Privacy Policy

This Privacy Policy applies to thetableplan.com, its subdomains and any other website through which The Table Plan is made available, together referred to as the “Sites”.

It also applies to The Table Plan web application, tools and related services, together referred to as the “Services”.

The Sites and Services are owned and operated by DD LABS LTD (16565063), trading as The Table Plan (“The Table Plan”, “we”, “us” or “our”).

Our business address is:

**DD LABS LTD (16565063)
**Flat 1B
21 Cardigan Road
Richmond
TW10 6BJ
United Kingdom

This Privacy Policy explains how we collect, use, store, share and protect personal information when you access or use our Sites and Services.

It also explains your rights and choices regarding the personal information we hold about you.

1. Who We Are

For the purposes of UK data protection law, DD LABS LTD is generally the data controller responsible for personal information collected directly from users of The Table Plan.

When users upload information about wedding guests, event attendees, collaborators or other third parties, our role may depend on the circumstances.

In some cases, the user who uploads that information may be the relevant data controller and we may process the information on their behalf in order to provide the Services.

2. Definitions

2.1 Personal Information

Personal Information means any information relating to an identified or identifiable individual.

This may include:

• A person’s name.
• Email address.
• Postal address.
• Telephone number.
• Account details.
• Payment-related information.
• Device information.
• IP address.
• Online identifiers.
• Information about how a person uses a website or online service.
• Guest-list or event information that can be linked to a specific individual.

2.2 Marketing Site

The Marketing Site means the publicly accessible informational parts of our Sites.

This may include:

• Our homepage.
• Product and feature pages.
• Pricing information.
• Help and support resources.
• Blog content.
• Contact pages.
• Legal policies.

These pages generally provide information about The Table Plan and do not require a user to log in.

2.3 Web Application

The Web Application means the functional parts of The Table Plan that allow users to create, manage, edit and share wedding or event seating plans.

This may include:

• User dashboards.
• Account and profile settings.
• Wedding and event management tools.
• Guest lists.
• Table layouts.
• Seating assignments.
• Venue or room layouts.
• Notes relating to guests or attendees.
• Collaboration features.
• Export and sharing tools.
• Subscription and billing settings.

3. Personal Information We Collect

We collect information that you provide directly to us, information entered into the Services and information collected automatically when you access our Sites or Services.

We only collect and process personal information where we have a lawful basis and where the information is reasonably necessary for the relevant purpose.

We do not sell your personal information or personal information entered into the Services.

3.1 Account Information

When you create an account, we may collect:

• Your name.
• Your email address.
• Your username.
• Your password or authentication credentials.
• Your business or organisation name, where applicable.
• Your account preferences.
• Details of your subscription or selected plan.

Passwords may be managed by an authentication provider and should be stored in an encrypted or hashed form. We do not need to access your plain-text password.

3.2 Wedding, Event and Guest Information

When you use the Services, you may provide information relating to a wedding, event or seating plan.

This may include:

• Names of wedding guests or event attendees.
• Table assignments.
• Seating preferences.
• Relationships between guests.
• Party or household groupings.
• Meal choices.
• Dietary requirements.
• Accessibility requirements.
• Notes about attendees.
• Venue and table layout information.
• Wedding or event dates.
• Collaborator details.
• Information contained in imported files.
• Information contained in exported plans or documents.

You are responsible for ensuring that you have an appropriate lawful basis or permission to provide us with personal information relating to other individuals.

You should avoid entering unnecessary or highly sensitive information into free-text notes.

Information concerning health, allergies, disabilities, religion or other sensitive matters may constitute special category personal data under UK data protection law. You should only enter this information where it is genuinely necessary and where you have an appropriate lawful basis for doing so.

3.3 Payment Information

When you make a payment or purchase a subscription, payment information is generally collected and processed by our payment provider.

We may receive limited transaction information, such as:

• Your name.
• Billing email address.
• Billing address.
• Payment status.
• Subscription status.
• Transaction amount.
• Transaction date.
• Payment method type.
• The final digits of your payment card.

We do not ordinarily receive or store your full card number or card security code.

3.4 Communications

When you contact us, we may collect:

• Your name.
• Email address.
• The content of your message.
• Support request information.
• Any attachments or screenshots you provide.
• Records of our communications with you.

3.5 Information Collected Automatically

When you visit our Sites or use the Services, our systems and service providers may automatically collect technical and usage information.

