PRIVACY POLICY

This Privacy Policy applies to all personal information collected by RIGHT HERE SOLUTIONS PTY LTD (ACN 702788083) trading as InviEat (we, us or our) via the website located at invieat.com (Website), through the application and in connection with our services.

1. What information do we collect?

The kind of Personal Information that we collect from you will depend on how you use the website, application / services. The Personal Information which we collect and hold about you may include: name, email address, phone number, food preference, allergies and food restrictions, special food needs, RSVP response. In addition, if you use Google or Microsoft sign-in, we collect your name and email from Google or Microsoft. Our InviEat cookie collects name and email. We use Google Analytics to track and optimise our website. We use Google Analytics to collect aggregated, anonymous data like your device, browsing and click activity, unique identifiers and technical metadata.

2. Types of information

The Privacy Act 1988 (Cth) (Privacy Act) defines types of information, including Personal Information and Sensitive Information.

Personal Information means information or an opinion about an identified individual or an individual who is reasonably identifiable:

(a) whether the information or opinion is true or not; and

(b) whether the information or opinion is recorded in a material form or not.

If the information does not disclose your identity or enable your identity to be ascertained, it will in most cases not be classified as “Personal Information” and will not be subject to this privacy policy.

Sensitive Information is defined in the Privacy Act as including information or opinion about such things as an individual's racial or ethnic origin, political opinions, membership of a professional or trade association or trade union, religious or philosophical beliefs, membership of a professional body, criminal record or health information.

We collect allergy, food-restriction and special-food-needs information from you as part of providing our event and catering services. This information may constitute health information, or information about religious or philosophical beliefs, and therefore Sensitive Information under the Privacy Act. We will only collect such information with your express consent or as otherwise required or authorised by law. Where you enter your own dietary details through the Website or application, your express consent is obtained via a checkbox presented on the attendee form before you submit those details; the information is collected only after you select that checkbox. Where a host enters another attendee's sensitive dietary information on that attendee's behalf, the host must confirm that they have obtained the attendee's express consent before providing that information to us. We use this information solely to record and communicate your dietary requirements to the relevant event organiser or service provider, to accommodate those requirements at the relevant event or service, and for purposes directly related to those purposes, or with your consent or as otherwise authorised by law.

Sensitive Information will be used by us only:

(i) for the primary purpose for which it was obtained;

(ii) for a secondary purpose that is directly related to the primary purpose, limited to information that is de-identified or aggregated (such as analysing de-identified or aggregated data to evaluate and improve our services), provided that no dietary or allergy information is sent to Google Analytics; and

(iii) with your consent or where required or authorised by law.

3. How we collect your Personal Information

(a) We collect Personal Information directly from hosts (including event organisers, restaurants and food providers), and attendees when they provide information through the Website, related application or otherwise in connection with our services. Users may sign in using Google or Microsoft sign-in, or by email using a one-time password (OTP), and account details received from Google or Microsoft may be collected as Personal Information. We may also collect information about a minor only when it is entered by the minor's parent or legal guardian. The application is not intended for use by minors.

(b) The application uses its own cookies and may also use cookies set by third-party tools, including Google Analytics. Cookies and similar technologies may collect information about use of the Website or application, device and browsing activity, which may be used to operate, analyse and improve our services. Third-party tools may collect information under their own privacy terms. Users may choose to save event details to Google, Microsoft or Apple calendars; doing so may involve sharing the relevant event information with the selected calendar provider under its own privacy terms.

(c) We collect allergy, food-restriction and special-food-needs information as described above, which may be Sensitive Information. We collect it only with your express consent or as otherwise required or authorised by law, and handle it in accordance with the Privacy Act and the Australian Privacy Principles.

4. Purpose of collection

(a) We collect Personal Information to provide you with the best service experience possible on the Website and application, to operate and improve our services, and to keep in touch with you about developments in our business, such as changes to this policy or our services. These communications are not marketing emails.

(b) We only disclose Personal Information to our customers, i.e. hosts (including event organisers, restaurants and food providers), service providers and third-party providers (including sign-in, analytics and calendar providers) who assist us in operating the Website and application, receiving only such information as is necessary to provide those functions. Your Personal Information may also be accessed by maintenance and support personnel from time to time acting in the normal course of their duties. We may disclose Personal Information where required or authorised by law.

5. Security, Access and correction

(a) We store your Personal Information in a way that reasonably protects it from unauthorised access, misuse, modification or disclosure. When we no longer require your Personal Information for the purpose for which we obtained it, we will take reasonable steps to destroy or anonymise it, unless we are required or authorised by the law to retain it. As a general guide, we aim to delete:

(a) a host's account and data associated with it if that host does not log in for 6 months (except for de-identified analytics and statistics data), provided the host is given 14 days’ notice before the account and associated data are deleted; and

(b) event invitation and attendee response data relating to events that occurred 6 months or more ago (except for de-identified analytics and statistics data) except where we need to retain information to comply with a legal obligation, resolve a dispute or enforce our terms.

(b) An individual may request access to or correction of Personal Information that we hold about them by contacting us in writing using the contact details set out in this policy. Access and correction rights are subject to Australian Privacy Principles 12 and 13 and applicable exceptions under Australian privacy law.

6. Complaint procedure

If you have a complaint concerning the manner in which we maintain the privacy of your Personal Information, please contact us as on the contact details set out at the bottom of this policy. All complaints will be considered by us and we may seek further information from you to clarify your concerns. We will endeavour to respond to your complaint within 30 days of receipt, though the time taken may vary depending on the nature and complexity of the complaint. If we agree that your complaint is well founded, we will, in consultation with you, take appropriate steps to rectify the problem. If you remain dissatisfied with the outcome, you may refer the matter to the Office of the Australian Information Commissioner.

7. Overseas transfer

Our web servers are hosted by GoDaddy in the United States, we use Brevo for email services with servers located in the European Union (primarily, France, Germany and Belgium), and Personal Information may be stored, hosted or processed there. Other third-party service providers, including Google Analytics, Microsoft and Apple, may store, host or process Personal Information on distributed global hosting infrastructure across regions that are likely to include Asia, North America, South America and Europe. Specific server locations and countries within these regions may vary from time to time, and these regions do not represent an exhaustive country-by-country list. Privacy protections differ between jurisdictions, and we do not claim that every overseas jurisdiction provides protection equivalent to the Australian Privacy Principles. We take reasonable steps required by applicable Australian privacy law in relation to overseas disclosures, but we may not be able to control or guarantee how an overseas recipient handles information after transfer. Nothing in this policy excludes or limits any responsibility or liability that cannot lawfully be excluded or limited, including any accountability that may apply under section 16C of the Privacy Act 1988 (Cth) to the extent that section applies and is not subject to a statutory exception.

8. How to contact us about privacy

If you have any queries, or if you seek access to your Personal Information, or if you have a complaint about our privacy practices, you can contact us through: mail@invieat.com

9. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes to our practices, the Website, application, services or applicable law. The updated policy will be published on the Website and, where applicable, in the application, and takes effect on the date it is published. Before making any material change to how we handle Sensitive Information, we will seek fresh consent.

Effective date: 20 October 2026