Privacy Policy

• We are the data CONTROLLER for your own data, when you create an Organiser or Vendor account on our platform, or when you make a payment to us. We decide the purpose and the means of processing that data.
• We are the PROCESSOR for your guests' data (e.g. guest lists, RSVP responses, dietary preferences, table seating). For that data, you (the Organiser) are the Controller. We store it strictly in order to give you the technical tools you need to organise your event; we do not sell it and we do not use it for our own purposes.

For Organisers who wish to formalise this relationship, we make a Data Processing Agreement (DPA) available under Art. 28 GDPR — contact us at the address in section 10.

A. Data you provide directly (as an Organiser or Vendor)

• Identification and contact details: first and last name, email address, telephone number.
• Profile data (Vendors): company name, tax identification number, address, portfolio photographs, service descriptions.
• Billing data: billing address and the details required to issue invoices.
• Event details: the date, the venue, the type of event, and the public information shown on the website you build with the Website Builder.

B. Guest data (entered by the Organiser)

• First and last name, contact details (email/phone for digital invitations), RSVP status.
• Occasional information about allergies or dietary preferences. Note: data about allergies or medical conditions is a special category of data (Art. 9 GDPR — health data) and requires the explicit consent of the person concerned. The Organiser is solely responsible for obtaining that consent before entering such data into the platform; the Company does not verify and cannot guarantee that it exists.
• If a Guest contacts us directly about their data, we will refer them to the Organiser of that event, who is the data Controller, and will provide the Organiser's contact details where the law permits.

C. Data collected automatically (technical)

• IP address, browser type, operating system.
• Browsing and interaction data collected through cookies — for details, see the Cookie Policy.

A note on payments: all payments are processed through our authorised partner (Stripe). We do not store your bank card details.

• To provide the services (basis: performance of a contract — Art. 6(1)(b) GDPR): creating your account, running the tools (RSVP, QR Seat, QR Moments, Checklist, Marketplace), sending administrative notifications, processing payments.
• To comply with legal obligations (basis: legal obligation — Art. 6(1)(c) GDPR): retaining accounting records (invoices) as required by Romanian tax law.
• For security and operation (basis: legitimate interests — Art. 6(1)(f) GDPR): fraud prevention, protecting our IT systems, analysing platform performance and debugging technical faults.
• For marketing (basis: consent — Art. 6(1)(a) GDPR): only if you have explicitly opted in to receive newsletters or promotional offers from us. You can unsubscribe at any time, without affecting the rest of your account.
• We do not use automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you, within the meaning of Art. 22 GDPR.

We do not sell your personal data in any form. Data may be shared only with service providers strictly necessary to operate the platform (processors), who meet high GDPR standards:

• Hosting and cloud providers (e.g. AWS, Google Cloud, DigitalOcean) — to host the database.
• Payment processors (e.g. Stripe) — to complete financial transactions.
• Email/SMS services — to send digital invitations and system notifications.
• Public authorities — only where there is a valid legal request (e.g. courts, police, the tax authority).

We keep an up-to-date list of these processors (sub-processors), available on request at the contact address in section 10.

In the Marketplace section, a Vendor's public data (portfolio, contact details) is by its nature visible to all users, on the basis of the consent the Vendor gives when creating a public profile.

In the event of a merger, acquisition or sale of the Company's assets, personal data may be transferred to the successor entity, subject to the same protections set out in this policy, and you will be notified accordingly.

• Account data: for as long as the account exists. If you request deletion of your account, the data is deleted or anonymised within 30 days at the latest.
• Guest data: we recommend that Organisers delete their guest list once the event is over. If an Organiser deletes their account, all guest data associated with it is irreversibly destroyed.
• Accounting records (invoices): kept for 10 years, as required by the Romanian Tax Code.
• Security backups: kept for a limited period (e.g. 30 days) and overwritten automatically.

6.1. We implement appropriate technical and organisational measures to protect data against unauthorised access, loss, destruction or alteration. These include encrypted connections (SSL/HTTPS), secure authentication, monitoring against cyber attacks, and restricting access to data to authorised personnel only.

6.2. In the event of a personal data breach that presents a risk to your rights and freedoms, we will notify the Romanian supervisory authority (ANSPDCP) within 72 hours of becoming aware of it, in accordance with Art. 33 GDPR, and will inform you directly, without undue delay, where the law requires it (Art. 34 GDPR).

• Right of access: to find out what data we hold about you.
• Right to rectification: to correct inaccurate or incomplete data from your account settings.
• Right to erasure (“the right to be forgotten”): to request deletion of your account and the associated data.
• Right to restriction of processing: to ask us to suspend processing temporarily.
• Right to portability: to receive your data in a structured format so you can transfer it to another controller.
• Right to object: to object to processing based on our legitimate interests, or to direct marketing.
• Right to withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing carried out before the withdrawal.

To exercise any of these rights, contact us at the email address given at the end of this document. We will respond within 30 days at the latest.

You also have the right to lodge a complaint, free of charge, with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) (dataprotection.ro), without prejudice to your right to go directly to the courts.

Our platform is hosted on servers located in the European Economic Area. Where we use service providers outside the EEA (for example Stripe, for payment processing, which may involve transfers to the USA), we ensure the transfer takes place strictly under appropriate safeguards recognised by the European Commission — Standard Contractual Clauses (SCCs) or, where applicable, the provider's participation in the EU–US Data Privacy Framework.

We may update this document from time to time to reflect changes to the platform or to legal requirements. Each published version carries a version number and an effective date, shown at the top of this document. Any major update will be notified to your email address or through a visible notice when you sign in to the platform.

• Legal name: [to be completed]
• Email (support and GDPR requests): [to be completed]
• Postal address: [to be completed]