1. The service
“Organiser” means the company, association or organisation — or the professional acting in the course of their business — that creates an event. “User” means an organiser or a member of its team authorised to use the service. “Guest” means a person invited by an organiser; a guest needs no InviteKey account to receive an invitation or present a pass.
InviteKey makes it possible to prepare an invitation-only event, import or enter confirmed guests, send invitation emails, issue each guest a personal QR code and, if the guest wishes, an Apple Wallet or Google Wallet pass, and record admissions. The features and limits available depend on the chosen offer; they are shown before the event is activated and may change.
InviteKey is an access-management tool. It is neither the event organiser, nor a ticket seller, nor the guarantor of admission. The organiser decides who is invited, who may enter and how its event is run.
InviteKey is intended exclusively for professionals and organisations. The services are not offered to consumers for personal or family use. On sign-up and before each order, the user confirms acting in the course of their professional activity or on behalf of the organisation they specify. InviteKey reserves the right to refuse or terminate an account or an order intended for personal or family use.
2. Accounts and authorised use
Users provide accurate account information, keep their access links and credentials confidential, and use only the rights granted to them. The organiser is responsible for its team members, its invitation verification devices — the phones and tablets that read QR codes at the entrance to its event —, and the accuracy of its event settings and of the information about its guests.
The organiser must have a legal basis to collect and import its guests’ contact details and to send them invitations. It is forbidden to import sensitive data, unlawful content or content infringing the rights of others, or data unnecessary for access control. It is also forbidden to send unsolicited messages, misuse passes, attempt unauthorised access or disrupt the service.
3. Invitations, Wallet passes and access control
A QR code or Wallet pass is a personal access credential: neither the organiser nor the guest may publish or forward it. A pass ceases to be valid if it is revoked, if the event expires or if the organiser changes its access rules. A revoked or expired pass may remain visible in the guest’s Wallet app, dimmed or marked inactive: its validity is checked by InviteKey at the time of the check. The availability of Wallet passes also depends on the guest’s device and on Apple or Google services.
When the organiser enables offline check-in, a verification device may record a provisional admission before it synchronises. Two disconnected devices may temporarily accept the same credential; the conflict is resolved or flagged on synchronisation. For stricter control, use server validation and a reliable connection.
Email delivery, the installation of Wallet passes and the continuity of the connection cannot be guaranteed. The organiser checks essential information and plans a fallback admission solution suited to its event.
4. Offers, prices and retention period
The offer, its capacity, its price and the retention period of the event’s data are shown before the purchase or the activation of the event. The free offer has a limited capacity and retention period, shown in the same place. Payment and refund terms are presented before any order.
When the retention period ends, access to the event’s data ends. The privacy policy describes how data is kept and deleted, including in backups and logs. Export the information you need before the displayed expiry date.
5. Personal data
The organiser decides which guest data it entrusts to InviteKey and for what purpose. InviteKey processes that data on its behalf, following its instructions, to provide the service; section 6 sets out InviteKey’s commitments as processor. Each party complies with the data-protection obligations that correspond to its role. The privacy policy describes the data processed, the service providers and how to exercise rights.
The organiser informs its guests as the regulations require, and does not ask InviteKey to use their data for any purpose other than this service.
6. Processing of data on behalf of the organiser
This section constitutes the processing agreement required by Article 28 of the General Data Protection Regulation (GDPR). It applies as soon as an organiser entrusts InviteKey with personal data of its guests or of its team members.
Subject and duration: providing the service described in section 1, for the retention period of each event. Nature and purposes: hosting, sending invitations, issuing and updating passes, access control and attendance tracking. Data: guests’ identity and contact details, category, status of the invitation and of its delivery, pass identifiers, time and checkpoint of admissions, and any field added by the organiser. Data subjects: the organiser’s guests and the members of its team.
InviteKey undertakes to: process this data only on the organiser’s documented instructions — these terms and the settings it chooses in the service — and inform it if an instruction appears to infringe the regulations; guarantee its confidentiality, the persons authorised to access it being bound by confidentiality; implement appropriate security measures; assist the organiser, as far as possible, in responding to requests to exercise rights, in ensuring the security of processing and, where applicable, in carrying out an impact assessment; notify it of any personal-data breach without undue delay after becoming aware of it; make available to it the information needed to demonstrate compliance with these obligations, and allow audits on reasonable prior request.
The organiser authorises InviteKey to use the sub-processors listed in the privacy policy, which are bound by equivalent obligations. InviteKey informs organisers of any addition or replacement by updating that list before the change and, for a significant change, by email; an organiser that objects may stop using the service. Transfers outside the European Economic Area are safeguarded as described in the privacy policy.
When an event’s retention period ends, InviteKey deletes its data from its active systems, under the conditions described in the privacy policy, without returning it: the organiser may export it until that date.
7. Content and intellectual property
The organiser retains its rights in the logos, images, event information and guest lists it provides. It grants InviteKey a limited permission to host, process and display them, only to the extent necessary for the service. It warrants that it holds the necessary rights in everything it imports.
InviteKey retains its rights in the service, the software, its design and its brand. These terms grant no right to copy, resell or decompile the service, except where the law allows it.
8. Changes, suspension and liability
We may maintain, improve or change the service. We may restrict access to it when reasonably necessary to protect its security, prevent abuse, comply with the law or remedy a payment default, notifying the user where possible. An organiser may stop using the service at any time; doing so does not extend the retention period chosen for its events.
We provide the service with reasonable care, without being able to guarantee uninterrupted or error-free operation, nor the delivery of emails or passes by third-party services. Nothing in these terms excludes any liability that the law does not allow to be excluded. To the extent permitted by law, neither party is liable for damage it could not reasonably foresee when the service was used.
9. Changes to these terms
We may change these terms. The new version is published on this page, with its version and effective date shown at the top; significant changes are announced to existing users by reasonable means before they take effect. Continuing to use the service after that date constitutes acceptance, to the extent permitted by law; otherwise, stop using the service and contact us.
10. Governing law, language and disputes
These terms are governed by French law. They are written in French; their translations are provided for information and, in case of discrepancy, only the French version is binding.
Any dispute falls under the exclusive jurisdiction of the courts of Lyon (France).
11. Contact
For any question or complaint: support@invitekey.app.