Terms and conditions

1. Provider

The Service is operated by fest-appen.dk, a Danish sole proprietorship, CVR no. 46422562, Elmehøjen 152, DK-8200 Aarhus N, Denmark. Contact: info@fest-appen.dk.

For GDPR purposes, fest-appen.dk acts as data processor for the content that the Tenant and the Tenant's Guests upload into the Service, and as an independent data controller for the operational data (admin credentials, server logs, acceptance records) needed to run the Service.

2. Definitions

• The Service — the hosted web application at fest-appen.dk and its subdomains, including the admin panel, guest front page and TV display.
• Provider / we / us — fest-appen.dk, as set out in section 1.
• Tenant — the natural or legal person that has created one or more Events in the Service and accepted these terms. In practice: you.
• Admin — the person who logs into the Tenant's admin panel to manage the Event. Usually the Tenant personally or someone appointed by the Tenant.
• Event — a specific event (party, wedding, anniversary, etc.) that the Tenant runs through the Service.
• Guest — a third party granted access by the Tenant to view and/or upload content for the Event.
• Content — all text, images, video, audio and other data that the Tenant or the Guests upload or generate in the Service.

3. Terms of Service

3.1 Acceptance and age requirement

By completing the Tenant administrator's first onboarding — including choosing a language, actively accepting these terms via the checkbox shown together with the full text and creating an admin password using the activation link provided by the Provider — you confirm that (a) you are at least 18 years old and legally competent to enter into contracts under Danish law, (b) you have read these terms, and (c) you accept them on behalf of yourself or — if acting for an organisation — on behalf of the organisation you represent. Your acceptance is technically recorded when you complete the password step; incomplete onboarding flows without a valid acceptance are not recorded as an agreement.

The Service is not intended for persons under 18 as Tenants.

As regards Guests, the Tenant is solely responsible for assessing and handling any age limits, parental consent and other regulatory requirements. The Provider does not set independent age limits for Guest access.

3.2 What the Service does

The Service helps the Tenant run an Event: schedules, menus, practical info, accommodations, activities, guest photo sharing, guestbook and TV display. The Service is an ambient/experience platform — it is not intended as an archive, accounting system, CRM or business-critical system of record.

3.3 Tenant responsibility for content and moderation

The Tenant is solely responsible for all Content that the Tenant or the Tenant's Guests place into the Service. This includes:

• ensuring the Tenant has the necessary rights and consents to display photos, mention names, share locations and publish schedule entries for persons identifiable in the Content;
• moderating Guest contributions (photos, guestbook messages) as needed — the Service provides tools for pre-approval, but using them is the Tenant's choice and responsibility;
• having its own lawful basis and, where applicable, internal data processing agreements if the Tenant acts as a business and further processes data for its own purposes.

The Provider is not a co-editor of Tenant Content and has no duty to pre-screen Content uploaded by Guests.

3.4 Acceptable use

The Tenant and Guests may not use the Service to:

• upload, send or display content that is illegal, defamatory, discriminatory, incites violence, constitutes hate speech, is sexually abusive, involves minors in inappropriate contexts, or infringes third-party intellectual property or privacy rights;
• upload malware, viruses, phishing content or act as a distribution point for such content;
• attempt to bypass security, gain unauthorised access to other Tenants' data, perform brute-force attacks, systematically scrape the Service or overload its infrastructure;
• use the Service for automated mass communication, spam, advertising to Guests without their consent, or reselling data;
• violate applicable Danish, EU or international law, including GDPR.

The Provider may, at its sole discretion and without notice, suspend or terminate the Tenant's account and remove Content in the event of a breach. Serious breaches may be reported to the authorities.

Images of minors. Events such as confirmations, birthday parties and weddings will often include images of minors. The Tenant is encouraged to inform guests — for example via table cards or at the welcome — that the Service is being used for photo uploads, and to obtain prior consent from parents or guardians where there is any doubt about a guest's age or wish to be photographed. Responsibility for obtaining consent rests with the Tenant as data controller, see §5.

