Privacy Policy

This Privacy Policy applies to thetableplan.com, its subdomains and any other website through which The Table Plan is made available, together referred to as the “Sites”.

It also applies to The Table Plan web application, tools and related services, together referred to as the “Services”.

The Sites and Services are owned and operated by DD LABS LTD (16565063), trading as The Table Plan (“The Table Plan”, “we”, “us” or “our”).

Our business address is:

**DD LABS LTD (16565063)
**Flat 1B
21 Cardigan Road
Richmond
TW10 6BJ
United Kingdom

This Privacy Policy explains how we collect, use, store, share and protect personal information when you access or use our Sites and Services.

It also explains your rights and choices regarding the personal information we hold about you.

1. Who We Are

DD LABS LTD is the data controller for the personal information of people who use The Table Plan.

When a couple plans their own wedding with us, we are the data controller for the information they enter about their guests: the couple is organising a personal event, and we decide how that information is stored, protected, shared and deleted. Our notice for wedding guests explains what we hold and guests’ rights.

When a wedding planner uses The Table Plan for a client, the planner is the data controller for the guest information and we process it on their behalf, following their instructions.

2. Definitions

2.1 Personal Information

Personal Information means any information relating to an identified or identifiable individual.

This may include:

• A person’s name.
• Email address.
• Postal address.
• Telephone number.
• Account details.
• Payment-related information.
• Device information.
• IP address.
• Online identifiers.
• Information about how a person uses a website or online service.
• Guest-list or event information that can be linked to a specific individual.

2.2 Marketing Site

The Marketing Site means the publicly accessible informational parts of our Sites.

This may include:

• Our homepage.
• Product and feature pages.
• Pricing information.
• Help and support resources.
• Blog content.
• Contact pages.
• Legal policies.

These pages generally provide information about The Table Plan and do not require a user to log in.

2.3 Web Application

The Web Application means the functional parts of The Table Plan that allow users to create, manage, edit and share wedding or event seating plans.

This may include:

• User dashboards.
• Account and profile settings.
• Wedding and event management tools.
• Guest lists.
• Table layouts.
• Seating assignments.
• Venue or room layouts.
• Notes relating to guests or attendees.
• Collaboration features.
• Export and sharing tools.
• Subscription and billing settings.

3. Personal Information We Collect

We collect information that you provide directly to us, information entered into the Services and information collected automatically when you access our Sites or Services.

We only collect and process personal information where we have a lawful basis and where the information is reasonably necessary for the relevant purpose.

We do not sell your personal information or personal information entered into the Services.

3.1 Account Information

When you create an account, we may collect:

• Your name.
• Your email address.
• Your username.
• Your password or authentication credentials.
• Your business or organisation name, where applicable.
• Your account preferences.
• Details of your subscription or selected plan.

Passwords may be managed by an authentication provider and should be stored in an encrypted or hashed form. We do not need to access your plain-text password.

3.2 Wedding, Event and Guest Information

When you use the Services, you may provide information relating to a wedding, event or seating plan.

This may include:

• Names of wedding guests or event attendees.
• Table assignments.
• Seating preferences.
• Relationships between guests.
• Party or household groupings.
• Meal choices.
• Dietary requirements.
• Accessibility requirements.
• Notes about attendees.
• Venue and table layout information.
• Wedding or event dates.
• Collaborator details.
• Information contained in imported files.
• Information contained in exported plans or documents.

You are responsible for ensuring that you have an appropriate lawful basis or permission to provide us with personal information relating to other individuals. Section 6.3 of our Terms of Service sets out what you agree to do when you add guests, and our notice for wedding guests is written for the people on your guest list.

You should avoid entering unnecessary or highly sensitive information into free-text notes.

Information concerning health, allergies, disabilities, religion or other sensitive matters may constitute special category personal data under UK data protection law. You should only enter this information where it is genuinely necessary and where you have an appropriate lawful basis for doing so.

3.3 Payment Information

When you make a payment or purchase a subscription, payment information is generally collected and processed by our payment provider.

We may receive limited transaction information, such as:

• Your name.
• Billing email address.
• Billing address.
• Payment status.
• Subscription status.
• Transaction amount.
• Transaction date.
• Payment method type.
• The final digits of your payment card.

We do not ordinarily receive or store your full card number or card security code.

3.4 Communications

When you contact us, we may collect:

• Your name.
• Email address.
• The content of your message.
• Support request information.
• Any attachments or screenshots you provide.
• Records of our communications with you.

3.5 Information Collected Automatically

When you visit our Sites or use the Services, our systems and service providers may automatically collect technical and usage information.

