# Privacy Policy This Privacy Policy explains how Space Tech, S.A., RUC 155727383-2-2022 DV 33, with registered address at Avenida Centenario, Plaza Super 99, Piso 3, Oficina 9, Panama, Costa del Este, Republic of Panama ("Space Tech", "we", "us", or "our"), collects, uses, stores, shares, and protects personal data in connection with RSVPhub and any related websites, applications, dashboards, communications, support channels, and services that link to this Policy (the "Services"). Contact: legal@rsvphub.me Data Protection & Legal Contact — external counsel: ARCA Business Lawyers, Attn: Justin Cabrera, Calle 50 con Calle 53E, Edificio PH Plaza 2000, Piso 20, Panama City, Republic of Panama. All requests must be submitted in writing. (Courtesy intake copy: legal@rsvphub.me) ## 1. Scope and governing approach Space Tech is incorporated in the Republic of Panama. This Policy is intended to align with Panamanian data protection law, including Law 81 of 2019 and its implementing regulations, and with broadly recognized privacy principles used in other jurisdictions where our users, event organizers, guests, clients, or service providers may be located. Where another mandatory law applies, we will respect rights that cannot be waived by contract. This Policy applies when you visit our website, create or use an account, create or manage events, respond to invitations, purchase or use Services, contact support, receive communications from us, or otherwise interact with RSVPhub. ## 2. Roles: controller, processor, and service provider Depending on the context, Space Tech may act as a controller when we decide why and how personal data is processed for our own purposes, such as account administration, billing, security, analytics, support, legal compliance, product improvement, and communications. Space Tech may also act as a processor or service provider when we process personal data on behalf of an event organizer, customer, company, or administrator that uses RSVPhub to manage invitations, guest lists, RSVPs, registrations, check-ins, seating, messages, event pages, forms, or similar workflows. When an organizer uploads, imports, or collects personal data through RSVPhub, the organizer is primarily responsible for ensuring that it has a lawful basis to use that data and to send invitations or messages to the relevant individuals. ## 3. Personal data we may collect We may collect the following categories of personal data, depending on how the Services are used: Account and identity data, such as name, username, company name, role, email address, phone number, password or authentication credentials, second-factor and passkey enrollment data, language preference, account settings, and login information. Event and RSVP data, such as event names, dates, locations, invitation details, guest names, email addresses, phone numbers, attendance status, ticket or registration data, check-in status, seating or group information, comments, preferences, and event-related messages. Organizer-provided data, such as guest lists, forms, notes, reports, custom fields, tags, labels, internal instructions, and other data that customers, organizers, administrators, or users upload, import, enter, or generate using the Services. Payment and billing data, such as billing name, billing address, tax or invoice details, subscription plan, purchase history, payment status, transaction identifiers, and limited payment metadata. We generally do not store full credit card numbers; payment information may be processed by third-party payment providers. Identity-verification data, where you use an optional identity-verification feature, as described in Section 12. Communications and support data, such as emails, support tickets, chat messages, call notes, feedback, attachments, survey responses, and other information you provide when contacting us. Technical and usage data, such as IP address, approximate country derived from IP (used, among other things, to apply geographic access restrictions), device identifiers, browser type, operating system, pages viewed, referral URLs, timestamps, session identifiers, log files, cookie identifiers, usage events, and diagnostic data. Marketing data, such as communication preferences, campaign interactions, referral source, and consent or opt-out records. Sensitive or special-category data is not required by default. However, event organizers or users may choose to collect information such as dietary restrictions, accessibility needs, health-related event requirements, identity documents, or other sensitive information. Such data should only be collected when necessary, lawful, proportionate, and transparent to the individual. ## 4. Sources of personal data We may receive personal data directly from you, from your employer or organization, from an event organizer, from invited guests, from other users, from service providers, from payment processors, from authentication and identity-verification providers, from analytics tools, or automatically through your device and browser. ## 5. Purposes of processing We process personal data to provide, operate, maintain, secure, and improve the Services; create and manage accounts, events, invitations, RSVPs, registrations, check-ins, dashboards, forms, reports, and related features; authenticate users and operate second-factor and passkey security; prevent unauthorized access; process payments, invoices, subscriptions, refunds, taxes, and accounting