Clear roles when you plan for someone else.

Scope and roles

The planner or client determines the celebration, guest list and questions and is normally the controller for that guest-data use. Monkey Magic Cloud Ltd processes that guest data to provide MKMela’s invitation, RSVP, storage, export, support and deletion functions, while remaining a controller for account, security and legal administration.

Your instructions

Your use of MKMela and actions within the product are documented instructions to process guest data only for the relevant celebration. Do not upload information outside the service’s intended fields or ask MKMela to process special-category data.

MKMela commitments

• Process guest data only for the service and lawful documented instructions.
• Limit staff and provider access to what is needed and require confidentiality.
• Use appropriate technical and organisational security measures.
• Assist reasonably with guest rights requests, security incidents and data-protection assessments.
• Delete or return guest data when the celebration or account is deleted, subject to legal requirements and backup rotation.
• Notify the planner without undue delay after becoming aware of a personal-data breach affecting their guest data.

Sub-processors and transfers

OpenAI provides Sites hosting, Sign in with ChatGPT and D1 storage. Brevo will be added only when transactional email is configured. Provider terms and appropriate international-transfer safeguards apply. Material sub-processor changes will be reflected in the Privacy notice.

Your responsibilities

You must have a lawful basis, provide required information to guests, limit access within your organisation, keep exports secure, respond to guests and delete copies you no longer need. If a client controls the guest list, ensure your agreement with that client clearly allocates these duties.

Contact

For a tailored commercial data-processing agreement before professional rollout, contact hello@mkmela.co.uk.