This may include:

• Your IP address.
• Browser type and version.
• Device type.
• Operating system.
• Referring website.
• Pages viewed.
• Features used.
• Dates and times of access.
• Time spent on pages.
• Clickstream information.
• Login activity.
• Error logs.
• Diagnostic information.
• Performance data.

Although some of this information may not identify you by itself, it may become personal information when combined with other data.

3.6 Information Collected With Consent

Where required, we may use cookies and similar technologies with your consent to collect information about how visitors use our Sites.

This may include:

• Approximate location information.
• Anonymised or truncated IP addresses.
• Browser and device information.
• Referring and exit pages.
• Website interactions.
• Page views.
• Clickstream information.
• Date and time information.
• Analytics identifiers.

You can manage your cookie preferences through our cookie notice or through your browser settings.

Disabling certain cookies may affect the availability or functionality of some features.

Please refer to our Cookie Policy for further information.

4. How We Use Personal Information

We may use personal information for the following purposes:

• To create and manage user accounts.
• To authenticate users.
• To provide the Sites and Services.
• To allow users to create and manage seating plans.
• To enable collaboration and sharing.
• To process subscriptions and payments.
• To provide customer support.
• To respond to enquiries.
• To send service-related communications.
• To maintain the security of the Services.
• To detect and prevent fraud, misuse and unauthorised access.
• To diagnose technical problems.
• To improve the functionality, reliability and usability of the Services.
• To analyse how the Sites and Services are used.
• To maintain records required for accounting, tax and legal purposes.
• To enforce our Terms of Service.
• To comply with legal and regulatory obligations.
• To establish, exercise or defend legal claims.
• To send marketing communications where permitted by law.

We will not use personal information for a purpose that is materially incompatible with the purpose for which it was originally collected unless permitted by law or unless we obtain appropriate consent.

5. Lawful Bases for Processing

Under UK data protection law, we must have a lawful basis for processing personal information.

Depending on the circumstances, we may rely on the following lawful bases:

5.1 Contract

We may process personal information where it is necessary to:

• Create or manage your account.
• Provide the Services you have requested.
• Process purchases or subscriptions.
• Respond to service-related requests.
• Perform our obligations under our Terms of Service.

5.2 Legitimate Interests

We may process personal information where it is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your rights and interests.

These interests may include:

• Operating and improving the Services.
• Securing our systems.
• Preventing fraud and abuse.
• Understanding how users interact with our Sites.
• Managing customer relationships.
• Communicating with users about the Services.
• Establishing or defending legal claims.

5.3 Consent

We may rely on your consent where required, including for:

• Non-essential analytics cookies.
• Certain marketing communications.
• Optional tracking technologies.
• Particular uses of sensitive personal information where consent is appropriate.

You may withdraw your consent at any time. Withdrawal does not affect processing carried out before consent was withdrawn.

5.4 Legal Obligation

We may process personal information where necessary to comply with legal obligations, including:

• Accounting and tax requirements.
• Responding to lawful requests from regulators or public authorities.
• Preventing or reporting unlawful activity.
• Meeting data protection obligations.

6. Third-Party Services and Sub-Processors

We use third-party service providers to operate, maintain and improve our Sites and Services.

These providers may process personal information on our behalf and are only permitted to use it for the purposes of providing their services to us, subject to their contractual and legal obligations.

A current list of our sub-processors is published in our Subprocessors notice. The principal providers are set out below.

6.1 Hosting and Infrastructure

Hetzner

We host our Sites, our web application and our databases on infrastructure provided by Hetzner Online GmbH, located in the European Union.

Hetzner may process technical information such as IP addresses, request logs and device information as part of providing hosting, storage and security services. Your account, wedding, event, guest and seating information is stored in databases operated by us on this infrastructure.

Cloudflare

We use Cloudflare, Inc. as a content delivery network and reverse proxy in front of our Sites and web application, providing performance, TLS encryption and protection against malicious traffic.

As traffic passes through Cloudflare's global edge network, Cloudflare may process technical information such as IP addresses and request metadata. Cloudflare operates from the United States, and any such transfer relies on the safeguards described in this policy.

6.2 Payments

Stripe

We use Stripe to:

• Process payments.
• Manage subscriptions.
• Prevent fraud.
• Issue refunds.
• Maintain payment and transaction records.