3.5 Rights to Content

The Tenant and the Guests retain all copyright in their own Content. By placing Content into the Service, the Tenant (on its own behalf and on behalf of the Guests) grants the Provider a non-exclusive, royalty-free, worldwide licence to host, store, display, convert (e.g. compress images), back up and deliver the Content across the Service's own surfaces (front page, admin, TV, print kit). The licence is limited to what is technically necessary to operate the Service and terminates when the Content is deleted.

The Provider does not use the Tenant's or the Guests' Content for advertising, training machine-learning models, reselling or any purpose outside operating the Service.

3.6 Availability

The Provider aims for high uptime but does not guarantee uninterrupted service and gives no separate SLA. Hosting is provided by Simply.com A/S (Denmark). Daily backups are taken and may be up to 24 hours old. Scheduled maintenance may occur with or without notice.

3.7 Account security

The Tenant is responsible for safeguarding its password and for all actions taken through its admin account. The Tenant must notify the Provider immediately if it suspects unauthorised access.

3.8 Payment, access and default

Pricing and payment. Paid use of the Service requires a separate agreement on price and payment terms between the Tenant and the Provider (typically by quote and invoice issued by the Provider). Where no express price agreement exists, the Provider may restrict or discontinue functionality.

Access before payment in full. The Provider may — without waiving its rights — allow the Tenant to retain or obtain access to the Service before payment has been recorded as received. This does not prevent the Provider from later suspending or restricting access for non-payment.

Suspension or restriction for non-payment or misuse. The Provider may — where reasonable and proportionate — with or without prior notice suspend, restrict or terminate the Tenant's access to the Service in whole or in part in the event of (a) default, including material or repeated failure to pay in accordance with agreed due dates, or (b) misuse or material breach of these terms, including section 3.4 (Acceptable use). The Provider aims to avoid unnecessary interruption of Events already underway but cannot guarantee uninterrupted access in case of default or misuse.

Pricing information. The exact price is agreed in a separate price overview or quote that the Tenant accepts before access to paid features is activated. Access to basic Service functions during setup occurs prior to the pricing agreement, but no payment obligation arises unless the Tenant has received and accepted a price overview, in accordance with the pre-contractual information requirement (CRD art. 6).

Cancellation and refunds. The Tenant may cancel its purchase of the Service subject to the deadline below: If the Provider has received the Tenant's written cancellation at info@fest-appen.dk no later than seven (7) full calendar days before the planned date of the Event, the Tenant will receive a full refund of any amount already paid to the Provider for that specific Event. Cancellation is deemed received on the calendar day the Provider's mail server or support system logs the message as delivered to the Provider.

If cancellation is received later than the deadline above, no refund is due unless the Provider expressly agrees otherwise in writing.

Credit notes or refunds, where applicable, follow the Provider's normal routines and may require bank details from the Tenant.

Right of withdrawal. The Service is a digital service (ongoing platform access). During onboarding, the Tenant explicitly requests immediate performance of the service agreement and acknowledges that the right of withdrawal lapses once the agreement has been fully performed by the Provider, pursuant to CRD art. 16(a) and the Danish Consumer Contracts Act § 18 a. This consent is recorded separately at onboarding.

Consumer protection. Mandatory rules under Danish or EU law on consumer contracts apply where the Tenant acts as a consumer.

3.9 Warranty disclaimer

The Service is provided "as is" and "as available", without warranties of any kind, whether express or implied, including but not limited to warranties of fitness for a particular purpose, merchantability, non-infringement of third-party rights or error-free operation.

3.10 Limitation of liability

To the fullest extent permitted by Danish law, the Provider is not liable for indirect losses, consequential damages, lost profits, lost goodwill, data breaches caused by the Tenant's or Guests' actions, or loss of Content beyond what can be restored from the most recent daily backup. The Provider's aggregate liability to the Tenant for any claim is in any event capped at DKK 2,500 per Tenant account per 12-month period, or the amount the Tenant has paid the Provider in the preceding 12 months — whichever is higher.

