Last Updated Sept. 10, 2023
Welcome to RSVP.link and our website at www.rsvp.link. At RSVP.link, we respect your privacy and are committed to being transparent about what data we collect when you visit and use our website and/or our services and how it is used.
If you are a Citizen of the European Union or the United Kingdom, please also refer to our GDPR Compliance Statement for supplemental information and our Data Processing Addendum.
a) What is Personal Data?
Personal Data is any information relating to personal or material circumstances that relates to an identified or identifiable individual. This includes, for example, your name, date of birth, e-mail address, postal address, or telephone number as well as online identifiers such as your IP address. In contrast, information of a general nature that cannot be used to determine your identity is not Personal Data. This includes, for example, the number of users of a website.
b) What is Special Category Data?
Special category data is Personal Data that needs more protection because it is sensitive. This includes Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data. As well as, data concerning health, a person’s sex life; and a person’s sexual orientation. In order to lawfully process Special Category Data, it is necessary to explicitly consent to the processing.
c) What is processing?
"Processing" means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means. The term is broad and covers virtually any handling of data.
d) What law applies?
In principle, we will only use your Personal Data in accordance with the applicable data protection laws, in particular Canada's Personal Information Protection and Electronic Documents Act (the “PIPEDA”).
e) Who is responsible for data processing?
The responsible party for data processing is Clever Bytes Inc, registered in Alberta Canada (“RSVP.link”, “we”, “us”, or “our”).
If you have any questions or if you wish to exercise your rights, please contact us using [email protected].
f) What are the legal bases of processing?
We only process your Personal Data if we at least one of the following applies:
a) Log data
Each time you visit our website, our system automatically records the following data from the visiting device and stores it in a so-called log file: i) Name of the retrieved file, ii) date and time of the visit, iii) amount of data transferred, iv) message about successful retrieval, type of browser and version used, v) IP address (identification of the user's device), vi) Operating system of the visiting device, vii) Internet service provider of the visiting device, viii) website from which you access our website, and ix) which of our website pages you are accessing. The legal basis for processing is our legitimate interest.
b) Hosting
To provide our website, we use the services of DigitalOcean Holdings, Inc. who process all data to be processed in connection with the operation of our website on our behalf. The legal basis for the data processing is our legitimate interest in providing our website.
a) General
We may ask you for Personal Data when you:
In order to provide you with a more consistent and personalized user experience in your interactions with RSVP.link, data collected through one source may also be linked to other data collected by RSVP.link through other sources. This may include data that helps us identify you when you access our website through several different devices.
b) Contacting us
In addition to your name, company name, and e-mail address, IP address or telephone number, if provided, we usually collect the context of your message which may also include certain Personal Data. The Personal Data collected when contacting us is to handle your request and the legal basis is both your consent and Contract.
c) When using our services
We process the data of our users (Name, Email address, IP address and the IP address and User Agent from a form responder for spam filtering purposes) in order to be able to provide our contractual services as well as to ensure the security of our services and to be able to develop it further. This includes in particular our support, correspondence with you, invoicing, fulfillment of our accounting and tax obligations. Your data will not be used by us for automated decision making or profiling. Accordingly, the data is processed on the basis of fulfilling our contractual obligations as well as to fulfill our legal obligations.
We ensure that access by our staff members to your data is only available on a need-to-know basis, restricted to specific individuals, and is logged and audited. We communicate our privacy and security guidelines to our staff members and enforce privacy and protection safeguards strictly.
Please note: When using our services, you become the data controller and we become the data processor. Where we process your Personal Data as data processor or in other words on behalf of you, we will process the Personal Data involved in your use of our fully customizable event registration forms and services in accordance with your instructions and shall use it only for the purposes agreed between you and us. For further information please contact us.
d) Administration, financial accounting, office organization, contact management
We process data in the context of administrative tasks as well as organization of our business, and compliance with legal obligations, such as archiving. In this regard, we process the same data that we process in the course of providing our contractual services. The processing bases are our legal obligations and our legitimate interest.
e) Payment Data
If you pay through our website your payment data will be processed via our payment service provider Stripe. Payment data will solely be processed through Stripe and we have no access to any Payment Data you may submit. The legal basis for the provision of a payment system is the establishment and implementation of the user contract for the use of the service.
f) Data management and customer support
For optimal data management and customer support, we may store the data related to your use of our services with us in our proprietary customer relationship management system. This data processing is based on our legitimate interest in providing our customer service.
g) Service Notifications
By using our services, you are giving your consent to receiving notifications and messages per email. Those typically include general, RSVP and content information in relation to your use of our services. Our service notifications are sent using SendGrid by Twilio Inc. and are designed to enhance your experience. You can of course opt out from receiving notifications by following the unsubscribe instructions at the bottom of every notification e-mail sent by us. The legal bases are to provide you with our services and your consent as well as our legitimate interest.
Insofar as you have given us your consent to process your Personal Data for marketing and advertising purposes, we are entitled to contact you for these purposes via the communication channels you have given your consent to.
