Trust & Compliance

Privacy & Data Transparency

Protecting personal privacy, celebration records, and attendee trust under UK GDPR and the Data Protection Act 2018.

Last updated: 28 October 2026 • Regulatory Authority: Information Commissioner’s Office (ICO), UK

1. About Us 2. Controller vs Processor 3. Information Collected 4. Lawful Bases 5. Sub-Processors 6. Retention & Purge 7. Your Statutory Rights 8. Security Safeguards 9. Child Safeguarding 10. ICO Escalation

1. About Us & Our Data Protection Commitment

At Party Platform (operated by Party Platform, registered in England and Wales), data privacy is not a passive legal disclaimer; it is an engineered foundation of our celebration management software. We process personal data in strict compliance with the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018 (“DPA 2018”).

2. Dual Regulatory Architecture: Data Controller vs Data Processor

Under UK data protection law, the legal classification of Party Platform depends on the category of data and the specific processing context:

Platform as Controller

Organiser & Account Data

We act as an independent Data Controller for account credentials, subscription invoices, payment records, direct support tickets, and telemetry logs generated by registered Event Organisers and website visitors.

Platform as Processor

Attendee & Guest Data

When an Event Organiser creates an event and imports a guest list, sends invitations, collects RSVPs, gathers dietary requirements, or receives gallery photos, the Organiser acts as the Data Controller. Party Platform processes this information strictly as a Data Processor in accordance with our Data Processing Addendum (DPA).

3. Personal Data We Collect & Process

We collect and process the following categories of personal data:

Full name, commercial organisation name, email address, telephone number, encrypted password hash, two-factor authentication (2FA) secrets, and billing metadata (processed via Stripe; we do not store raw payment card numbers).

Guest names, mobile numbers (for SMS invitations), email addresses, unique 8-character RSVP tokens, attendance statuses (Attending, Declined, Tentative), plus-one guest counts, table seating allocations, and check-in timestamps.

Dietary specifications submitted by attendees during RSVP (e.g., severe anaphylactic food allergies, Halal, Kosher, vegetarian, or gluten-free preferences). These constitute Special Category Data under UK GDPR Article 9 because they may reveal religious beliefs or health status. They are processed solely to facilitate event catering safety under the explicit direction of the host.

Photographs, video snippets, and celebration comments uploaded by hosts or invited guests to the shared event gallery, along with associated upload timestamps and EXIF metadata.

Internet Protocol (IP) addresses, browser user-agent strings, device screen dimensions, session identifiers, rate-limiting telemetry, and security audit logs utilised for brute-force defence and anti-fraud verification.

4. Lawful Bases for Processing (UK GDPR Articles 6 & 9)

Processing Activity	Data Categories	Lawful Basis under UK GDPR
Account administration & subscription provisioning	Organiser name, email, billing profile	Article 6(1)(b) – Performance of Contract: Necessary to provide access to Party Platform.
Guest invitation delivery & RSVP collection	Attendee name, phone, email, RSVP status	Article 6(1)(f) – Legitimate Interests: Fulfilling the Organiser’s instruction to coordinate event attendance.
Dietary & allergen catering coordination	Allergies, religious dietary needs (Halal/Kosher)	Article 9(2)(a) – Explicit Consent: Provided voluntarily by the attendee during the RSVP workflow for hospitality safety.
Two-factor authentication & cyber defence	IP addresses, 2FA tokens, login timestamps	Article 6(1)(c) – Legal Obligation: Ensuring appropriate security of personal data under Article 32 UK GDPR.
Platform analytics & performance tuning	Aggregated interaction telemetry, cookie tags	Article 6(1)(a) – Consent: Captured via our Cookie Preference Centre in compliance with PECR Regulation 6.

5. Authorised Third-Party Sub-Processors

We engage vetted infrastructure partners who operate under strict contractual Data Processing Agreements conforming to UK GDPR Article 28:

Sub-Processor	Nature of Processing	Location	Transfer Safeguards
Stripe Payments Europe Ltd	Payment processing & merchant underwriting	Ireland / UK / USA	UK International Data Transfer Addendum & PCI-DSS Level 1
Twilio Inc.	SMS invitation and 2FA token dispatch	United States / EU	Standard Contractual Clauses & Binding Corporate Rules
SendGrid / Postmark	Transactional email invitation delivery	United States / EU	UK Approved International Data Transfer Agreement (IDTA)
Amazon Web Services (AWS)	Cloud hosting, database vaults & media storage	London (eu-west-2), UK	Data kept within UK sovereign boundaries; ISO 27001

6. Data Retention & Automated Purge Schedules

We adhere to the UK GDPR principle of storage limitation. We retain personal data only for as long as necessary to fulfill the purposes of the event:

Guest Registries & RSVPs: Retained for the duration of the active event plus ninety (90) days following the conclusion of the event, after which organisers can archive or permanently delete the records.
Event Photo Galleries: Stored until the Organiser closes the gallery or deletes the celebration space. Attendees may request individual removal at any time.
Special Category Dietary Records: Permanently purged automatically thirty (30) days following event completion.
Security & Audit Logs: Maintained for twelve (12) months for intrusion detection and forensic accountability, then truncated.
Financial Invoices: Retained for seven (7) years to comply with statutory UK tax and accounting requirements (HMRC).

7. Your Statutory Data Subject Rights

Under Chapter III of the UK GDPR, you have the following enforceable statutory rights:

Right of Access (SAR)

Request a complete copy of the personal data we hold about you free of charge.

Right to Erasure (“Right to be Forgotten”)

Request permanent deletion of your RSVP records, guest contact info, or gallery photographs.

Right to Rectification

Correct inaccurate or incomplete contact numbers, email spellings, or dietary preferences.

Right to Data Portability

Obtain your attendee data in a structured, commonly used, and machine-readable format (JSON/CSV).

To exercise any of these rights, submit a written Subject Access Request to our Data Protection Officer at general@mypartyplatform.com. We respond within one calendar month in accordance with statutory requirements.

8. Technical & Organisational Security Safeguards

We enforce modern cryptographic and access control defences under Article 32 UK GDPR:

Transport Encryption: All traffic across Party Platform is enforced via TLS 1.3 with strict HTTP Strict Transport Security (HSTS).
Storage Encryption: Database volumes and private object stores are encrypted at rest using AES-256 keys.
Session & Token Armor: Session cookies utilise `SameSite=Lax`, `HttpOnly`, and `Secure` attributes. All state mutations enforce cryptographically verified CSRF tokens.
Access Controls: Principle of least privilege enforced internally with audit trails logged for administrative actions.

9. Children & Minor Privacy Safeguards

Our management service is not directed at children under the age of 13. When celebrations involve child attendees, all information must be provided by or with the explicit consent of the child’s parent or legal guardian. If we learn that personal data of a minor has been collected without verifiable parental consent, we take immediate steps to expunge such data from our databases.

10. Supervisory Authority & Right to Lodge a Complaint

If you have an unresolved concern regarding our processing of your personal data, you have the statutory right under Article 77 UK GDPR to lodge a formal complaint with the UK supervisory authority:

Information Commissioner’s Office (ICO)

Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Helpline: 0303 123 1113 • Website: https://ico.org.uk

Data Protection Officer & Privacy Enquiries

For questions regarding this policy, Data Subject Access Requests (SARs), or Data Processing Agreements:

Contact Privacy Lead: general@mypartyplatform.com