Who is responsible
LuxVibeWeb Limited runs RSVP Events. Full company details are at the bottom of this page. For anything about your information, email gareth@luxvibeweb.co.uk.
Who counts as the “controller” depends on why the event is being held.
- A personal event: a wedding, a birthday or a dinner. Organising your own social life falls outside data protection law for you as an individual, so we are the controller for everything in the service.
- An event for a business, employer or organisation: a work social, a client evening, a charity fundraiser. There the organisation is the controller and we act as its processor, handling guest details on its instructions. The terms of use set out that arrangement.
Either way we are the controller in our own right for accounts, the abuse-prevention records described below, and messages sent to us through the contact form.
If you are a guest, not an organiser
You never signed up to anything. Someone sent you a link, you filled in a form, and now you are here. This section is the part that matters to you.
- Your organiser can see everything you submitted: your name, whether you are coming, how many people you are bringing and their names, any note you wrote, and every answer you gave including dietary requirements. They can also edit or delete it.
- Other guests normally see nothing. The one exception is if your organiser switched on a “who's coming” list, in which case your first name only appears to anyone who opens that invitation, never your answers, your email address, your phone number, or the fact that you declined.
- You can remove your details yourself, without asking the organiser. Open the invitation, choose Change my reply, then Remove my details. That deletes your reply and everything in it, straight away.
- Lost the link? Use Find your reply on the invitation and we will email it to the address you replied with. If you did not leave an email address, ask your organiser, or email us and we will do it.
- Your organiser chose the questions, not us. If a question felt intrusive, that is worth taking up with them. You can leave any optional field blank and still reply.
If you were emailed but never replied
You can get an email from us without ever having used this site. An organiser can type a list of names and email addresses into their event and send a nudge to whoever has not answered. If that is how you got here, then all we hold about you is the name and email address they typed, sitting inside their event. You have no reply, no account and nothing you can log in to.
- To stop the emails, ask the organiser to take you off their list, or email us at gareth@luxvibeweb.co.uk and we will remove your details from that event ourselves. You do not have to go through them.
- We will not ask you to justify it. This is your right to object under Article 21, and for this kind of email there is nothing to weigh up. You are removed.
- We did not get your address from anywhere else. We do not buy lists, and we never email you about anything other than the event you were invited to.
If your organiser is running the event for a business, they decide what happens to your details and you can also exercise your rights against them directly. We will help either way rather than sending you round in a circle.
What is collected, and from whom
| Information | Who provides it | Required? |
|---|---|---|
| Event title, date, time, time zone, location, notes | The organiser | Title and date only |
| Organiser's name and email address | The organiser | Optional |
| A cover photo, if uploaded | The organiser (a photo may show people) | Optional |
| An invitation password | The organiser | Optional |
| A list of people invited: names and email addresses | The organiser, about other people | Optional |
| Your name and whether you are coming | You, the guest | Required to reply |
| How many people you are bringing, and their names | You | Only if asked |
| Your email address and phone number | You | Only if asked |
| Dietary requirements and meal choice | You | Only if asked, always optional |
| Children coming, and their ages | You, about a child | Only if asked |
| A partner's or family members' names | You, about other people | Only if asked |
| A note to the organiser, a song request, a question | You | Optional |
| A record of requests made from your IP address | Created automatically | Automatic |
| Aggregate counts of page views and key steps, with no identifier | Created automatically | Automatic |
| Account email, if you create an account | The organiser | Optional. Accounts are not required |
A guest can also be entered by the organiser rather than replying themselves, when somebody phones or texts instead of using the link. Those entries are marked as added by the organiser.