You may give us your consent in a number of ways including by selecting a box on a form where we seek your permission, or sometimes your consent is implied from your interactions or contractual relationship. Where your consent is implied, it is on the basis that you would have a reasonable expectation of receiving marketing communication based on your interactions or contractual relationship with us.
Our Marketing generally takes the form of e-mail but may also include other less traditional or emerging channels. These forms of contact will be managed by us, or by our contracted service providers. Every directly addressed marketing sent by us or on our behalf will include a means by which you may unsubscribe or opt out.
a) Plausible Analytics
We use the web analytics service “Plausible Analytics” to continuously optimize our offer, both technically and in terms of content. Plausible is a trademark of Plausible Insights OÜ. Plausible takes a particularly privacy-friendly approach to analyzing your visit. For this purpose, Plausible collects the following information, among others: Date and time of your visit, title and URL of the pages visited, incoming links, the country you are in and the user agent of your browser software. Plausible does not use or store “cookies” on your device. All personal data (e.g., your IP address) is stored completely anonymously in the form of a so-called hash. A hash is an encryption of data that cannot be reversed, i.e., cannot be “decrypted”. In this way, we can analyze your visit without storing personal data in a form that would be readable by us, plausible or third parties.
b) Mixpanel
We also use the analytics service Mixpanel, a service of Mixpanel Inc, to help us improve our service, Mixpanel logs page views, user interactions and activity only for logged in users in our Dashboard. You can also stop the analysis of data about your activity with the so-called “opt out cookie”, which you can activate at http://mixpanel.com/optout/. Please note that we, have no influence on the further use of your data by Mixpanel Inc.
a) Storage and Retention
We will retain your Personal Data as necessary in connection with the purposes described in this Privacy Policy, and in accordance with Canada`s retention periods if applicable. In the course of our business operations, your data is generally transferred to our DigitalOcean Holdings, Inc server.
b) Security
Our website uses SSL or TLS encryption to ensure the security of data processing and to protect the transmission of confidential content, such as orders, login data or contact requests that you send to us. We have also implemented numerous security measures (“technical and organizational measures”) for example encryption or need to know access, to ensure the most complete protection of Personal Data processed through this website.
Nevertheless, internet-based data transmissions can always have security gaps, so that absolute protection cannot be guaranteed. And databases or data sets that include Personal Data may be breached inadvertently or through wrongful intrusion. Upon becoming aware of a data breach, we will notify all affected individuals whose Personal Data may have been compromised as expeditiously as possible after which the breach was discovered.
c) Special Category Data
Unless specifically required when using our services and explicit consent is obtained for that service, we do not process special category data.
d) Minors
We do not request Personal Data from minors and children and do not knowingly collect such data or pass it on to third parties.
e) Automated decision-making
Automated decision-making is the process of making a decision by automated means without any human involvement. Automated decision-making does not take place.
f) Do Not Sell
We do not sell your Personal Data.
g) Sharing and Disclosure
We will not disclose or otherwise distribute your Personal Data to third parties unless this is i) necessary for the performance of our services, ii) you have consented to the disclosure, iii) or if we are legally obliged to do so e.g., by court order or if this is necessary to support criminal or legal investigations or other legal investigations or other legal proceedings; or proceedings at home or abroad or to fulfill our legitimate interests, iv) A transfer of assets including data by a sale or acquisition.
h) International Transfer
We may transfer your Personal Data to other companies and/or staff members as necessary for the purposes described in this Privacy Policy. In order to provide adequate protection for your Personal Data when it is transferred, we have contractual arrangements regarding such transfers. We take all reasonable technical and organizational measures to protect the Personal Data we transfer.
Under the PIPA, you have the following rights:
If you have any questions about the nature of the Personal Data we hold about you, or if you wish to exercise any of your rights, please contact us.
a) Updating your information
If you believe that the information we hold about you is inaccurate or that we are no longer entitled to use it and want to request its rectification, deletion, or object to its processing, please do so by contacting us.
b) Withdrawing your consent
You can revoke consents you have given at any time by contacting us. The legality of the data processing carried out until the revocation remains unaffected by the revocation.
c) Access Request
In the event that you wish to make a Data Subject Access Request, you may inform us in writing of the same. We will respond to requests regarding access and correction as soon as reasonably possible. Should we not be able to respond to your request within thirty (30) days after receiving your request, we will inform you in writing within thirty (30) days of the time by which we will be able to respond to your request. If we are unable to provide you with any Personal Data or to make a correction requested by you, we shall generally inform you of the reasons why we are unable to do so (except where we are not required to do so under the respective legal regulations mentioned above).
d) Complaint to a supervisory authority
You have the right to complain about our processing of Personal Data to a supervisory authority responsible for data protection. The Office of the Privacy Commissioner, 30 Victoria Street, Gatineau, Quebec, J8X 0A8, www.priv.gc.ca. However, we would appreciate the opportunity to address your concerns before you contact the Privacy Commissioner.
This Privacy Policy was last updated on Sunday, September 10th, 2023, and is the current and valid version. However, we want to point out that from time to time due to actual or legal changes a revision to this policy may be necessary. If you have any data protection questions, please feel free to contact us.