Privacy Policy

1. Who is responsible for your data

1.1 EPlanit, operated by the EPlanit founding team, London, is the data controller for the personal data described in this policy. EPlanit is in the process of incorporating as a limited company in England and Wales; the company name, number and registered office will be published here on incorporation.

1.2 We are registering with the Information Commissioner's Office and will publish our registration number here as soon as it is issued.

1.3 For anything about your data, contact hello@eplanit.co.uk.

1.4 Our data protection officer is not required for an organisation of our size; privacy questions go to hello@eplanit.co.uk.

2. Where your data comes from

Almost all of it comes from you: when you create an account, build a supplier profile, post a brief, send a message, or make a booking. We also generate some data about how you use the platform, and we receive confirmation of identity and payment status from Stripe.

3. What we collect, and why

The table below is organised by what the platform actually stores.

3.1 Account data

3.2 Supplier profile data

3.3 Brief data

3.4 Messages

3.5 Booking and payment data

When the booking and payment flow goes live we will hold the record of each booking, what was agreed, what was paid and when, and our commission. Card details are handled by Stripe and are never stored on our systems.

3.6 Technical data

IP address, browser and device information, pages visited and actions taken. We use this to keep the service secure, to diagnose faults and to understand how the platform is used. Our lawful basis is legitimate interests, and for any non-essential analytics or marketing cookies, your consent.

4. Sensitive information in briefs and messages

This section exists because of what an events platform inevitably collects. Briefs and messages are free text, and the nature of events means they will sometimes reveal information that UK GDPR treats as special category data, needing stronger protection.

• Religious or philosophical belief: a christening, a bar mitzvah, an Eid celebration, a Hindu wedding, or a request for halal or kosher catering.

• Health: allergies and dietary requirements told to a caterer or cake maker, accessibility needs, or the circumstances behind a memorial event.

• Sexual orientation: a same-sex wedding.

• Data about children: a child's name, age or photograph in a brief for a children's party.

We do not ask for any of this, and you should not include more of it than a supplier needs. Where it is present, we hold it only to pass it to the suppliers you are dealing with and to keep the record of your booking, and we do not use it for any other purpose.

5. Who we share your data with

We do not sell your personal data, and we do not share it with advertisers.

6. Sending data outside the UK

6.1 Our database and files are hosted in Ireland. Transfers from the UK to the EEA are permitted under the UK adequacy regulations.

6.2 Stripe may process data in the United States. Those transfers rely on the UK extension to the EU-US Data Privacy Framework, or on the International Data Transfer Agreement, together with appropriate safeguards.

6.3 Where we use any other provider outside the UK or EEA, we put appropriate safeguards in place before doing so.

7. How long we keep it

8. Your rights

Under UK GDPR you have the right to:

• be told how your data is used, which is what this policy does;

• get a copy of the data we hold about you;

• have inaccurate data corrected;

• have data deleted, where we no longer need it and no legal obligation requires us to keep it;

• restrict or object to how we use it, including objecting to processing based on legitimate interests;

• receive your data in a portable format;

• withdraw consent at any time, where we relied on consent;

• object to direct marketing at any time, with no exceptions.

To exercise any of these, email hello@eplanit.co.uk. We respond within one month, and will tell you if we need longer because the request is complex. There is no charge.

Deleting your account does not delete everything immediately. We keep booking, payment and message records for the periods in section 7, because tax law requires some of it and because the other party to a booking has rights too.

9. Cookies

We use cookies that are strictly necessary to run the site and keep you signed in, which do not need your consent. Any analytics, performance or marketing cookies are used only with your consent, given through the cookie banner, and you can change your choice at any time.

10. Security

Data is encrypted in transit and at rest. Access to the production database is limited to those who need it. Row-level security is enabled on every table so users can reach only their own records. Payment card details never touch our systems.

If a breach occurs that risks your rights and freedoms, we will report it to the ICO within 72 hours and tell you where the risk to you is high.

11. Marketing

We send service messages about your account, briefs and bookings, which are part of the service and not marketing. We send marketing only where you have agreed, or where you are an existing user and we are telling you about similar services, and every marketing message has an unsubscribe link.

12. Children

EPlanit is for adults. You must be 18 or over to hold an account. We do not knowingly collect data from children, but a planner may include information about a child in a brief for a children's party. Please include only what the supplier needs.

13. Changes to this policy

We will update this policy when the platform changes, in particular when the booking and payment flow goes live. Where a change is material we will tell you by email. This is version v0.1, prepared 14 August 2026.

14. Complaints

Tell us first at hello@eplanit.co.uk and we will try to put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk, or on 0303 123 1113.