Why, and on what legal basis
| Purpose | Lawful basis | Detail |
|---|---|---|
| Creating and showing an invitation, and collecting replies | Contract (Article 6(1)(b)) | Performing the service the organiser and the guest each asked for. |
| Emailing an organiser their dashboard link, and telling them about replies | Contract (Article 6(1)(b)) | It is the service they asked for; without it they lose access to their own event. |
| Emailing a guest a confirmation and their private link to amend their reply | Contract (Article 6(1)(b)) | It is how a guest keeps control of what they submitted. |
| Reminders before the event, and an organiser's messages to guests | Legitimate interests (Article 6(1)(f)) | Our interest, and the organiser's, in guests arriving at the right place at the right time, and in the organiser being able to tell guests about a change of plan. Never marketing. Any guest can ask to be removed and the emails stop. |
| Showing a first-name guest list, where the organiser switched it on | Legitimate interests (Article 6(1)(f)) | Our interest in people feeling able to commit to an event when they can see who else is going. Limited to first names, only for people who said yes, and off unless the organiser turns it on. |
| Rate limiting, and keeping access tokens unguessable | Legitimate interests (Article 6(1)(f)) | Our interest in the service not being used to send unsolicited email, and in one organiser's guest list not being reachable by another. |
| Counting page views and key steps, in aggregate | Legitimate interests (Article 6(1)(f)) | Our interest in knowing whether people find the service and get through it, so we can improve it. Totals only, nothing stored on your device and no identifier. A Global Privacy Control or Do Not Track signal switches it off. |
| Answering a message you send us through the contact form | Legitimate interests (Article 6(1)(f)) | Our interest in replying to the person who wrote to us. |
| Dietary requirements, allergies, and choices that reveal religious belief | Explicit consent (Article 9(2)(a)), on top of Article 6(1)(b) | Only collected where an organiser asks, only where you choose to answer, and used for nothing but telling that organiser. Leave it blank and nothing is stored. |
Dietary requirements, allergies and religious diets
This deserves its own section because it is the most sensitive thing the service touches.
Where an organiser asks about food, the answers can include allergies, which is health information, and options such as halal or kosher, which reveal religious belief. Both are “special category” data under UK data protection law and need a stronger justification than ordinary details.
We rely on your explicit consent under Article 9(2)(a). In practice that means:
- the field is always optional, and leaving it blank stores nothing;
- it is only shown when your organiser chose to ask;
- the answer goes to that organiser and to nobody else: never to other guests, never into the “who's coming” list, never used to profile you;
- you can withdraw it at any time by editing or removing your reply, though that cannot un-tell an organiser who has already read it.
If you would rather tell your organiser about an allergy privately, do that instead and leave the field empty. The service works perfectly well without it.
Children
An organiser can ask how many children are coming and, if they turn it on, their ages. Names of people in your party can also be children's names. That information is entered by the adult replying, is only visible to the organiser, and is deleted with the rest of the reply.
You need to be at least 16 to organise an event. There is no age limit on replying to one, because an invitation is often answered on a child's behalf by a parent. If you believe a child has given us more than you are comfortable with, email us and we will remove it.
Who else receives it
| Service | What it does | What it can see | Where |
|---|---|---|---|
| Base44 (a Wix company) | Hosting, database, sign-in, uploaded files, image delivery and the AI cover-image generator | Everything stored in the service: event details, guest names and replies, answers including dietary requirements, uploaded cover photos, email addresses and access tokens | United States (Base44's default hosting region); the company is based in Israel |
| Resend | Sending every email the service sends | Recipient email addresses and the full content of each email, which includes names, event details and, in confirmation emails, a private link to that guest's reply | United States |
| Microsoft (Outlook) | Receiving the operator's own notification when a new event is created | The event title, date, location, the organiser's email address and the organiser's private dashboard link | United States and European Union |
Two of these are worth spelling out. Base44 hosts the whole service, so everything stored passes through them. Resend sends every email, so it sees the contents, including, in a guest's confirmation, the private link that lets that reply be edited.
We do not sell your information, we do not share it for anyone else's marketing, and no organiser can see another organiser's guest list.
What we deliberately do not use
- No third-party analytics: no Google Analytics and no outside analytics service. The platform SDK ships its own usage tracking and we have turned it off. We keep our own aggregate counts of page views and key steps, with nothing stored on your device and no identifier
- No advertising, ad networks or ad pixels
- No error-tracking or session-recording tools
- No tag manager
- No payment processor: the service takes no payments and asks for no card details
- No profiling and no automated decision-making about you
Information leaving the UK
Some of the services above operate outside the UK, so your details travel with them:
- Base44 (a Wix company), United States (Base44's default hosting region); the company is based in Israel. Requires Base44's Data Processing Addendum with the Standard Contractual Clauses and UK Addendum, or another UK transfer mechanism. Confirm first-hand which the DPA provides.