This may include:

• Your IP address.
• Browser type and version.
• Device type.
• Operating system.
• Referring website.
• Pages viewed.
• Features used.
• Dates and times of access.
• Time spent on pages.
• Clickstream information.
• Login activity.
• Error logs.
• Diagnostic information.
• Performance data.

Although some of this information may not identify you by itself, it may become personal information when combined with other data.

3.6 Analytics

We measure how our Sites and Services are used with our own cookieless analytics. It holds no personal data about you. Section 6.4 explains what it records, the lawful basis we rely on and how to object.

Please refer to our Cookie Policy for further information.

4. How We Use Personal Information

We may use personal information for the following purposes:

• To create and manage user accounts.
• To authenticate users.
• To provide the Sites and Services.
• To allow users to create and manage seating plans.
• To enable collaboration and sharing.
• To process subscriptions and payments.
• To provide customer support.
• To respond to enquiries.
• To send service-related communications.
• To maintain the security of the Services.
• To detect and prevent fraud, misuse and unauthorised access.
• To diagnose technical problems.
• To improve the functionality, reliability and usability of the Services.
• To analyse how the Sites and Services are used.
• To maintain records required for accounting, tax and legal purposes.
• To enforce our Terms of Service.
• To comply with legal and regulatory obligations.
• To establish, exercise or defend legal claims.
• To send marketing communications where permitted by law.

We will not use personal information for a purpose that is materially incompatible with the purpose for which it was originally collected unless permitted by law or unless we obtain appropriate consent.

5. Lawful Bases for Processing

Under UK data protection law, we must have a lawful basis for processing personal information.

Depending on the circumstances, we may rely on the following lawful bases:

5.1 Contract

We may process personal information where it is necessary to:

• Create or manage your account.
• Provide the Services you have requested.
• Process purchases or subscriptions.
• Respond to service-related requests.
• Perform our obligations under our Terms of Service.

5.2 Legitimate Interests

We may process personal information where it is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your rights and interests.

These interests may include:

• Operating and improving the Services.
• Securing our systems.
• Preventing fraud and abuse.
• Understanding how users interact with our Sites.
• Managing customer relationships.
• Communicating with users about the Services.
• Establishing or defending legal claims.

5.3 Consent

We may rely on your consent where required, including for:

• Certain marketing communications.
• Particular uses of sensitive personal information where consent is appropriate.

You may withdraw your consent at any time. Withdrawal does not affect processing carried out before consent was withdrawn.

5.4 Legal Obligation

We may process personal information where necessary to comply with legal obligations, including:

• Accounting and tax requirements.
• Responding to lawful requests from regulators or public authorities.
• Preventing or reporting unlawful activity.
• Meeting data protection obligations.

6. Third-Party Services and Sub-Processors

We use third-party service providers to operate, maintain and improve our Sites and Services.

These providers may process personal information on our behalf and are only permitted to use it for the purposes of providing their services to us, subject to their contractual and legal obligations.

A current list of our sub-processors is published in our Subprocessors notice. The principal providers are set out below.

6.1 Hosting and Infrastructure

Hetzner

We host our Sites, our web application and our databases on infrastructure provided by Hetzner Online GmbH, located in the European Union.

Hetzner may process technical information such as IP addresses, request logs and device information as part of providing hosting, storage and security services. Your account, wedding, event, guest and seating information is stored in databases operated by us on this infrastructure.

Cloudflare

We use Cloudflare, Inc. as a content delivery network and reverse proxy in front of our Sites and web application, providing performance, TLS encryption and protection against malicious traffic.

As traffic passes through Cloudflare's global edge network, Cloudflare may process technical information such as IP addresses and request metadata. Cloudflare operates from the United States, and any such transfer relies on the safeguards described in this policy.

6.2 Payments

Stripe

We use Stripe to:

• Process payments.
• Manage subscriptions.
• Prevent fraud.
• Issue refunds.
• Maintain payment and transaction records.

Stripe receives personal information - such as your billing details and payment method - when you make a purchase, and processes it according to its own privacy policy and legal obligations. We do not store full card numbers ourselves.

6.3 Email

Resend

We use Resend to send transactional emails such as account, security and service notifications.

Resend processes the recipient email address and the content of the message as necessary to deliver it.

6.4 Analytics

We use Umami, an analytics tool we run ourselves at analytics.thetableplan.com on our own servers at Hetzner, to understand how people use our Sites and Services - for example which pages are visited and which features are used - so we can improve them. It is not shared with any third-party advertising or analytics network.

We have set it up so that it holds no personal data about you:

• It sets no cookies and stores nothing on your device.
• It does not record your name, email address, account or any other identifier linked to you.
• It does not store your IP address. Your browser's IP address reaches our analytics server, as it does with any website you visit, and is used only to estimate an approximate location and to group the pages viewed in one visit. It is not kept.
• Links that work like a password, such as a shared plan, an invitation or a password reset, are removed from page addresses before they are sent.

