This page covers the Protection of Personal Information Act, 2013 (POPIA) and the Promotion of Access to Information Act, 2000 (PAIA). For what we collect day to day and why, read the
Privacy Policy.
Who you are dealing with
RSVIP is a digital invitation, RSVP and event-communication platform for weddings and every other kind of event, operated by Kanvas Creative Solutions in South Africa. We provide the platform to hosts and organisers, and deliver their invitations to the guests they invite.
- Trading nameRSVIP (rsvip.co.za)
- Operated byKanvas Creative Solutions
- Registration number2019/136304/07
- AddressJohannesburg, South Africa
- Support and legal emailrsvp@kanvas.co.za
- Telephone and WhatsApp(+27) 081 788 0727
- Support hoursMonday to Friday, 09:00 to 17:00 (SAST), excluding public holidays
- CurrencyAll prices are in South African Rand (ZAR)
1. Responsible party and information officer
Kanvas Creative Solutions, trading as RSVIP, is the responsible party for personal information processed on the platform. A host is a responsible party for the guest information they bring into their invitation, and RSVIP processes it on their behalf.
- Information officerThe Information Officer, Kanvas Creative Solutions
- Emailrsvp@kanvas.co.za
- Telephone(+27) 081 788 0727
- AddressJohannesburg, South Africa
- Registration number2019/136304/07
The information officer deals with POPIA requests, PAIA requests, complaints and dealings with the Information Regulator.
2. Why we are allowed to process your information
Every use of personal information on RSVIP rests on one of these grounds in section 11 of POPIA:
- Performance of a contract - building a host's invitation, signing them in, delivering invitations and recording RSVPs, taking payment, paying affiliate commission.
- Legal obligation - tax, company and consumer-protection records; responding to lawful demands.
- Legitimate interests - fraud prevention, platform security, chargeback handling and keeping the service working, where these do not override your rights.
- Consent - optional things you choose to do: submitting a gallery or Community photo, receiving marketing, sharing a file with Len. You may withdraw consent at any time.
- On the host's instruction - for guest lists and responses, RSVIP acts as the host's operator.
We do not process special personal information (such as health, religion or biometrics) or children's information for our own purposes. A guest's dietary requirement is collected only because the host asks for it, for catering at their event.
3. How we meet the eight conditions
- Accountability. The information officer is answerable for compliance.
- Processing limitation. We collect what an invitation, an RSVP or a payment needs, lawfully and from you wherever possible.
- Purpose specification. Each category is collected for a stated purpose and kept only as long as the retention schedule allows.
- Further processing limitation. We do not repurpose your information into something unrelated to the reason it was given, and we do not use your photos in our marketing without permission.
- Information quality. Hosts can correct their details in the dashboard, guests can ask the host or us, and we act on correction requests.
- Openness. This page, the Privacy Policy and the PAIA manual say what we hold and why.
- Security safeguards. Passwordless sign-in, access control, encrypted transport, private directories, upload checks, monitoring, and contracts with our operators.
- Data subject participation. The request process below.
4. Your rights
- Ask whether we hold personal information about you, and ask for a copy.
- Ask us to correct or delete information that is wrong, misleading, out of date, excessive or unlawfully held.
- Object, on reasonable grounds, to processing based on legitimate interests.
- Withdraw consent where the processing rests on consent.
- Object to direct marketing at any time, and not receive unsolicited electronic marketing.
- Not be subject to a decision based solely on automated processing that significantly affects you. RSVIP does not make such decisions; Len's replies are information, not decisions about you.
- Complain to the Information Regulator, and go to court.
Exercising a right is free, except that a fee prescribed under PAIA may apply to a request for access to records.
5. Making a request
- Write to the information officer at rsvp@kanvas.co.za.
- Say what you want - access, correction, deletion, objection or withdrawal of consent - and give enough detail to find the records: the email address or mobile number used, the invitation or event, and roughly when.
- Prove who you are. We may ask for identification so that we do not hand someone's information to a stranger. Never send PINs, sign-in links or full card numbers.
- We respond. Acknowledgement within five business days. A decision within 30 days, which POPIA and PAIA allow us to extend once, with reasons.
Requests about a guest list or RSVP may be passed to the host, who controls that invitation, and we will tell you when we do. The prescribed forms are available from the Information Regulator and in the PAIA manual: Form 2 under PAIA for access to a record, and under POPIA Form 1 for an objection, Form 2 for correction or deletion, and Form 5 for a complaint to the Regulator.
We may refuse a request where the law requires or permits it - for example where a record must be kept for tax, where releasing it would reveal someone else's personal information, or where a request is manifestly excessive. We give reasons, and you may complain to the Regulator.
6. PAIA manual
Section 51 of PAIA requires every private body to publish a manual explaining what records it holds and how to request them. Ours covers Kanvas Creative Solutions's details, the information officer, the records kept, the request procedure, the prescribed fees and the remedies if a request is refused.
The manual is available free of charge on request from the information officer at rsvp@kanvas.co.za.
The manual is available in English. A printed copy may be requested from the information officer.
7. Records we hold
The categories a PAIA request can ask about:
- Host records - account and contact details, sign-in records, co-organiser access, invitations and their content, settings and activity.
- Guest records - RSVP responses, guest lists and whitelists, invitation delivery status, imported SMS contacts.
- Media - uploaded images, music and video, Public Gallery photos and Community posts.
- Payment records - amounts, methods, PayFast references, coupons, refunds and chargebacks, affiliate commissions and withdrawals.
- Communications - transactional email and SMS, support correspondence, and enquiries and transcripts sent from the Len chat.
- Technical records - access, security and error logs.
- Company records - those kept under the Companies Act, the Income Tax Act and similar legislation, where applicable.
8. Sending information outside South Africa
Some providers process information outside the Republic: email delivery, WhatsApp (for WhatsApp sign-in), and the AI provider behind Len and AI programme formatting. Section 72 of POPIA allows this where the recipient is bound by rules giving comparable protection, where you consent, or where the transfer is necessary to perform our contract with you. We rely on contract terms with those providers and pass on no more than the service needs.
9. Security compromises
If personal information is accessed or acquired by an unauthorised person, section 22 of POPIA requires us to notify the Information Regulator and the people affected as soon as reasonably possible. Our notice will describe what happened, the likely consequences and what we and you can do about it.
10. The Information Regulator
You may complain to the Regulator at any time, whether or not you have complained to us first. We would rather hear from you first, but that is your choice.