- Resend, United States. Requires the UK International Data Transfer Addendum, or reliance on the UK–US Data Bridge if Resend is certified. Confirm which applies before relying on it.
- Microsoft (Outlook), United States and European Union. Standard Microsoft terms. Confirm the transfer mechanism.
We have said “verify” where the safeguard needs confirming against the supplier's current terms rather than assumed. We would rather write that than claim a protection we have not checked.
How long it is kept
| What | How long | Detail |
|---|---|---|
| An event and its replies | Until deleted | Kept until the organiser deletes the event, or you remove your own reply. There is no automatic deletion after the event date. Deleting an event removes every reply to it at the same time. |
| Your own reply | Until deleted | You can delete it yourself at any time from your invitation, or ask the organiser or us to do it. Deletion is immediate and permanent. |
| Account details, if you created an account | Until you ask us to close it | Sign-in is handled by Base44. Ask us and we will delete the account and unlink your events. |
| Rate-limiting records | 24 hours | To stop abuse, the service counts requests against a key derived from your IP address. Records older than 24 hours are deleted by a weekly cleanup job, so the longest one survives is about eight days. |
| Aggregate usage counts | Until deleted | Each count records only which page or step it was (with the private part of any link removed), a rough device type and, where there is one, the name of the site that linked here. No name, email, IP address, identifier or event link is stored, so a count cannot be traced back to you. |
| Sent emails | Set by Resend | Delivery logs are held by our email provider under their own retention schedule. We do not keep a separate copy of the emails we send. |
There is no automatic deletion after an event has passed. We would rather tell you that than promise a schedule the software does not keep.
Your rights
- Access. Ask for a copy of what we hold about you.
- Rectification. Have anything wrong corrected. You can also edit your own reply directly.
- Erasure. Have it deleted. From your invitation, use “Remove my details”. That is immediate.
- Restriction. Ask us to stop using it while a complaint or correction is dealt with.
- Objection. Object to anything we do on the basis of legitimate interests, including reminders.
- Portability. Ask for what you gave us in a machine-readable file.
- Withdrawing consent. Where you gave dietary or allergy information, withdraw it at any time by editing or removing your reply. Withdrawing does not undo what was already shared with your organiser.
Email gareth@luxvibeweb.co.uk and we will answer within one month. It is free. We may ask something to confirm which reply is yours, usually the email address you used, so we do not hand your details to somebody else.
Complaining
Tell us first if you can, so we have a chance to fix it. You can also complain to the Information Commissioner's Office at any time, and you do not need our permission:
- Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
- Helpline 0303 123 1113
- ico.org.uk/make-a-complaint
How it is protected, honestly
What is true:
- The site and every connection to it use HTTPS.
- No page in your browser reads the events or replies database directly. Every request goes through a server function that checks first whether the caller is entitled to it.
- Guest details are not readable through the general data interface. That route is closed to everyone but the service itself.
- A dashboard link and a guest's reply link are long random tokens, not guessable ids.
- Requests are rate-limited so the service cannot be used to send unsolicited email.
- Invitations are excluded from search engines.
What is not true, so you can judge for yourself:
- An invitation password is stored as ordinary text, not scrambled. Treat it as a doorkeeper, not a secret. Do not reuse a password you use anywhere else.
- Anyone holding a dashboard link can manage that event, including seeing the full guest list. There is no second check. Organisers are told to keep it private.
- We hold no security certification and have had no external audit. We are a small operation and will not pretend otherwise.
Changes
If this notice changes in a way that affects you, the date at the top changes with it. This version is dated below.
Company details
LuxVibeWeb Limited, Private limited company, limited by shares, registered in England and Wales, company number 16954810.
Registered office: 12 Beech Road, Epsom, Surrey, KT17 4NH, United Kingdom
Registered with the Information Commissioner's Office, reference ZC211919.
Trading as RSVP Events at rsvp-events.uk. Contact gareth@luxvibeweb.co.uk.