It records the page visited, the referring website, your browser, operating system, device type, screen size, language and approximate location (country, region and city), and named events such as a completed signup or a downloaded plan. Some events, such as a completed sign-in or payment, are sent by our servers rather than your browser. Those carry no IP address or other detail about you.

We rely on our legitimate interest in measuring and improving our Sites and Services. Because the analytics uses no cookies and holds no personal data, we do not ask for consent and do not show a cookie banner.

You can object at any time. If your browser sends a Global Privacy Control or Do Not Track signal, our analytics sends nothing. You can also block analytics.thetableplan.com with a content blocker, or contact us at [email protected].

6.5 Other Service Providers

We may also use service providers for:

• Email delivery.
• Customer support.
• Error monitoring.
• Website security.
• Cloud storage.
• Database backups.
• Accounting.
• Legal and professional advice.
• Customer relationship management.
• Fraud detection.

We will update this Privacy Policy or provide additional information where necessary if our use of service providers materially changes.

7. When We Share Personal Information

We may share personal information in the following circumstances:

7.1 Service Providers

We may share information with suppliers and sub-processors that help us operate the Sites and Services.

7.2 Collaborators and Other Users

Where you choose to share a seating plan, guest list, event or project, information may be visible to:

• Invited collaborators.
• Wedding planners.
• Venue staff.
• Family members.
• Other individuals with whom you share a link.
• Anyone who receives an exported file.

You are responsible for controlling access to your projects and shareable links.

You should not make a project publicly accessible unless you are comfortable with the information being available to anyone with access to the relevant link.

7.3 Business Transfers

If DD LABS LTD is involved in a merger, acquisition, financing, restructuring, sale of assets or transfer of the Services, personal information may be disclosed to advisers, potential purchasers or successor organisations.

Where required, we will take reasonable steps to notify affected users and protect their rights.

7.4 Legal and Regulatory Requirements

We may disclose information where reasonably necessary to:

• Comply with applicable law.
• Respond to a court order or lawful request.
• Protect our legal rights.
• Investigate fraud, security incidents or unlawful activity.
• Protect users or members of the public.
• Establish, exercise or defend legal claims.

8. International Data Transfers

Some of our service providers may process or store personal information outside the United Kingdom.

Where personal information is transferred internationally, we will take appropriate steps to ensure that it is protected in accordance with applicable data protection law.

These safeguards may include:

• Transferring information to a country recognised as providing an adequate level of protection.
• Using the UK International Data Transfer Agreement.
• Using the UK Addendum to the European Commission’s Standard Contractual Clauses.
• Relying on another legally permitted transfer mechanism.

You may contact us for further information about the safeguards used for international transfers.

9. Data Security

The security of personal information is important to us.

We use appropriate technical and organisational measures designed to protect personal information against:

• Unauthorised access.
• Accidental loss.
• Misuse.
• Alteration.
• Disclosure.
• Destruction.

These measures may include:

• Encryption during transmission.
• Access controls.
• Authentication systems.
• Secure hosting infrastructure.
• Backups.
• Monitoring and logging.
• Restricted staff and contractor access.
• Confidentiality obligations.

Access to personal information is limited to employees, contractors, professional advisers and service providers who require access for legitimate business purposes.

However, no online service, transmission method or storage system can be guaranteed to be completely secure.

You are responsible for using a secure password, protecting your account credentials and controlling access to devices through which you use the Services.

If you believe your account or personal information has been compromised, please contact us promptly.

10. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy.

Retention periods may depend on:

• How long your account remains active.
• Whether the information is required to provide the Services.
• Legal, accounting and tax requirements.
• Fraud prevention and security needs.
• The need to resolve disputes.
• The need to enforce agreements.
• The need to establish or defend legal claims.

Guest details for a wedding (guest names, households, dietary notes and the seating plan) are kept until you delete them, the wedding or your account. Two things are deleted automatically: your guests' email addresses and any floor-plan photo you upload. Each is deleted 12 months after the later of the wedding date (or the day the wedding was created, if it has no date) and the last time anyone with access to the wedding signed in. If you delete a wedding, its guest details are deleted with it. If you delete your account, the weddings in any workspace where you are the only admin are deleted with the rest of your data after the 30-day window described below.

If you delete your account or data, the relevant information will normally be flagged for removal and deleted from active systems within 30 days.

Information may remain in backups for up to 90 days or for another limited period required by our backup and disaster-recovery processes.