Stripe receives personal information - such as your billing details and payment method - when you make a purchase, and processes it according to its own privacy policy and legal obligations. We do not store full card numbers ourselves.

6.3 Email

Resend

We use Resend to send transactional emails such as account, security and service notifications.

Resend processes the recipient email address and the content of the message as necessary to deliver it.

6.4 Analytics

Where you have provided consent, we use our own first-party analytics to understand how people use our Sites and Services - for example which pages and features are used - so we can improve them.

This analytics is operated by us on our own infrastructure and is not shared with a third-party advertising or analytics network. It uses a pseudonymous identifier and does not require your real identity. You can withdraw consent at any time through our cookie preferences tool.

6.5 Other Service Providers

We may also use service providers for:

• Email delivery.
• Customer support.
• Error monitoring.
• Website security.
• Cloud storage.
• Database backups.
• Accounting.
• Legal and professional advice.
• Customer relationship management.
• Fraud detection.

We will update this Privacy Policy or provide additional information where necessary if our use of service providers materially changes.

7. When We Share Personal Information

We may share personal information in the following circumstances:

7.1 Service Providers

We may share information with suppliers and sub-processors that help us operate the Sites and Services.

7.2 Collaborators and Other Users

Where you choose to share a seating plan, guest list, event or project, information may be visible to:

• Invited collaborators.
• Wedding planners.
• Venue staff.
• Family members.
• Other individuals with whom you share a link.
• Anyone who receives an exported file.

You are responsible for controlling access to your projects and shareable links.

You should not make a project publicly accessible unless you are comfortable with the information being available to anyone with access to the relevant link.

7.3 Business Transfers

If DD LABS LTD is involved in a merger, acquisition, financing, restructuring, sale of assets or transfer of the Services, personal information may be disclosed to advisers, potential purchasers or successor organisations.

Where required, we will take reasonable steps to notify affected users and protect their rights.

7.4 Legal and Regulatory Requirements

We may disclose information where reasonably necessary to:

• Comply with applicable law.
• Respond to a court order or lawful request.
• Protect our legal rights.
• Investigate fraud, security incidents or unlawful activity.
• Protect users or members of the public.
• Establish, exercise or defend legal claims.

8. International Data Transfers

Some of our service providers may process or store personal information outside the United Kingdom.

Where personal information is transferred internationally, we will take appropriate steps to ensure that it is protected in accordance with applicable data protection law.

These safeguards may include:

• Transferring information to a country recognised as providing an adequate level of protection.
• Using the UK International Data Transfer Agreement.
• Using the UK Addendum to the European Commission’s Standard Contractual Clauses.
• Relying on another legally permitted transfer mechanism.

You may contact us for further information about the safeguards used for international transfers.

9. Data Security

The security of personal information is important to us.

We use appropriate technical and organisational measures designed to protect personal information against:

• Unauthorised access.
• Accidental loss.
• Misuse.
• Alteration.
• Disclosure.
• Destruction.

These measures may include:

• Encryption during transmission.
• Access controls.
• Authentication systems.
• Secure hosting infrastructure.
• Backups.
• Monitoring and logging.
• Restricted staff and contractor access.
• Confidentiality obligations.

Access to personal information is limited to employees, contractors, professional advisers and service providers who require access for legitimate business purposes.

However, no online service, transmission method or storage system can be guaranteed to be completely secure.

You are responsible for using a secure password, protecting your account credentials and controlling access to devices through which you use the Services.

If you believe your account or personal information has been compromised, please contact us promptly.

10. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy.

Retention periods may depend on:

• How long your account remains active.
• Whether the information is required to provide the Services.
• Legal, accounting and tax requirements.
• Fraud prevention and security needs.
• The need to resolve disputes.
• The need to enforce agreements.
• The need to establish or defend legal claims.

If you delete your account or data, the relevant information will normally be flagged for removal and deleted from active systems within 30 days.

Information may remain in backups for up to 90 days or for another limited period required by our backup and disaster-recovery processes.

Certain records may be retained for longer where required for:

• Tax.
• Accounting.
• Transaction records.
• Fraud prevention.
• Legal compliance.
• Dispute resolution.
• Enforcement of our agreements.

Where information has been shared with collaborators or exported from the Services, deleting your account may not delete copies already held by those third parties.

