Privacy Policy

Scope and responsible parties

This policy applies to the-invitation.ch, customer registration, the Event Studio, design demos and event websites created using The Invitation, insofar as 2impress GmbH is responsible for the relevant processing.

2impress GmbH is the controller for platform accounts, orders, invoices, operation, security and support. For guest data entered in an RSVP form, the respective event organiser normally determines the purpose and use. The Invitation provides the technical service and generally processes such data on the organiser’s behalf, unless independent legal obligations apply.

Platform operator: 2impress GmbH, Talacher 36, 8627 Grüningen, Switzerland. Email: hallo@evanu.ch. The Invitation is a product of EVANU.

Personal data we process

Depending on how you use the service, the following information may be processed:

• Customers: email address, account status, selected language, protected login credentials, email verification records and security-related information.
• Event websites: text, images, logos, dates, venues, programmes, designs, settings and communication templates provided by the organiser.
• RSVP guests: name, email address, acceptance or decline, number of attendees, submission time and a derived security value for preventing abuse.
• Orders and invoices: name or company, billing address, country, selected plan, amounts, invoice number, due date and payment status.
• Contact and security: messages and support enquiries, together with necessary technical access information such as IP address, timestamps, browser details and error logs.

Purposes and legal grounds

We process data to provide customer accounts and event websites, manage invitations and responses, issue invoices, respond to enquiries, prevent misuse and comply with legal obligations.

Where the EU General Data Protection Regulation applies, the applicable legal grounds may include performance of a contract or pre-contractual steps (Article 6(1)(b) GDPR), compliance with legal obligations (point (c)), legitimate interests in security and enforcement of rights (point (f)) and consent where required (point (a)). The Swiss Federal Act on Data Protection applies to the extent provided by law.

Events, guest registrations and organisers

Customers can customise event websites with their own content and branding. They remain responsible for the lawfulness of what they publish and for their use of guest lists. The organiser decides why guests are invited, contacted or included in reports.

An RSVP only collects the details needed to record acceptance or decline. Authorised organisers can access the responses in the protected Studio, amend entries and export guest lists as CSV or PDF. Any exports stored outside the platform remain the organiser’s responsibility.

No separate mandatory privacy checkbox is used for an ordinary RSVP. Privacy information must nevertheless be readily available. Organisers must provide additional information and, where required, obtain separate consent for purposes such as marketing.

Accounts, access and email communications

To create an account, we require in particular an email address and password. Registration requires confirmation of this privacy policy. The email address is verified, and additional security codes may be sent by email when signing in.

We send service-related account, verification, security and billing messages. Organisers can edit, send or test event email templates using the functions provided. The Invitation does not independently use RSVP guest lists for its own marketing.

Essential cookies and technical logs

Cookies or similar storage mechanisms may be necessary for login, sessions, language preferences, form protection and security. Their purpose is to provide the functions requested by users.

When the website is accessed, necessary connection and log data are generated to operate the service, diagnose errors and protect against improper use.

If additional analytics or marketing technologies are introduced on particular pages in future, they must be disclosed separately and, where legally required, enabled only after consent.

Hosting and service providers

We use infrastructure services from hosttech, among others. Other selected providers may assist with email delivery, backups, maintenance and invoice-based payment administration. They receive only the data necessary for their respective tasks.

An event website may contain links to third-party services, for example directions, or images from external sources. Accessing those services may transmit technical information to their operators, whose own privacy notices then apply.

International data transfers

Data are processed using the infrastructure selected for the platform. Depending on the email, support or external content services actually used, processing may also take place in Switzerland or in the EU/EEA. Opening external services may involve other countries, including the United States.

Where we are responsible for an international transfer, we comply with the applicable requirements. If a country does not provide a legally recognised adequate level of protection, we use appropriate safeguards where required, such as recognised standard contractual clauses and supplementary measures, or rely on a lawful exception. Information about specific transfers may be requested using the contact details below.

Retention and deletion

We retain personal data only as long as necessary for the relevant purpose, contractual obligations, security or mandatory legal retention.

RSVP records: The platform includes scheduled cleanup of completed events, generally no earlier than around 180 days after the relevant event date. Permanently deleting an event removes its associated RSVP entries from the platform. Copies previously exported by an organiser are not affected.

Accounts and event content: Generally for the period of use until legitimate deletion, subject to security and evidence requirements. Business and accounting records: Generally ten years where required by Swiss law.

Backups and essential technical logs may be removed later as part of their normal retention cycles.

Data security

We use reasonable technical and organisational measures, including encrypted transfer, access controls, separate permissions, safeguards against abusive requests and backups. No internet service can offer absolute security.

Customers should use strong passwords, keep credentials confidential, restrict access to authorised persons and adequately protect guest lists after export.

Your rights

Subject to applicable law, you may request access to your personal data, correction, disclosure or portability, and deletion. Where processing is based on consent, consent may generally be withdrawn for the future. Additional rights, such as restriction of processing or objection, may apply under the GDPR.

For enquiries concerning your The Invitation account, please contact us. For information in an event guest list, the relevant organiser is normally the first point of contact. We assist with valid requests within our respective responsibilities and legal obligations.

You may also contact the competent data protection supervisory authority, including the Swiss Federal Data Protection and Information Commissioner (FDPIC) where it has jurisdiction.

Updates to this notice

We may update this notice if features, processing activities or legal requirements change. The current version published here applies. Where required, we will communicate material changes by appropriate means.