Privacy policy

Introduction

Matchmeeting AB, org. number: 556598–6634 (hereinafter referred as “InvitePeople”) provides a cloud-based service to manage and conducting digital and physical events (“the service”). Through the service a Customer can sell or distribute their tickets to their clients. InvitePeople is responsible for providing the technical mediation of tickets through its system. 

Data protection and the data integrity is something that InvitePeople take very seriously, for both our Customers and their End user. Personal data is information that, directly or indirectly, can identify an individual, such as name, telephone number, address, and email. InvitePeople only processes personal data in accordance with applicable legislation, the EU Data Protection Regulation, GDPR (EU) 2016/679. 

InvitePeople’s responsibility as data processor 

InvitePeople provides the service to the organizer (“Customer”), where InvitePeople acts as data processor and the Customer as data controller. A Personal Data Processing Agreement is signed between the Customer and InvitePeople to ensure secure, correct and legal processing of personal data in each individual case. The Customer is the controller of the personal data for the End user that are processed within the service and InvitePeople only process such data in accordance with instructions from the Customer. InvitePeople’s processing of Personal Data on behalf of the Customer is not subject to this Privacy Policy. 

If an End user would like to withdraw their consent you can use: https://invitepeople.com/revoke.
InvitePeople will forward your request to the data controller of your data.

InvitePeople’s responsibility as data controller 

InvitePeople processes personal data in capacity as data controller in accordance with the information below: 

Process Category of data subject Category of personal data Legal basis Retention period

Administering customer information to be able to provide the service to invite, implement and manage digital and physical events, following processes are involved:

  • Registration of user
  • Communication logs
  • Administrator (Customer)
  • Name
  • Email address
  • IP-address
  • Phone number
  • Performance of contract
  • As long as you are a customer and for 24 months after you have ended your contractual relationship with InvitePeople.

Collection of contact information to representatives at companies that have shown interest in our services.
  • Sales leads of potential customers.
  • Name
  • Email address
  • Phone number
  • Legitimate interest
  • 24 months

We collect information for invoicing of customers and agreements administration.
  • Customers
  • Invoicing addresses
  • Contact details
  • Fulfillment of contract
  • During the length of the agreement and 7 years thereafter according to the Accounting act.

We collect cookie information that is necessary for the website to function properly and for statistical purposes.
  • Website visitors
  • Cookie ID
  • IP-addresses
  • Consent
  • 2 months

We collect cookie information for marketing purposes to provide tailored advertisement.
  • Website visitors
  • Cookie ID
  • IP-addresses
  • Consent
  • 2 months

Data subjects’ rights 

If a data subject considers that any personal information about him or her is incorrect or misleading or if the data subject in any way wish to restrict the handling of the personal data, object to the processing, delete them (subject to certain exceptions), transfer any data or request information about which personal data that are being processed, please contact our Data Protection Officer at privacy@invitepeople.com. Data subjects also have the right to submit a complaint to the Supervisory Authority in their country.

Processors

InvitePeople uses suppliers to provide the service. When suppliers process personal data on our behalf, a Data Processing Agreement is signed which sets out the parties’ responsibilities for the processing activities. 

Sharing of personal data 

InvitePeople share personal data with the following categories of recipients:

  • Payment providers to enable them to process payments from our customers. 
  • Suppliers of digital marketing and statistical analysis that InvitePeople use to provide relevant advertising to potential customers. 
  • InvitePeople may need to provide necessary information to authorities such as the Police, the Financial Supervisory Authority, the Tax Agency, or other authorities and courts.

AI assistants and the MCP server

InvitePeople provides an MCP server (Model Context Protocol) that lets a Customer connect AI assistants, such as Microsoft Copilot, Claude or ChatGPT, to the Customer’s own data in InvitePeople. The MCP server is an alternative way of using the InvitePeople API: the AI assistant can read the documentation, look up data about the organization’s events and prepare imports that a person then reviews. It is available only to organizations for which InvitePeople has enabled it, and only with keys that the Customer’s administrators create in InvitePeople.

  • The Customer stays in control. The Customer’s administrators decide which AI assistant to connect, create the key the assistant uses, choose what the key may read, set when it expires and can revoke it at any time. Keys are read-only by default. An AI assistant can never run an import, download files or change data through the MCP server, regardless of the key’s permissions.
  • InvitePeople acts as data processor. When an AI assistant uses the MCP server, InvitePeople processes personal data in the service on behalf of the Customer and on the Customer’s instructions, under the Data Processing Agreement, in the same way as for any other use of the service or its API. The data an assistant retrieves is sent to the AI assistant the Customer chose to connect. That AI provider is engaged by the Customer, not by InvitePeople; it is not a sub-processor of InvitePeople, and InvitePeople does not control, and has no agreement covering, its processing. Customers should review the AI provider’s terms and data handling before connecting it.
  • InvitePeople does not use Customer data to train AI models. The MCP server does not send any data to AI models itself; it only answers requests from the assistant the Customer has connected.
  • What InvitePeople records. For each request, the MCP server logs which tool was used, which type of data was requested, whether the request succeeded and how long it took. On the key, InvitePeople records when it was last used. The MCP server does not log the content of requests or of the data returned; the requests it makes to the InvitePeople API on the assistant’s behalf are logged by the service in the same way as any other use of the API. The MCP server’s technical logs are kept for 30 days and are used for security, abuse prevention and operations.
  • Sign-in with OAuth. Some AI assistants connect through a sign-in flow in which the person connecting the assistant enters the key once. The MCP server then issues short-lived, encrypted access tokens to the assistant. No user account is created and the MCP server does not store the key.
  • Hosting and security. The MCP server is operated by InvitePeople in the same region as the service. All traffic is encrypted in transit, keys are stored hashed, requests are rate limited and access is restricted to what the key permits.

