How data is processed in this project

Data protection roles

• Arely y Jorge Oscar acts as controller for guest and RSVP data related to the event.
• Maped Solutions processes that data on behalf of the controller to host, protect, and operate the platform.
• Maped Solutions acts as an independent controller for authentication, security, technical logs, abuse prevention, and infrastructure operation.

Invitation and RSVP data

• Invited group name.
• Assigned guest count.
• RSVP status.
• Confirmed attendance count.
• Declined attendance count.
• Invitation link, public reference, and technical access identifier.
• Optional guest message and dietary-note fields are not currently enabled.

Purposes and legal basis

Guest data is used to manage invitations, display the invitation linked to the received link, and collect RSVP responses for event organization.

The event controller will normally rely on Art. 6(1)(f) GDPR, to the extent the processing is necessary for organizing the event of Arely y Jorge Oscar.

Where Maped Solutions processes that data on behalf of the controller, this takes place under the corresponding data processing arrangement.

Private access and security data

• Email address.
• Password credentials stored in protected form, where applicable.
• Authentication and session identifiers.
• Access role and status.
• IP address.
• Timestamps.
• Browser and device metadata.
• Request logs.
• Security event logs.
• Technical session and CSRF security data.

Legal basis of the technical operator

• Art. 6(1)(b) GDPR to provide the requested private access to the couple.
• Art. 6(1)(f) GDPR for security, abuse prevention, service continuity, and infrastructure protection.

Technical providers

• Frontend hosting: Vercel
• Backend hosting: Render
• Database: MongoDB Atlas
• File storage: Cloudflare R2
• Transactional email: SendGrid

International transfers and providers

Some technical providers may be located outside the EU/EEA or may belong to groups established outside the EU/EEA.

Where required, appropriate safeguards are used.

No marketing use

Guest and RSVP data are not used for advertising, sale of data, or unrelated marketing communications.

Retention

• Invitations and RSVPs: Until event closure plus configured retention window.
• Private accounts: While private access remains active.
• Technical and security logs: For the configured technical security retention window.
• Residual backups: Until backup rotation expires.

Deletion requests

There is currently no self-service deletion function in the private panel.

Deletion of event data, invitations, RSVPs, or private access profiles may be requested through the contact channels listed here.

Rights and contact

Data subjects may request access, rectification, erasure, restriction, and objection, and may also lodge a complaint with a data protection supervisory authority.

Requests relating to guest and RSVP data should primarily be directed to Arely y Jorge Oscar.

Requests relating to authentication, security, or technical operation may be directed to the technical operator.

Technical operator contact: contact@mapedsolutions.com

Event controller contact: jorgeamaroh@gmail.com