Privacy Policy

PartyLists (“we”, “our”, “us”) provides party invitations, guest lists, RSVPs and planning tools at partylists.co.uk. We handle personal data under the UK GDPR and Data Protection Act 2018.

Data contact: data@partylists.co.uk

1. The information we handle

Account holders

• Name, email address, password hash and optional phone, profile and address details.
• Party and planning information, collaborator access and account activity.
• Optional marketing choice and its timestamp.
• Limited campaign attribution such as UTM source, campaign or referral code.

Invited guests and families

• Guest or child name, responding adult or carer name, contact details and private invitation token.
• RSVP, sibling or additional-guest numbers, dietary/allergy information, accessibility requirements and answers the host asks for.
• Invitation opens and communication delivery status.

Technical and payment information

• IP address, browser/device details, security and audit events, and consented analytics interactions.
• Purchase status, amount, currency, promotion and Stripe identifiers. PartyLists does not store full card details.

2. Why we use it

• To create accounts, invitations, guest lists, replies, reminders, updates and exports.
• To deliver and secure the service, prevent abuse, troubleshoot and provide support.
• To process Plus purchases and keep financial records.
• To understand and improve PartyLists when analytics consent has been given.
• To send birthday ideas and offers only when the account holder has separately opted in.
• To meet legal and regulatory duties.

3. Legal bases

Depending on the activity, we rely on performance of our contract with an account holder, our legitimate interests in operating and securing PartyLists, legal obligations, or consent for optional marketing and non-essential analytics. Consent can be withdrawn without affecting earlier lawful processing.

4. Hosts, guests and children

PartyLists is marketed to adult parents, carers and organisers. Children do not need accounts and are not asked to buy anything. A host decides whom to invite and what RSVP questions are necessary, and must use guest information fairly and only for organising the party.

Collect the minimum information needed. Avoid entering medical detail beyond practical dietary, allergy or accessibility instructions the host needs. If a school, club or other organisation uses PartyLists, it remains responsible for its own lawful basis, notices and permissions; our contractual data-protection role may also be set out in its agreement with us.

5. Who receives data

We do not sell personal data. We use service providers only where needed, which may include hosting/storage, email and SMS delivery, Stripe payments, error/security tooling and consented analytics. PartyLists currently supports Matomo, OpenPanel and Meta measurement only after analytics consent. Guest contact details from invitation/RSVP pages must not be uploaded to advertising audiences.

We may disclose information where the law requires it, to protect users and the service, or during a properly managed business transaction. Providers must be covered by suitable data-protection terms.

6. Retention and deletion

• Guest details: the host chooses 30, 60 or 90 days after the party; 60 is the default. At that point we remove the dedicated birthday-child first name, communication copies and RSVP answers, and anonymise guest names, contact details, invite tokens, dietary/accessibility notes and invite-view records. Anonymous RSVP/headcount totals may remain.
• Account and party data: kept while the account is active or until deleted, subject to backups, disputes and legal requirements.
• Purchases: retained for applicable accounting, tax, fraud and legal periods.
• Security/audit records: kept only for a proportionate security and accountability period.
• Backups: expire on a controlled cycle. Deleted information may remain briefly in restricted backups and is not restored into live use except for disaster recovery.

7. Your choices and rights

Account holders can correct profile data, change optional marketing preferences and download a portable JSON export. Depending on the circumstances, individuals may ask us to access, correct, erase, restrict or transfer their data, or object to processing. Contact data@partylists.co.uk. We may need to verify the request and coordinate with the party host where they control the guest record.

You can complain to the Information Commissioner’s Office.

8. Security and international transfers

We use proportionate safeguards including access controls, password hashing, encrypted network connections, rate limits, audit records, signed payment verification and restricted operational access. No internet service can promise absolute security.

If a provider processes data outside the UK, we use an applicable adequacy decision or contractual and supplementary safeguards as required.

9. Cookies and analytics

Essential storage supports login, security and preferences. Analytics and advertising measurement load only after consent. See the Cookie Policy or use the cookie controls to change your choice.

10. Changes and contact

We may update this policy as the product or law changes and will highlight significant changes where appropriate. Questions and rights requests can be sent to data@partylists.co.uk.