Certain records may be retained for longer where required for:

• Tax.
• Accounting.
• Transaction records.
• Fraud prevention.
• Legal compliance.
• Dispute resolution.
• Enforcement of our agreements.

Where information has been shared with collaborators or exported from the Services, deleting your account may not delete copies already held by those third parties.

You may contact us to request deletion from our customer relationship management system or other third-party services, subject to any legal or legitimate retention requirements.

11. Your Data Protection Rights

Depending on the circumstances, you may have the following rights under UK data protection law.

11.1 Right of Access

You may request confirmation of whether we process your personal information and obtain a copy of the information we hold about you.

11.2 Right to Rectification

You may ask us to correct personal information that is inaccurate or incomplete.

11.3 Right to Erasure

You may ask us to delete your personal information in certain circumstances.

This right is not absolute, and we may retain information where legally permitted or required.

11.4 Right to Restrict Processing

You may ask us to restrict the processing of your personal information in certain circumstances.

11.5 Right to Data Portability

Where processing is based on consent or contract and is carried out by automated means, you may have the right to receive personal information in a structured, commonly used and machine-readable format.

You may also request that it be transferred to another controller where technically feasible.

11.6 Right to Object

You may object to processing based on our legitimate interests in certain circumstances.

You also have the right to object to the use of your personal information for direct marketing at any time.

11.7 Right to Withdraw Consent

Where we rely on consent, you may withdraw that consent at any time.

11.8 Rights Relating to Automated Decision-Making

You may have rights relating to decisions made solely through automated processing where those decisions produce legal or similarly significant effects.

We do not intend to make significant decisions about users solely through automated processing.

11.9 Right to Complain

If you are unhappy with how we have handled your personal information, you can complain to us by emailing [email protected]. We will acknowledge your complaint within 30 days, look into it and tell you the outcome.

You also have the right to complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk if you believe your personal information has been handled improperly. We would appreciate the chance to put things right first, but you do not have to complain to us before going to the ICO.

12. Exercising Your Rights

To exercise your data protection rights, please contact us using the details set out at the end of this Privacy Policy.

We may need to request information to confirm your identity before responding.

Requests are generally free of charge. However, we may charge a reasonable fee or refuse to act where a request is manifestly unfounded, excessive or repetitive, where permitted by law.

We aim to respond to valid requests within one month.

Where a request is complex or multiple requests have been made, we may extend this period as permitted by law. If we do so, we will explain the reason for the delay.

13. Marketing Communications

We may send you marketing communications where:

• You have consented to receive them.
• You have previously purchased or requested similar services and applicable law permits us to contact you.
• Another lawful basis applies.

You may unsubscribe at any time by:

• Using the unsubscribe link in a marketing email.
• Changing your communication preferences.
• Contacting us directly.

You may continue to receive essential service-related communications, such as account, security, payment or legal notices.

14. Cookies

We may use cookies and similar technologies to:

• Keep the Sites and Services functioning.
• Authenticate users.
• Maintain sessions.
• Remember preferences.
• Protect against fraud and abuse.

Essential cookies may be used without consent where they are strictly necessary to provide the Services.

Our analytics does not use cookies (see section 6.4). We do not use marketing or advertising cookies. We will ask for your consent before using any non-essential cookie.

Our Cookie Policy describes the cookies we set.

15. Children’s Privacy

The Sites and Services are not directed at children under the age of 13, and we do not knowingly collect personal information directly from children under 13.

The Services are intended to be used by adults organising weddings and events.

Users should not enter unnecessary personal information about children into the Services.

Where information about a child is required for a seating plan, the user entering that information is responsible for ensuring that they have the authority and lawful basis to do so.

If we become aware that we have collected personal information directly from a child in circumstances where we should not have done so, we will take reasonable steps to delete it.

16. External Links

Our Sites may contain links to websites, services or applications operated by third parties.

We do not control and are not responsible for the content, security or privacy practices of those third parties.

You should review the privacy policy of any third-party service before providing it with personal information.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• Changes to the Services.
• Changes to our business practices.
• Changes to the providers we use.
• Legal or regulatory developments.
• Improvements to the way we explain our privacy practices.

We will publish the updated Privacy Policy on our Sites.

Where changes are material, we may notify registered users by email, through the Services or by another appropriate method.

Where required by law, we will seek consent or provide an opportunity to opt in or opt out before applying a new use of personal information.

18. Contact Details

If you have questions, concerns or requests relating to this Privacy Policy or the way we handle personal information, please contact:

**DD LABS LTD (16565063)
**Trading as **The Table Plan
**Flat 1B
21 Cardigan Road
Richmond
TW10 6BJ
United Kingdom

Email: [email protected]

19. Effective Date

This Privacy Policy is effective from 5 November 2026