1. Who we are

LUAR is a wedding and event planning business based in Porto, Portugal, operated by its founders, Polina Ulyanova and Daria Bastos. We decide how and why your personal data is used, which makes us the "controller" under the EU General Data Protection Regulation (GDPR).

Email: team@luarwed.com
Phone: +351 933 757 359

2. What data we collect

When you contact us through the website form, email, WhatsApp, phone or social media, we receive your name, email address, phone number and whatever you choose to tell us in your message.

When you become a client, we collect the information we need to plan your event: names of the couple or hosts, contact details, event date, location and venue, budget, design preferences, and notes from our meetings and conversations.

Guest information. To plan your event, you may share details about your guests, such as names, contact details, seating arrangements, dietary requirements, allergies and accessibility needs. Allergies and some dietary or accessibility information count as health data, which the GDPR treats as a special category. We ask you to share it only with your guests' agreement and use it for nothing except making sure the event works for them.

Billing and payment data, such as billing name, address, tax number (NIF or equivalent) and payment records. If you pay by card, the card details are handled directly by our payment provider. We never see or store full card numbers.

Photos and videos of your event. We use these for our portfolio, website or social media only after you've given us signed permission.

Website data. When you visit our site, our hosting provider automatically records technical data such as your IP address, browser type and device, which is needed to deliver and protect the site. With your consent, we also use analytics cookies to understand how visitors use the site. See our Cookie Policy for details.

3. Why we use your data and on what legal basis

The GDPR requires a legal basis for every use of personal data. Here's ours:

• To answer your enquiry and prepare a proposal: this is a step you've asked us to take before entering a contract (Art. 6(1)(b) GDPR).

• To plan and deliver your event, including sharing details with venues and suppliers: this is necessary to perform our contract with you (Art. 6(1)(b)).

• To handle guests' dietary, allergy and accessibility information: explicit consent of the guests concerned, which you confirm you've obtained when you share it with us (Art. 9(2)(a)).

• To issue invoices and keep accounting records: we're legally required to (Art. 6(1)(c)).

• To use event photos in our portfolio and on social media: your signed consent (Art. 6(1)(a)), which you can withdraw at any time.

• To run website analytics: your consent through our cookie banner (Art. 6(1)(a)).

• To keep the website secure and to establish or defend legal claims: our legitimate interest in protecting our business (Art. 6(1)(f)).

You don't have to give us your data, but without contact details we can't reply to you, and without event details we can't plan your event.

We don't sell your data, and we don't use it for automated decision-making or profiling.

4. Who we share it with

We share personal data only when needed, and only with:

• Venues and event suppliers (caterers, photographers, florists, musicians, transport and similar) involved in your event, limited to what each of them needs.

• Service providers who help us run the business: Google (email and file storage), WhatsApp (messaging), Framer (website hosting and contact form), payment providers such as Stripe and our bank, our invoicing software, and our accountant.

• Public authorities, when the law requires it.

Our service providers act on our instructions and may not use your data for their own purposes.

If you interact with our Instagram, Facebook, Pinterest or LinkedIn pages, the platform also processes your data under its own privacy policy. For page statistics provided by Meta (Instagram and Facebook), Meta and LUAR act as joint controllers.

5. Transfers outside the EU

Some of our providers, including Google, Meta (WhatsApp) and Stripe, may process data in the United States or other countries outside the European Economic Area. These transfers are protected by the EU–US Data Privacy Framework or by the European Commission's Standard Contractual Clauses.

6. How long we keep it

• Enquiries that don't lead to a booking: up to 12 months after our last contact.

• Client planning files: up to 3 years after your event, in case questions or claims come up.

• Guest dietary, allergy and accessibility information: deleted within 3 months after the event.

• Invoices and accounting records: 10 years, as required by Portuguese tax law.

• Event photos used in our portfolio: until you withdraw your consent.

• Analytics data: no longer than 14 months.

7. Your rights

You have the right to:

• access the personal data we hold about you and get a copy of it;

• ask us to correct or complete it;

• ask us to delete it;

• ask us to restrict how we use it;

• receive the data you gave us in a portable format;

• object to our use of your data based on legitimate interest;

• withdraw your consent at any time, without affecting anything we did before you withdrew it.

To use any of these rights, email team@luarwed.com. We'll reply within one month. We may ask you to confirm your identity first.

If you think we've mishandled your data, you can complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), at www.cnpd.pt, or to the authority in your EU country of residence. We'd appreciate the chance to sort it out with you first.

8. Security

We protect your data with access controls, secure passwords and two-factor authentication on our accounts, and we share it only with people who need it for your event. No system is completely secure, but if a breach puts your data at risk, we'll inform you and the authorities as the law requires.

9. Children

Our services are meant for adults. We don't knowingly collect data from anyone under 18, except guest details (such as a child's name or dietary needs) that a parent or guardian shares with us for an event.

10. Changes to this policy

We'll update this policy when our services or the law change, and we'll change the date at the top when we do. If a change significantly affects how we use your data, we'll tell our current clients directly.

11. Contact

For anything about this policy or your data, email team@luarwed.com.