Data processing and GDPR

For the personal data of your guests and contacts that you collect through RSViP Online, you are the controller and we are the processor. For your own account and billing data, we act as an independent controller, as described in our privacy policy.

• Subject matter and purpose: providing the scheduling service, which means taking and managing bookings, syncing calendars, creating meeting links and sending booking emails.
• Duration: for as long as your account exists, and until deletion as described below.
• Data subjects: your guests and the people who book with you or are invited to meetings.
• Types of data: names, email addresses, booking times, time zones, notes entered by guests, and the calendar information needed to show your availability.

• We process personal data only on your documented instructions, which are the use of the service and these terms, unless the law requires otherwise. We will tell you if we think an instruction breaks the law.
• Everyone who has access to the data is bound by confidentiality.
• We apply appropriate technical and organisational security measures: encryption of connection credentials at rest, HTTPS for all traffic, access limited to those who need it, and regular software updates.
• We help you answer requests from guests who exercise their rights (access, correction, deletion and similar), and we help with your obligations on security, breach notification and data protection impact assessments, as far as is reasonable given the nature of the processing.
• We tell you without undue delay after we become aware of a personal data breach that affects your data.

You give us general authorisation to use sub-processors to run the service. They are the infrastructure and hosting providers that run RSViP Online and deliver its email, and the services you choose to connect, which act at your instruction. Our infrastructure can be located in different regions of the world. We bind sub-processors to data protection obligations that are no less protective than these. If we add or replace an infrastructure sub-processor that handles your guests’ data, we will tell you in advance, and you may object on reasonable data protection grounds.

Stripe, which processes subscription payments, acts as an independent controller of payment data.

If processing involves a transfer of personal data outside the European Economic Area to a country without an adequacy decision, we ensure an appropriate safeguard is in place, such as the European Commission’s standard contractual clauses.

You can delete your data, or your whole account, at any time from your account; if you need a copy of your data first, write to privacy@rsviponline.com. When your account is deleted, we delete the personal data we process for you, except where the law requires us to keep it. Backups are overwritten within 30 days.

On reasonable written request, we will give you the information needed to show that we meet these terms, and we will allow and contribute to reasonable audits, no more than once a year unless a breach or a supervisory authority requires otherwise, at your cost and with reasonable notice.

You are responsible for having a lawful basis to collect your guests’ data, for telling guests how you use it, and for the instructions you give us. Do not use the service to process special categories of data unless you have a lawful basis and appropriate safeguards.

Questions about data processing: privacy@rsviponline.com.