If you are a participant and have questions about how an organizer uses AI assistants with your data, contact the organizer, who is the data controller.

Text messages (SMS)

InvitePeople sends text messages (SMS) as part of the service, on behalf of the event organizer (the Customer). The messages concern your participation in an event: login links, a welcome message and event information, notifications about meetings, sessions and messages during the event, check-in confirmations, authentication codes when you sign in, survey reminders, and other messages the organizer sends to the event’s participants. Message frequency varies: most messages are sent around the event itself, such as a welcome message on the morning of the event, notifications during the event and survey reminders just after it.

Mobile phone numbers are only used to send text messages related to the service. Mobile phone numbers and SMS consent will not be sold, rented or shared with third parties or affiliates for marketing or promotional purposes, and are excluded from the categories of recipients above.

You can stop receiving text messages at any time: change your notification settings or your registration in the event, or contact the organizer. If you have questions about text messages, contact support@invitepeople.com.

Text messages in the United States and Canada

Messages to US and Canadian mobile numbers (country code +1) are sent under the program name InvitePeople from a US toll-free number operated by Matchmeeting AB (InvitePeople) through our SMS provider.

  • Consent. When you register for an event with a +1 number, or update your registration, you choose whether to receive text messages for that event by ticking a checkbox below the mobile phone number field. The checkbox is unticked by default, and agreeing is not a condition for registering. Your choice applies to that event only. If you do not agree, InvitePeople does not send text messages to your number for that event.
  • What the messages are about, and how often. The messages are the ones described above: login links, a welcome message and event information, notifications during the event, check-in confirmations, authentication codes, survey reminders and other messages from the organizer. Message frequency varies: most messages are sent around the event itself, such as a welcome message on the morning of the event, notifications during the event and survey reminders just after it.
  • Opting out. Reply STOP to any message to stop receiving text messages from InvitePeople to your number, for every event. Reply START to receive messages again.
  • Help. Reply HELP to any message, or email support@invitepeople.com.
  • Message and data rates may apply. Carriers are not liable for any delayed or undelivered messages.

International transfers 

Some of the suppliers with whom InvitePeople have entered into service agreements with are storing personal data outside the EU/EEA. In cases when third country transfers occur, InvitePeople have entered into EU’s standard contractual clauses with the suppliers to ensure a sufficient level of security for such transfers. 

Security measures 

InvitePeople maintain a high level of technical and organizational security and we continuously update and test our technology and measures to ensure a level of security that is appropriate to the risk of our business. 

Technical security 

Below is a list with examples of technical security measures (but the technical security is not limited to these). 

  • InvitePeople uses established standards and recommendations for secure development 
  • Best practice for code reviewing and testing 
  • The service is hosted in a safe and secure environment 
  • All issues and abnormalities are logged, tracked, analysed to identify the root cause, any critical security threats are handled instantly 
  • InvitePeople have implemented logging for security events (e.g. logins) 
  • Well known and updated antivirus software 
  • Updated firewalls 
  • All traffic to InvitePeople’s network is encrypted through SSL or VPN tunnel 
  • Perform regular security analysis 
  • Penetration test on a regular basis 
  • Continuous vulnerability scanning 
  • Daily backups stored off site 
  • Enforced password complexity, MFA when available and high requirements for storage of passwords 
  • InvitePeople have implemented a variety of security techniques for countermeasures 

Organizational security 

Below is a list with examples of organizational security measures (but the organizational security is not limited to these). 

  • No sensitive data is sent, or received, through insecure channels. 
  • Access to InvitePeoples systems is limited to “need to have” basis, where only individuals that need to have access to personal data will have that. 
  • Access is controlled via unique user ID and a up to date registers is kept 
  • No shared accounts are used 
  • All employees undergo information security educations on a regular basis 
  • Appointed responsible individual within the organization for the overall information security 
  • All employees are bound by terms and conditions and confidentiality agreement 
  • A Data Protection Agreement is always signed to ensure secure, correct and legal processing of personal data 
  • InvitePeople have appointed an external DPO (Data Protection Officer) 
  • InvitePeople is actively working towards an ISO/IEC 27001:2017 certification 

Cookies

We process personal data through cookies for technical purposes in order to improve your experience when using our website. We also use cookies for statistical purposes to measure the number of visitors and for marketing purposes to be able to provide targeted advertising. 

For more information on how InvitePeople use cookies including a full list of the cookies we use please see our Cookie Policy here:
https://invitepeople.com/cookies

Contact information 

Matchmeeting AB 
privacy@invitepeople.com 
Tysta gatan 9 
SE-115 20 Stockholm 
Sweden 
Org.nr 556598-6634