Nothing in these terms excludes liability that cannot be excluded under Danish mandatory law, including liability for gross negligence, intent and personal injury.

3.11 Indemnification

The Tenant indemnifies the Provider against claims, losses, fines and reasonable legal costs arising out of (a) Content placed into the Service by the Tenant or its Guests, (b) the Tenant's use of the Service in violation of these terms, or (c) the Tenant's failure to meet its own obligations as data controller.

3.12 Termination and consequences

The Tenant may request termination and deletion of its Tenant at any time by emailing info@fest-appen.dk. The Provider will initiate deletion within a reasonable period and no later than 30 days after receipt.

The Provider may terminate the agreement with 30 days' notice, or immediately without notice in the event of material breach, including breach of section 3.4 (Acceptable use), failure to pay (if pricing has been separately agreed), or upon discontinuation of the Service.

On termination, the Provider offers the Tenant a 30-day window to extract Content, after which the Content and the Tenant account are deleted. Daily backups rotate on a 14-day window and are then overwritten.

3.13 Changes to these terms

The Provider may change these terms. The version and effective date appear at the bottom. For material changes, active Tenants will be notified by email or through the admin panel at least 14 days before the effective date. Continued use after the effective date constitutes acceptance. Alternatively, the Tenant may terminate the agreement pursuant to section 3.12.

3.14 Force majeure

The Provider is not liable for non-performance or delayed performance resulting from circumstances outside the Provider's reasonable control, including but not limited to power outages, hosting outages at Simply.com, public authority intervention, pandemic, war, cyber-attack and force majeure events.

3.15 Governing law and venue

These terms are governed by Danish law. Any dispute arising out of or relating to these terms or the Service that cannot be settled amicably shall be decided by the Provider's ordinary venue in Denmark.

3.16 Miscellaneous

Assignment. The Provider may assign its rights and obligations in connection with corporate restructuring, sale or merger, with reasonable notice to the Tenants. The Tenant may not assign without the Provider's prior written consent.

Severability. If any provision of these terms is held invalid or unenforceable, the validity of the remaining provisions is unaffected.

Entire agreement. These terms, including the Privacy Policy (section 4) and the Data Processing Agreement (section 5), constitute the entire agreement between the Provider and the Tenant regarding the use of the Service and supersede any prior agreements.

No waiver. The Provider's failure to enforce any right under these terms does not constitute a waiver of that right.

DSA single point of contact. fest-appen.dk is a hosting service within the meaning of Regulation (EU) 2022/2065 (Digital Services Act). As a micro-enterprise, fest-appen.dk is exempt from the majority of the obligations under the Regulation. In accordance with DSA art. 11, info@fest-appen.dk serves as the single point of contact for communications from authorities.

4. Privacy Policy

4.1 Roles

The Tenant is the data controller for the Content that the Tenant or the Tenant's Guests place into the Service about identifiable persons. The Provider is the data processor for this Content and acts only on instructions from the Tenant (see section 5, Data Processing Agreement).

The Provider is an independent data controller for the operational data necessary to run the Service: the Tenant admin's login credentials, technical web server logs, acceptance of these terms (timestamp + IP + snapshot of the text), and communications with the Provider.

4.2 Legal basis

The Provider processes personal data on the following legal grounds:

• Performance of a contract (GDPR Art. 6(1)(b)) — for what is necessary to deliver the Service to the Tenant, including account creation/log-in, hosting the Tenant's Content, invoicing (where relevant).
• Legitimate interests (GDPR Art. 6(1)(f)) — for necessary IT security, debugging, abuse prevention, proof of terms acceptance and other ordinary operation.
• Legal obligation (GDPR Art. 6(1)(c)) — where we are required to retain data, e.g. under the Danish Bookkeeping Act (5 years).
• Consent (GDPR Art. 6(1)(a)) — if we ever introduce newsletters or similar; consent can be withdrawn at any time.

The Tenant is independently responsible for ensuring a lawful basis for the processing the Tenant initiates in relation to its Guests.

4.3 Categories of data subjects and data

Tenant admins. Email address (if provided), password hash, IP address and timestamp at terms acceptance.

