Who we are
Nodus Events Limited is a company registered in England and Wales (Company No. 17208744), with its registered office at 79 Belgrave Road, Aylesbury, England, HP19 9TN ("we", "us", "our"). We operate the website and platform available at thenodus.uk (the "Platform").
We are the data controller for personal data collected through the Platform. For the purposes of UK GDPR and the Data Protection Act 2018, our representative can be contacted at privacy@thenodus.uk.
What data we collect and why
Nodus is a marketplace that connects couples planning South Asian weddings with wedding vendors. The data we hold depends on how you use it.
Account data (couples and vendors)
When you create an account we collect your name, email address, phone number (if you give it), whether you are a couple or a vendor, and your login credentials (passwords are stored only as a secure hash). We need this to create and run your account and to contact you about it. Our lawful basis is contract (Article 6(1)(b) UK GDPR).
Wedding planning data (couples)
To help you plan, we store the details you add about your wedding: dates, city and venues, the ceremonies and events involved, guest numbers, budget, saved vendors and notes. Our lawful basis is contract. Please only add other people's details (for example family members helping to plan) where they are happy for you to do so.
Vendor business data
For vendors we store your business name, category, region, experience, website, profile content, pricing, availability and the information we collect to verify your business. Our lawful basis is contract, and legitimate interests for verification, which protects couples using the Platform.
Enquiries, messages, quotes and bookings
We store the enquiries, messages and quotes exchanged between couples and vendors on the Platform, when they were sent and answered, and the bookings that result: the services booked, the price, deposits and instalment schedules, and the commission due. We need this to run bookings and resolve disputes (contract), and to keep financial records (legal obligation, Article 6(1)(c)).
Payment data
Payments are processed by Stripe. We receive tokenised payment references and payment details such as amount, currency, date and the last four digits of a card. We never see or store full card numbers. Our lawful basis is contract.
Website enquiries and vendor applications
When you use a form on thenodus.uk (the contact form, a vendor application or the Journal newsletter) we receive what you enter, such as your name, email, business details and message. We use it to reply, to assess vendor applications and, for the newsletter, to send you the Journal. Our lawful basis is legitimate interests for enquiries and applications, and consent for the newsletter.
Account management and record keeping
We keep a record of every couple and vendor account, every website enquiry and every vendor application in our customer relationship management system (HubSpot). Alongside your contact details, this record holds a summary of activity on the Platform, for example sign-up date, wedding date and city, the number of enquiries, quotes and bookings, total booked value, vendor response times and, for vendors, commission and onboarding progress. We use this to support you, onboard and look after vendors, keep accurate business records and understand how the Platform is used. Our lawful basis is legitimate interests. Holding this record does not mean we will send you marketing: that only happens with your consent.
Usage data and analytics
If you accept analytics cookies, we use PostHog and Google Analytics to understand how the website and Platform are used: pages visited, features used, and session recordings in which everything typed into forms is masked. Our lawful basis is consent, which you can withdraw at any time through the cookie banner. We also keep technical data such as IP address, browser, device and error logs for security, fraud prevention and fixing faults, on the basis of legitimate interests.
Marketing
We send newsletters and marketing emails only if you have opted in, or, where the law allows, about similar services to existing customers who have not opted out. Our lawful basis is consent (Article 6(1)(a)). You can unsubscribe using the link in any email or by contacting us.
Cookies and tracking
Our use of cookies is governed by our Cookie Policy. We use PECR-compliant consent mechanisms — non-essential cookies are only placed after you give explicit consent.
Where your data is stored and who we share it with
We share data only where necessary:
Couples and vendors. When a couple sends an enquiry or makes a booking, we share the details needed with that vendor (such as the couple's name, wedding date, event details and message), and share the vendor's business details with the couple.
