Skip to content

Privacy policy

Last updated: October 18, 2026

In accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD), we explain how we process your personal data.

1. Data controller

  • Controller: Objectiu S.C.P. (trading as Lifetime Weddings)
  • Tax ID (CIF): J43300581
  • Address: C/ Mare Molas, 26, 43202 Reus (Tarragona), Spain
  • Email: [email protected]
  • Phone: +34 688 94 61 11

2. Purposes and legal basis

  • Answering your enquiries received through the website forms, the quiz, WhatsApp or email, and sending you the information or quote you ask for (basis: your consent and pre-contractual steps taken at your request).
  • Preparing and following up proposals for photography and video, including sending personalised links to the couple (basis: pre-contractual steps at the data subject’s request).
  • Formalising and performing the contract when you book: tax details (ID, address) to issue invoices, collecting payments, and the communications that are part of the service, such as payment reminders or the forms to prepare the wedding (basis: performance of the contract and legal tax obligations).
  • Publishing images of your wedding only on the channels you expressly authorise, one by one, in the contract: the studio’s shop window, the website and blog, Instagram, Facebook, ads, and sharing with the wedding venues for their own promotion (basis: your consent). You can withdraw it at any time by writing to us: we will stop using the images in new publications and remove those that depend on us.
  • Statistics and advertising, only if you accept them on the cookie banner (basis: consent). If you accept advertising and submit the contact form, we share with Meta your email and name hashed, together with your IP and browser, to measure how our ads perform (Meta Conversions API).
  • Security and abuse prevention: a captcha on public forms and logging the IP and user agent when the booking form is submitted, limited to what is needed to detect fraud or automated use (basis: legitimate interest).

We do not send you advertising by email. The emails that couples who have already booked receive are part of the service, and if you would rather not receive any of them, just tell us.

Fields marked as required on the forms are needed to handle your request: without them we cannot reply or prepare a quote.

3. Data retention

We apply the following periods from the date each record is created, unless the law requires a longer period or you have asked us to delete the data earlier:

  • Enquiries that do not lead to a contract: 12 months.
  • Unaccepted quote proposals: 6 months.
  • Bookings archived without being formalised: 6 months from archiving.
  • Tax and billing data for booked weddings: 6 years from the wedding date, under art. 30 of the Spanish Commercial Code and tax rules.
  • Published images: for as long as you keep your consent.
  • Activity logs (visits, events): 12 months.

Clean-up runs automatically in the system, periodically.

4. Recipients and processors

We do not sell or share your data with third parties for their own purposes, except sharing images with the wedding venues when you have authorised it and when the law requires it (for example, with the Spanish Tax Agency). We do work with providers who process data on our behalf, with contractual safeguards in line with the GDPR:

  • Railway (railway.com, USA): website and database hosting.
  • Resend, Inc. (USA): sending the website and service emails (confirmations, notices, auto-replies).
  • Fotostudio (fotostudio.io, France): customer management (CRM), where enquiries and bookings arrive, and photo delivery galleries.
  • Stripe Payments Europe, Ltd. (Ireland): collecting the deposit and other card payments. We do not store your card details.
  • Cal.com, Inc. (USA): video call scheduling, if you book one.
  • Meta Platforms Ireland Ltd. (Ireland) and Meta Platforms, Inc. (USA): WhatsApp, if you message us there; the Meta Pixel and Conversions API, only if you accept advertising; and publishing on Instagram and Facebook, only with your consent.
  • Google LLC (USA): web fonts (Google Fonts), YouTube videos when you play them, Google Analytics 4 only if you accept statistics, and Google Maps Platform to show our Google rating (server-side request, without your IP).
  • Cloudflare, Inc. (USA): captcha (Turnstile) on public forms.
  • Telegram FZ-LLC (United Arab Emirates / United Kingdom): internal notifications to our team, with a minimal summary (couple, date, venue), no tax data or ID numbers.
  • Behold Inc. (United Kingdom): shows our Instagram feed on the website; it only processes your IP when the page loads.

5. International transfers

Some of these providers are outside the European Economic Area, mainly in the United States and the United Kingdom. Transfers rely on the EU-U.S. Data Privacy Framework, on Standard Contractual Clauses approved by the European Commission or, for the United Kingdom, on the Commission’s adequacy decision, depending on the provider.

6. Cookies

We use technical cookies, which the site needs to work, and, only if you accept them, statistics (Google Analytics) and advertising (Meta) cookies. You can change your choice at any time from “Cookie preferences” at the bottom of every page. More information in the cookie policy.

7. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time by writing to [email protected] and proving your identity. Where processing is based on your consent, you can withdraw it at any time, without affecting the lawfulness of processing carried out before. We do not make automated decisions that significantly affect you.

If you believe we have not handled your rights properly, you can lodge a complaint with the Spanish Data Protection Agency (aepd.es).

8. Security measures

We apply appropriate technical and organisational measures to protect data against unauthorised access, alteration, loss or destruction. Admin passwords are stored with bcrypt hashing, traffic between the browser and the server is encrypted with HTTPS, and backups are made on the persistent volume hosted on Railway.

Chat with us