Guests. Name (if provided), guestbook messages, uploaded images (with any EXIF metadata incl. GPS), emoji reactions, a pseudonymous "visitor_id" cookie used for guestbook rate-limiting. The Provider does not process Guests' IP addresses beyond what the web server logs.

Operational data. Web server logs (IP, URL, status code, user agent), upload timestamps, error logs.

4.4 What we do not do

• We do not use third-party analytics tools (Google Analytics, Meta Pixel, Hotjar, etc.).
• We do not use advertising trackers or behavioural profiling.
• We do not sell data and do not disclose data to third parties beyond the sub-processors listed in section 5.4 and where legally required.
• We do not use the Tenant's or the Guests' Content to train machine-learning models.

4.5 Security measures

We apply the technical and organisational security measures reasonably proportionate to the risk, including: TLS on all connections; password hashing; CSRF protection on forms; server-side validation and rate-limiting; daily rotating backups at Simply.com; separate database instances per tenant; principle of least privilege on the server; continuous updates of platform and dependencies.

4.6 Cookies

The Service sets only strictly necessary cookies: a session cookie for admin login, a CSRF token, and a pseudonymous visitor_id for guestbook rate-limiting. No analytics or advertising cookies are used on the guest-facing pages.

4.7 Retention

Event content is retained until the Tenant requests deletion (see section 3.12). Operational logs are retained for up to 90 days. Acceptance logs are retained for 5 years after Tenant termination. Accounting records are retained for 5 years under the Danish Bookkeeping Act.

After the Event has ended, the Provider may provide a bulk download package (ZIP of photos + guestbook export) via a personal secret link valid for approximately 30 days from issuance.

4.8 Your rights

You have the right to access, rectification, deletion, restriction of processing, data portability and objection. Contact info@fest-appen.dk. We respond within 30 days. Guests should normally address requests to the Tenant (data controller for the Content), but may also contact the Provider.

4.9 Right to complain

You may lodge a complaint with Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, datatilsynet.dk.

4.10 International transfers

Hosting and backup in Denmark at Simply.com A/S. Transactional email via Resend, Inc. (USA), processed on AWS eu-west-1 (Ireland) under EU Standard Contractual Clauses. No other transfers outside the EU/EEA.

5. Data Processing Agreement (DPA)

This section constitutes the DPA between the Tenant (data controller) and the Provider (data processor) required under GDPR Art. 28 in respect of the Content that the Tenant and the Tenant's Guests place into the Service.

5.1 Subject matter and duration

The Provider processes personal data on behalf of the Tenant for the purpose of delivering the Service. The DPA applies for as long as the Tenant maintains an active account and terminates together with the main agreement.

5.2 Instructions

The Provider may only process personal data on documented instruction from the Tenant. These terms and the features enabled in the admin panel constitute the ongoing instruction.

5.3 Confidentiality and staff access

The Provider ensures that authorised persons are bound by confidentiality. Access to tenant data is restricted to the minimum necessary for operation, support and security.

5.4 Sub-processors

The Tenant gives general consent to the following sub-processors:

• Simply.com A/S (Denmark) — hosting, database storage, backups, infrastructure.
• Ping IT (Denmark) — decommissioned storage media destruction (sub-processor of Simply.com).
• B4Restore (Denmark) — backup infrastructure (sub-processor of Simply.com).
• Resend, Inc. (USA) — transactional email. Processed in the EU (AWS eu-west-1, Ireland) under EU Standard Contractual Clauses.

The Provider will notify the Tenant with at least 30 days' notice of any planned changes to sub-processors.

5.5–5.9

Security (Art. 32 measures per section 4.5), assistance with data subject rights, data breach notification without undue delay, audit access on reasonable notice, and deletion within 30 days of termination. Full details are set out in the onboarding terms document.

6. Version and effective date

For complaints: EU consumer dispute resolution bodies.

These terms have been drafted in good faith but are not guaranteed to be exhaustive or legally perfect. Seek professional legal advice for situations that require it.