GDPR and your guest list: what an organiser must do

Who is responsible for the list?

Whoever decides the purpose and the means of processing is the controller. For a guest list, that is the organiser: they choose whom to invite, why and how. The tool they use to send emails and collect registrations is a processor.

The distinction has consequences. The controller must inform people, answer their requests for access or deletion and secure the list. The processor undertakes, by contract, to process the data only on instruction. In Carton Blanc, that contract is article 9 of the terms of sale.

On what legal basis can you invite?

Inviting someone to an event requires a legal basis. For people who register for the event, it is the performance of their request: their data is processed to organise the event they asked to attend.

To invite them to other events afterwards, two regimes coexist. Between professionals, legitimate interest may suffice if the message relates to the recipient's activity and they can object easily. For private individuals, prior consent is the rule. A checkbox offered at registration and not pre-ticked constitutes that consent.

Informing people

Anyone whose data you collect must know who processes it, for what, for how long and how to exercise their rights. The information fits in a few lines, at the point of collection, with a link to a full privacy policy.

The registration page of each event in Carton Blanc links to a privacy policy that describes what the software does. The organiser completes it with their own identity and contact address.

Unsubscribing must be simple and immediate

Every email must contain a way to stop receiving them, and that way must work without logging in or giving a reason. In Carton Blanc, each email contains an unsubscribe link that takes effect on all the organiser's mailings.

Keep a record of the unsubscription: a file re-imported later must not reactivate a person who asked not to be contacted. The software leaves out unsubscribed people when you import.

Collect only what is necessary

The minimisation principle forbids asking for what is not used. For an event, the strict minimum is short.

• Name and email address, to confirm and remind.
• Company and country, only if the context requires it (professional meeting, international event).
• Phone, only for an event where the guest must be reached on the day.
• A free question, for dietary or access needs, without asking for medical justification.

How long should you keep the list?

The retention period must be set in advance. For prospecting, the French data protection authority (CNIL) recommends a limited retention period; check the recommendation in force on cnil.fr. For a guest list with no follow-up, delete the data after the event once it has no further use.

Clean the file every year: remove people who have not responded for a long time, and those who unsubscribed where that is possible without losing the record of their refusal.

Where is the data hosted?

A list hosted in the European Union avoids the formalities of transfers outside the EU. Carton Blanc hosts lists and registrations in Paris, does not sell them, does not pass them on and does not use them for itself. The organiser can export them to Excel at any time.

A checklist before the first mailing

These checks are quick and protect both guests and organiser.

• You know which legal basis covers each use of the list.
• The registration page links to an up-to-date privacy policy, with your contact address.
• Every email contains an unsubscribe link that works.
• You have set the date on which the list will be sorted or deleted.
• You know who on your team answers a request for access or erasure.

Frequently asked questions

Do I need consent to invite my professional contacts?

Not always: between professionals, legitimate interest may suffice if the invitation concerns their activity and they can object easily. For private individuals, consent is the rule.

Who answers if a guest asks for their data to be erased?

The organiser, who is the controller. They can rely on their tool to delete or unsubscribe the person.

Is Carton Blanc GDPR compliant?

Carton Blanc hosts data in the European Union, acts as a processor under article 9 of the terms of sale and offers unsubscribing and export. Compliance of the use also depends on the organiser; this guide does not replace legal advice.