records; send service communications, confirmations, reminders, administrative notices, security alerts, support replies, and product updates; provide customer support; personalize language and settings; monitor system performance; diagnose errors; protect against fraud, abuse, spam, unauthorized access, illegal activity, security incidents, or misuse; apply sanctions and geographic access restrictions; comply with legal, tax, accounting, regulatory, contractual, and dispute-resolution obligations; enforce our Terms and other policies; analyze usage trends; improve our products; and send marketing communications where permitted by law and in accordance with your preferences. ## 6. Legal bases for processing Depending on the applicable law and context, we may process personal data based on consent, performance of a contract, steps taken before entering into a contract, compliance with legal obligations, legitimate interests, protection of vital interests in exceptional cases, or the lawful instructions of a customer, organizer, or controller when we act as processor or service provider. Where consent is required, you may withdraw it at any time, without affecting processing carried out before withdrawal. ## 7. Cookies and similar technologies We use cookies and similar technologies as described in our Cookie Policy. Some cookies are strictly necessary for the Services to function. Other cookies, such as analytics or marketing cookies, are used only where permitted by law or with consent where consent is required, which you can give or refuse through our cookie banner and preference controls. ## 8. Sharing of personal data We may share personal data with event organizers, administrators, team members, or authorized users who manage the relevant event or account; guests or attendees where the functionality of the Services requires limited sharing and the organizer has enabled it; service providers that support hosting, cloud infrastructure and object storage, databases, email delivery, SMS or messaging, analytics, payment processing, identity verification, customer support, security, logging, backups, document generation, and other operations; professional advisers; public authorities, courts, regulators, law enforcement, or other third parties as described in Section 20; and business transaction parties in connection with a merger, acquisition, financing, restructuring, sale of assets, or similar transaction. We do not sell personal data in the ordinary sense of exchanging personal data for money. If a law defines "sale" or "sharing" more broadly, we will honor applicable opt-out rights where required. ## 9. International transfers Because RSVPhub is an online service, personal data may be processed in Panama and in other countries where our service providers, infrastructure, users, or customers are located. For example, we use cloud hosting and object storage (including Cloudflare R2) to store media and files, and third-party payment providers to process payments (for payments to Space Tech, providers such as Binance Pay, Lemon Squeezy, and TowerPay; and, for payments that organizers collect from their own guests through the modules, providers such as Yappy, Binance Pay, and Lemon Squeezy); these providers may operate in multiple countries. These countries may have different data protection laws from your country. When required by applicable law, we use appropriate safeguards for international transfers, such as contractual obligations, data processing agreements, security measures, transfer risk assessments, or other lawful transfer mechanisms. ## 10. Retention We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, including to provide the Services, maintain accounts, comply with legal and accounting obligations, resolve disputes, enforce agreements, protect security, and preserve evidence where needed. Retention depends on the data category, account status, organizer settings, contractual requirements, backups, and legitimate operational needs. ## 11. Security We use reasonable technical, organizational, and administrative safeguards designed to protect personal data against unauthorized access, loss, misuse, alteration, disclosure, or destruction. Our measures include, among others: access controls and least-privilege access; one-time passcode (OTP) verification; optional stronger authentication using authenticator-app (TOTP) codes and device passkeys (WebAuthn); encryption of sensitive authentication secrets at rest and encryption in transit; session protections against fixation and reuse; rate limiting and abuse detection; audit logging of privileged and administrative access; backups; and internal procedures. We follow a data-minimizing logging practice: we aim to keep personal identifiers out of operational logs and to mask email addresses where they appear. No system is perfectly secure. You are responsible for maintaining the confidentiality of your credentials, second-factor devices, and recovery material, and for using secure devices, networks, and passwords. ## 12. Identity verification (KYC) For certain higher-trust features or account tiers, we may offer or require identity verification. When you use this feature, verification is performed by a specialized third-party identity-verification provider that acts on our behalf. To verify you, that provider may collect and process a government-issued identity document and a biometric "liveness" or selfie check, under its own terms and privacy notice. **Space Tech does not receive or store your identity document, selfie, or biometric data.