Processors acting on our behalf. We use these services, each bound by a data processing agreement meeting Article 28 UK GDPR:
| Service | What it does | Where data is held |
|---|---|---|
| Supabase | Platform database and account login | EU (Ireland) |
| Vercel | Website hosting and processing of website forms | UK (London) for form processing; global network for page delivery |
| HubSpot | Customer relationship management and record keeping | EU data centre |
| Resend | Sending emails, including form notifications | EU and US |
| PostHog | Analytics, only with your consent | EU |
| Google Analytics | Website analytics, only with your consent (advertising features switched off) | EU and US |
| Stripe | Payment processing | UK, EU and US |
Legal obligations. We may disclose data where required by law, court order, or to cooperate with a regulatory investigation.
Business transfers. If we undergo a merger, acquisition, or asset sale, personal data may transfer to the acquiring entity. We will notify you before this occurs where required.
We do not sell personal data. We do not share personal data with third parties for their own marketing purposes.
International transfers
We keep data in the UK and EU wherever we can. Some of the services above are run by US companies and may access or process data in the US. Where data is transferred to a country without a UK adequacy decision, we rely on the UK Extension to the EU–US Data Privacy Framework, the UK International Data Transfer Agreement (IDTA) or equivalent safeguards. You can request a copy of the relevant transfer mechanism by contacting us.
How long we keep your data
| Category | Retention period |
|---|---|
| Account and wedding planning data | While your account is open, then 2 years for dispute resolution |
| Enquiries, messages and quotes | 3 years after the related wedding date or your last activity, whichever is later |
| Booking, payment and commission records | 7 years (HMRC statutory requirement) |
| Record-keeping (CRM) record | As for account data; for people without an account, 2 years from our last contact |
| Unsuccessful vendor applications and website enquiries | 2 years from our last contact |
| Analytics and session recordings | Up to 12 months |
| Technical and security logs | 12 months rolling |
| Marketing preferences | Until consent is withdrawn, then deleted within 30 days (we keep a suppression record so we do not contact you again) |
After the relevant period, data is securely deleted or anonymised.
Your rights
Under UK GDPR, you have the right to:
Access — request a copy of the personal data we hold about you.
Rectification — ask us to correct inaccurate data.
Erasure — ask us to delete your data where we have no lawful reason to retain it.
Restriction — ask us to pause processing while a dispute is resolved.
Portability — receive your data in a machine-readable format where processing was based on consent or contract.
Object — object to processing based on legitimate interests, including for direct marketing (which we will always honour immediately).
Withdraw consent — where we rely on consent, you can withdraw it at any time without affecting the lawfulness of prior processing.
To exercise any right, contact us at privacy@thenodus.uk. We will respond within one calendar month. If the request is complex, we may extend this by a further two months and will notify you accordingly. We will not charge a fee unless the request is manifestly unfounded or excessive.
Automated decision-making
We do not subject you to decisions made solely by automated means that produce legal or similarly significant effects. If this changes, we will update this policy and notify you in advance.
Security
We implement technical and organisational measures appropriate to the risk, including encryption in transit (TLS 1.2+), encryption at rest, access controls based on least privilege, and regular security reviews. No transmission over the internet is entirely secure — we cannot guarantee absolute security, but we take our obligations seriously.
If we become aware of a personal data breach that poses a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, notify you without undue delay.
Children
The Platform is not directed at individuals under 18. We do not knowingly collect personal data from children. If you believe we have done so inadvertently, contact us and we will delete the data promptly.
Changes to this policy
We may update this policy to reflect changes in our practices or applicable law. Where changes are material, we will notify you by email or prominent notice on the Platform at least 14 days before they take effect. The "last updated" date at the top of this page will always reflect the current version.
How to complain
If you have concerns about how we handle your data, please contact us first at privacy@thenodus.uk. If you remain unsatisfied, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Tel: 0303 123 1113
ico.org.uk
Contact us
Data controller: Nodus Events Limited (Company No. 17208744)
Email: privacy@thenodus.uk
Post: 79 Belgrave Road, Aylesbury, England, HP19 9TN