Privacy Policy

This Privacy Policy explains how ur.rsvp (“we”, “us”, “our”) collects, uses, shares and protects personal data when you use our website and party RSVP platform (the “Service”). We are committed to protecting your privacy and handling your personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Please read this policy carefully. If you do not agree with it, please do not use the Service.

ur.rsvp is a platform used by leisure venues and party hosts to create RSVP pages and manage guest responses. Our data protection responsibilities depend on the type of data:

• Account & billing data. When a venue or host signs up and uses their account, we act as the data controller for that account and billing information.
• Guest RSVP data. When guests respond to a party invitation, the venue or host who created the party is the data controller for those responses, and ur.rsvp acts as a data processor handling that data on their behalf under our agreement with them.

Where we act as a processor, this policy describes our practices for transparency, but any questions about how a specific venue or host uses guest data should be directed to that organisation, who is the controller.

From venues and hosts (account holders):

• Name, email address and (where provided) phone number and business details.
• Login credentials and account settings.
• Party details you create, such as party names, dates, times and locations.
• Billing and subscription information (payments are handled by our payment provider).
• Communications you send us, such as enquiries and support requests.

From guests responding to an invitation:

• Name and contact details (for example email address) where provided.
• RSVP status and head count (number of adults/children attending).
• Dietary requirements and allergy information you choose to share.
• Any messages, photos or media you submit with your RSVP.
• Marketing preferences (for example whether you opt in to offers).

Collected automatically:

• Technical data such as IP address, device and browser type, and pages visited.
• Strictly necessary cookies and similar technologies needed to run the Service.

You do not have to provide dietary, allergy or message information — it is optional and shared only to help the venue or host cater for you.

We use personal data for the following purposes, relying on these lawful bases under UK GDPR:

• To provide the Service — creating accounts, hosting party pages, collecting and displaying RSVPs, and sending transactional emails (such as confirmations and reminders). Lawful basis: performance of a contract and our legitimate interests in operating the platform.
• To communicate with you — responding to enquiries and providing support. Lawful basis: legitimate interests and/or contract.
• Marketing offers — sending promotional messages where you have opted in. Lawful basis: consent, which you may withdraw at any time.
• To keep the Service secure and improve it — monitoring for fraud and abuse, and understanding usage. Lawful basis: legitimate interests.
• To comply with the law — meeting our legal and regulatory obligations. Lawful basis: legal obligation.

We do not sell your personal data. We share it only as needed to run the Service:

• Venues and hosts. Guest RSVP details are shared with the venue or host who created the party, so they can plan and cater for the event.
• Service providers. Trusted suppliers who help us operate the platform — for example cloud hosting, database, file storage, email delivery and payment processing — acting as our processors under contract.
• Legal and safety. Where required by law, court order, or to protect the rights, safety and security of our users or the public.
• Business transfers. If our business is reorganised, merged or sold, personal data may be transferred as part of that transaction.

Some of our service providers may process data outside the UK. Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place — such as an adequacy decision by the UK government, or the International Data Transfer Agreement (IDTA) / Standard Contractual Clauses with the UK Addendum — so that your data receives an equivalent level of protection.

We keep personal data only for as long as necessary for the purposes described in this policy:

• Account data is kept while your account is active and for a reasonable period afterwards.
• Guest RSVP data is kept for as long as the venue or host needs it for the event and their own record-keeping, subject to their instructions as controller.
• Billing records are kept for as long as required to meet legal and accounting obligations (typically at least six years).

When data is no longer needed, we securely delete or anonymise it.

Under UK GDPR you have the right to:

• Be informed about how your data is used (this policy).
• Access a copy of the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request erasure of your data (the “right to be forgotten”) in certain circumstances.
• Restrict or object to our processing in certain circumstances.
• Data portability — receive your data in a structured, commonly used format.
• Withdraw consent at any time, where we rely on consent (for example marketing).

To exercise any of these rights, contact us using the details below. If your request relates to guest RSVP data held on behalf of a venue or host, we may direct you to that organisation as the controller, or handle your request on their behalf. We will respond within one month.

We use cookies and similar technologies that are strictly necessary to run the Service — for example to keep you logged in and to keep the platform secure. These do not require consent. If we introduce non-essential cookies (such as analytics) in future, we will ask for your consent first and update this policy.

ur.rsvp is designed to be used by adults — venues, party hosts and the parents or guardians who respond to invitations. The Service is not intended for direct use by children. RSVP responses relating to children (for example a child’s attendance or dietary needs) should be submitted by a parent or guardian. We do not knowingly collect personal data directly from children. If you believe a child has provided us with personal data, please contact us and we will take steps to delete it.

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss or misuse — including encryption in transit, access controls and secure hosting. No system can be guaranteed completely secure, but we work to protect your data and to respond promptly to any incidents.

We may update this policy from time to time. When we make material changes, we will update the “Last updated” date at the top of this page and, where appropriate, notify you.

If you have any questions about this policy or how we handle your data, or you wish to exercise your rights, please contact us at [email protected].

You also have the right to lodge a complaint with the UK’s data protection regulator, the Information Commissioner’s Office (ICO), at ico.org.uk or by calling their helpline. We would, however, appreciate the chance to address your concerns before you approach the ICO.