** We retain only the verification result (for example, verified or not verified) and limited related status information. Separately, and independent of that check, we retain the basic account and contact details you provide — such as name, email address, WhatsApp or phone number, and postal address — to operate your account and to register and administer the subdomains we provision for you. Because subdomains are subject to domain-registry rules, some of this contact information may need to be provided to a domain registry or ICANN-related service where required. If we later allow you to upload a profile photo or avatar, that image is content you choose to provide and is not part of identity verification. ## 13. Your rights Depending on your jurisdiction and the context of processing, you may have rights to request confirmation of processing; access your personal data; request correction or updating; request deletion or anonymization, subject to legal and contractual limits; object to certain processing; restrict or limit certain processing; withdraw consent; request portability; opt out of marketing communications; and lodge a complaint with a competent data protection authority. To exercise rights, contact legal@rsvphub.me. We may need to verify your identity and may ask for information necessary to locate the relevant account, event, or record. If your data is controlled by an event organizer or customer, we may direct your request to that organizer or assist the organizer in responding. ## 14. Marketing communications You may opt out of marketing emails by using the unsubscribe link in the message or contacting us. We may still send non-marketing service communications, such as security alerts, account notices, transaction confirmations, and legal updates. ## 15. Children and minors The Services are not intended for children under the age required by applicable law to use online services without parental or guardian consent. Organizers should not knowingly collect personal data from minors through RSVPhub unless they have the necessary authority, consent, and safeguards. ## 16. Automated decision-making We do not intend to make decisions that produce legal or similarly significant effects solely through automated processing. If this changes, we will provide information required by applicable law. ## 17. Third-party services and links The Services may include links or integrations with third-party websites, payment processors, messaging providers, maps, calendars, analytics tools, identity-verification providers, or social platforms. Their privacy practices are governed by their own policies. We are not responsible for third-party privacy practices. ## 18. Changes to this Policy We may update this Policy from time to time. The updated version will indicate its effective date. If changes are material, we may provide additional notice through the Services or by email where appropriate. ## 19. Language and interpretation This Policy may be provided in several languages. For a Panamanian company, the Spanish version may be designated as the governing version unless mandatory law requires otherwise. Translations are provided for convenience and accessibility. ## 20. Lawful access, legal requests, and government audits Space Tech operates in and under the laws of the Republic of Panama. We will cooperate with valid, legally binding requests from competent courts, prosecutors, regulators, tax authorities, and law-enforcement or other public authorities — whether Panamanian or, through applicable mutual-assistance and cross-border legal channels, foreign. Where we receive a request that we reasonably believe to be valid and binding — including a judicial order, prosecutorial requirement, or documented criminal or regulatory inquiry — we may disclose personal data and/or provide supervised audit or investigative access to the relevant records and account activity. Because such requests frequently arrive under legal confidentiality, secrecy-of-investigation, or non-disclosure requirements, we may be prohibited from notifying the affected person and **may act without prior notice to you.** Please read this carefully: we **do not undertake, and you should not expect, that Space Tech will contest, challenge, litigate, or otherwise resist a request that appears lawful and binding on us.** Unlike some large platforms, we do not commit resources to fighting lawful access requests on a user's behalf. Our role is to confirm that a request is facially valid and to respond within the limits of applicable law. Such access and disclosures are recorded in our internal audit logs. Requests from law-enforcement or public authorities must be submitted in writing to our external counsel, ARCA Business Lawyers (Attn: Justin Cabrera, Calle 50 con Calle 53E, Edificio PH Plaza 2000, Piso 20, Panama City), with a courtesy copy to legal@rsvphub.me. ## 21. Contact Space Tech, S.A. RUC 155727383-2-2022 DV 33 Avenida Centenario, Plaza Super 99, Piso 3, Oficina 9, Panama, Costa del Este, Republic of Panama Email: legal@rsvphub.me Data Protection & Legal Contact — external counsel: ARCA Business Lawyers, Attn: Justin Cabrera, Calle 50 con Calle 53E, Edificio PH Plaza 2000, Piso 20, Panama City, Republic of Panama. All requests must be submitted in writing. (Courtesy intake copy: legal@rsvphub.me)