Privacy notice

Who is responsible for your data

RSVPPlus is an invitation and RSVP service used by government departments and other organisations to run their events. The organisation that invited you decides who is on its guest list and what it asks you. It is responsible for your data, and RSVPPlus processes that data on its behalf and on its instructions.

Every invitation names the organisation it was sent for. If you are unsure an invitation is genuine, enter the reference printed at the foot of the email at /verify — you do not need to open the invitation link to check it.

What we hold

Details the inviting organisation provides: your name, salutation, title or position, organisation, email address and, where given, telephone number.

Details you give when you respond: whether you will attend, the names of any guests you bring, meal, dietary or accessibility requirements, and answers to any questions the organisation adds to its invitation.

Details recorded as the event runs: whether invitation emails were delivered and when they were opened, when your invitation link was opened together with the network address and browser type that opened it, your confirmation code, any seat you are assigned and the time you checked in.

Invitation and reminder emails contain a small image that tells the organising staff when the email was first opened. It is recorded only if your mail app loads images, and it is used only to follow up with guests who have not seen their invitation.

Email addresses and telephone numbers are encrypted by the application before they are stored.

How it is used

Only to run the event you were invited to: sending your invitation, reminders and confirmation, arranging seating, issuing parking passes and checking you in on the day. Your data is not sold, not used for advertising and not shared between organisations.

Invitation and RSVP pages set no cookies and use no analytics or tracking scripts. Staff who sign in to manage events receive a session cookie for that purpose only.

Who processes it

Staff of the organisation that invited you, limited to the events they manage.

Service providers that run the platform: Vercel (hosting), Supabase (database), Resend (email delivery) and Upstash (rate limiting, which briefly holds network addresses). Where the organisation uses them: Twilio or WhatsApp (text messages) and Stripe (ticket payments — card details are entered on Stripe and never reach RSVPPlus).

Venue maps are loaded from OpenStreetMap or Google Maps. The map provider sees your network address, as with any web request, but not your invitation link, your name or the guest list.

How long it is kept

Guest records are kept while the inviting organisation needs them for the event and its follow-up. Events are archived six months after they end. The organisation can delete a guest record at any time, and will do so on request where it has no other obligation to keep it.

Your choices

You can change your response at any time from your invitation link until the organisation closes responses.

Invitation emails carry an unsubscribe option, shown by most mail apps beside the sender, that stops further emails about that event.

To stop opens being recorded, turn off automatic image loading in your mail app. Your invitation and RSVP link work the same either way.

To see, correct or remove what is held about you, contact the organisation that invited you — reply to its invitation email. If you cannot reach it, write to replies@rsvpplus.net and we will pass your request on and confirm when it has been handled.