that we understand and will comply with these restrictions.

The same commitments apply, as processor terms, under other US state privacy laws, such as those of Virginia, Colorado, Connecticut, Utah, Texas and Oregon.

17. Mexico

Where the LFPDPPP applies, you are the responsable and we are your encargado. We will:

  • process Customer Personal Data only on your instructions and not for our own purposes;
  • keep it confidential and protect it with the security measures in section 7;
  • not transfer it, except to sub-processors under section 8 or where the law requires it; and
  • delete it when our relationship ends, in line with section 12, unless the law requires us to keep it.

18. Liability

Each party’s liability arising out of or in connection with this DPA is subject to the limitations and exclusions of liability in the Terms of Service. This does not limit any rights that data subjects have under Data Protection Laws or the SCCs.

19. Duration and changes

This DPA applies for as long as we process Customer Personal Data for you, and it continues to apply until that data has been deleted or returned.

We may update this DPA to reflect changes in the law or in InviteTous. We will publish the updated version on this page and update the “last updated” date; if a change is material, we will also notify you by email or in the app. Changes to sub-processors follow the procedure in section 8.

20. Contact

Send questions about this DPA, objections to sub-processors and requests for information to ben@spacode.co.il.