Privacy policy

This policy explains how we process your personal data in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Spanish Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD).

The owner of CreaTusInvitaciones is a United States company. Because it offers its services to people in Spain, the GDPR applies to it just as it would to a European company (art. 3.2 GDPR), and we comply with it accordingly.

Data controller

• Controller: Syntessa Software LLC, a Limited Liability Company (LLC) organised in the State of New Mexico, United States of America.
• EIN: 30-1512860
• Address: 1209 Mountain Road Pl Ne, Albuquerque, NM 87110, EE. UU.
• Email for privacy matters: hola@creatusinvitaciones.com

What data we process and why

When you write to us

• Data: name, email, phone, date of the event and whatever you tell us in your message (by email or WhatsApp).
• Purpose: to answer your enquiry and, if you ask, to prepare a proposal for you.
• Legal basis: steps taken at your request prior to entering into a contract (art. 6.1.b GDPR) and, if you do not go on to order, our legitimate interest in handling the enquiries we receive (art. 6.1.f).
• Retention: as long as needed to assist you and, at most, one year if you do not go on to order.

When you order

• Data: full name, phone, Google email, type and date of the event, chosen plan, the version of the terms you accepted and when, and the payment result. We do not see or store your card details: they are handled directly by our payment gateway, Stripe.
• Purpose: to manage the order and the payment, give you access to your dashboard, provide the service and support, and send you service notifications.
• Legal basis: performance of the contract (art. 6.1.b GDPR).
• Retention: for as long as the service lasts and, afterwards, blocked for 5 years to deal with any possible claims (art. 1964.2 of the Spanish Civil Code).

Invoicing and legal obligations

• Data: the order and payment details (amount, date, reference).
• Purpose: to issue invoices and meet the tax and accounting obligations that apply to us, in the United States and, where applicable, in Spain.
• Legal basis: compliance with a legal obligation (art. 6.1.c GDPR).
• Retention: up to 7 years from payment, the period required by the applicable tax and accounting rules.

Advertising and campaign measurement

We advertise CreaTusInvitaciones on Google and on Meta (Facebook and Instagram). Only if you accept it in the cookie notice, the website loads the Google Ads and Meta tags, which allow us to:

• know whether an advert brought you to the website and whether you went on to order (conversion measurement), and

• show you CreaTusInvitaciones adverts on other websites and apps (remarketing).

• Data: cookie and device identifiers, pages visited, the advert you came from and whether you completed the purchase (without your contact details).

• Legal basis: your consent (art. 6.1.a GDPR and art. 22.2 LSSI-CE), which you can withdraw at any time from “Cookie preferences”, at the foot of every page.

• Retention: as stated for each cookie in the cookie policy.

Google and Meta also process this data as controllers in their own right, under their own policies (Google, Meta). We do not give them your name, email or phone number.

Marketing communications

We will not send you advertising by email or other electronic means without your prior consent (art. 21 LSSI-CE). If we ever ask for it and you agree, you can withdraw it at any time using the link in each message.

Your guests’ data

When you use the dashboard, you enter data about your guests (names, phone numbers, replies to the invitation and, if you ask for them, menus, allergies and intolerances). Regarding that data:

• You decide what data is collected and why; CreaTusInvitaciones processes it only on your behalf and following your instructions, as a processor (art. 28 GDPR), on the terms set out in the terms and conditions.
• Allergies and intolerances are health data, a special category (art. 9 GDPR). They are only requested if you switch this on, are used solely to organise the event menu and are protected with restricted access.
• Guests’ data is never used for advertising or shared with advertising platforms.
• When the service ends, it is deleted within the period stated in the terms and conditions.
• Guests can exercise their rights through you or by writing to us; in that case, we will let you know so that we can handle them together.

Who we share data with

We do not sell or transfer your data. Only the providers we need to deliver the service have access to it:

We have signed the data processing agreement required by art. 28 GDPR with those who process data on our behalf. We will also disclose data to the authorities when required by law (for example, the tax authorities).

Your data outside the European Economic Area

As we are a United States company, your data is processed in the United States, as well as on our providers’ European servers. We do so with the same safeguards as the GDPR:

• Our providers in the United States (Google, Stripe and Meta) participate in the EU-U.S. Data Privacy Framework (European Commission adequacy decision of 10 July 2023) and also sign the standard contractual clauses approved by the Commission.
• We apply the GDPR to all the data we process about people in the EU, wherever it is, and we are accountable for this to the Spanish supervisory authority.

You can ask us for more information about these safeguards by writing to hola@creatusinvitaciones.com.

Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time, and withdraw any consent you have given, without affecting processing carried out before.

Write to us at hola@creatusinvitaciones.com stating which right you wish to exercise. We will reply within one month at most. If you are not satisfied, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es, C/ Jorge Juan, 6, 28001 Madrid) or with the data protection authority of your EU country.

Minors

Ordering is reserved for people over 18. We do not knowingly collect data from children under 14 without the consent of their parents or guardians (art. 7 LOPDGDD). If underage guests are included in the dashboard, the customer decides on their data and must have their parents’ or guardians’ permission where required.

Security

We apply technical and organisational measures appropriate to the risk: encrypted connections (HTTPS), dashboard access only with a Google account, per-person permissions and our providers’ backups.

We do not make automated decisions with legal effects on you. If you accept advertising cookies, Google and Meta may build profiles to show you adverts, as explained above.

Changes to this policy

If we change it, we will publish the new version here with its date. If the change is significant, we will let you know.