The GDPR does not require the consent of the data subjects for processing. The GDPR requires that you have a legal basis for processing per Art 6. Here, there might be a legitimate interest for processing, in particular the legitimate interest of the party planner. Before relying on legitimate interest as a legal basis, you must do a balancing test to ensure that the legitimate interest outweighs the affected rights and freedoms of the data subject. You should also implement safeguards to limit abuse.
- within one month
- at the time of the first communication with the data subject
- when the information is disclosed to a third party
Here, it seems likely that your system would send out invites to all involved persons. In that invite, you should also make the Art 14 information available, in particular the information that the data subject can object (Art 21) to further processing: legitimate interest means opt-out.
The point of being a data controller vs a data processor is a good one, but doesn't quite apply here. A data processor is bound by some contract per Art 28, which is common/necessary in a B2B context. You could structure your signup flow so that such a contract is formed with the party planner, and the party planner would then be the sole data controller who would be responsible for selecting a suitable legal basis and providing information to data subjects.
But don't do that. Such terms would likely run into consumer protection issues and might be unenforceable. Being a processor is also not a get-out-of-jail-free card, because you still have substantial compliance obligations towards the controller.
More reasonably, you and the party planner are joint controllers per Art 26. The party planner is responsible for legally sharing the data about guests with you and for the processing they do, and you are fully responsible for any data processing or storage you do. This is the model under which consumer-facing internet services generally operate.