You may contact us to request deletion from our customer relationship management system or other third-party services, subject to any legal or legitimate retention requirements.

11. Your Data Protection Rights

Depending on the circumstances, you may have the following rights under UK data protection law.

11.1 Right of Access

You may request confirmation of whether we process your personal information and obtain a copy of the information we hold about you.

11.2 Right to Rectification

You may ask us to correct personal information that is inaccurate or incomplete.

11.3 Right to Erasure

You may ask us to delete your personal information in certain circumstances.

This right is not absolute, and we may retain information where legally permitted or required.

11.4 Right to Restrict Processing

You may ask us to restrict the processing of your personal information in certain circumstances.

11.5 Right to Data Portability

Where processing is based on consent or contract and is carried out by automated means, you may have the right to receive personal information in a structured, commonly used and machine-readable format.

You may also request that it be transferred to another controller where technically feasible.

11.6 Right to Object

You may object to processing based on our legitimate interests in certain circumstances.

You also have the right to object to the use of your personal information for direct marketing at any time.

11.7 Right to Withdraw Consent

Where we rely on consent, you may withdraw that consent at any time.

11.8 Rights Relating to Automated Decision-Making

You may have rights relating to decisions made solely through automated processing where those decisions produce legal or similarly significant effects.

We do not intend to make significant decisions about users solely through automated processing.

11.9 Right to Complain

You have the right to complain to the UK Information Commissioner’s Office if you believe your personal information has been handled improperly.

We would appreciate the opportunity to address your concerns directly before you submit a complaint.

12. Exercising Your Rights

To exercise your data protection rights, please contact us using the details set out at the end of this Privacy Policy.

We may need to request information to confirm your identity before responding.

Requests are generally free of charge. However, we may charge a reasonable fee or refuse to act where a request is manifestly unfounded, excessive or repetitive, where permitted by law.

We aim to respond to valid requests within one month.

Where a request is complex or multiple requests have been made, we may extend this period as permitted by law. If we do so, we will explain the reason for the delay.

13. Marketing Communications

We may send you marketing communications where:

• You have consented to receive them.
• You have previously purchased or requested similar services and applicable law permits us to contact you.
• Another lawful basis applies.

You may unsubscribe at any time by:

• Using the unsubscribe link in a marketing email.
• Changing your communication preferences.
• Contacting us directly.

You may continue to receive essential service-related communications, such as account, security, payment or legal notices.

14. Cookies

We may use cookies and similar technologies to:

• Keep the Sites and Services functioning.
• Authenticate users.
• Maintain sessions.
• Remember preferences.
• Protect against fraud and abuse.
• Measure website performance.
• Analyse website usage.
• Support optional marketing activities.

Essential cookies may be used without consent where they are strictly necessary to provide the Services.

We will request consent before using non-essential cookies where required by law.

Further information should be provided in our Cookie Policy and cookie preferences tool.

15. Children’s Privacy

The Sites and Services are not directed at children under the age of 13, and we do not knowingly collect personal information directly from children under 13.

The Services are intended to be used by adults organising weddings and events.

Users should not enter unnecessary personal information about children into the Services.

Where information about a child is required for a seating plan, the user entering that information is responsible for ensuring that they have the authority and lawful basis to do so.

If we become aware that we have collected personal information directly from a child in circumstances where we should not have done so, we will take reasonable steps to delete it.

16. External Links

Our Sites may contain links to websites, services or applications operated by third parties.

We do not control and are not responsible for the content, security or privacy practices of those third parties.

You should review the privacy policy of any third-party service before providing it with personal information.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• Changes to the Services.
• Changes to our business practices.
• Changes to the providers we use.
• Legal or regulatory developments.
• Improvements to the way we explain our privacy practices.

We will publish the updated Privacy Policy on our Sites.

Where changes are material, we may notify registered users by email, through the Services or by another appropriate method.

Where required by law, we will seek consent or provide an opportunity to opt in or opt out before applying a new use of personal information.

18. Contact Details

If you have questions, concerns or requests relating to this Privacy Policy or the way we handle personal information, please contact:

**DD LABS LTD (16565063)
**Trading as **The Table Plan
**Flat 1B
21 Cardigan Road
Richmond
TW10 6BJ
United Kingdom

Email: [email protected]

19. Effective Date

This Privacy Policy is effective from 23/07/2026