Effective 09 October 2026 · Version 1.0

Privacy Policy

How PassEU handles account, organization, service and public-passport data—and the choices available to people.

Draft for legal review

Add the controller identity, address, privacy contact, processors, transfer mechanism and final retention schedule before launch.

1. Scope and roles

This Policy covers personal data processed through the PassEU marketing site, account area, workspace, support channels and public passport pages.

For account administration, billing, security and direct service communications, the PassEU contracting entity acts as controller. For personal data an organization places in product records under its own instructions, that organization is normally the controller and PassEU acts as its processor. The exact role depends on the processing context.

2. Data we collect

Account data: name, work email, password credential or OAuth identifier, preferred language and authentication events.
Organization data: company name, role, team membership, invitations, permissions and billing contacts.
Product and passport data: uploaded records, evidence, files, change history and publication activity, including personal data a customer chooses to include.
Billing data: plan, transaction status, invoices, tax details and limited payment metadata received from a payment provider.
Technical data: IP address, device and browser details, timestamps, logs, security events and cookie or local-storage identifiers.
Support data: messages, attachments, diagnostics and feedback sent to us.

3. Purposes and legal bases

PurposeTypical legal basis

Create accounts, provide workspace features and publish passports on instructionPerformance of a contract

Invoice customers and keep statutory recordsContract and legal obligation

Prevent abuse, protect accounts, diagnose faults and secure the serviceLegitimate interests and legal obligation where applicable

Answer support requests and manage the customer relationshipContract or legitimate interests

Optional analytics or marketing communicationsConsent where required; otherwise a permitted legitimate interest

4. Public passports

Information published to a public passport is intentionally accessible through its public URL and QR code. Search-engine visibility and downstream sharing may make public information difficult to fully retract.

Customers should avoid publishing personal data unless it is necessary, accurate and supported by a lawful basis. Unpublishing removes normal access through PassEU but may not remove copies previously saved by third parties.

5. Cookies and local storage

PassEU may use strictly necessary cookies or browser storage for sessions, security, language and interface preferences. Optional analytics or marketing technologies will be described in a separate consent interface before they are enabled where consent is required.

6. Who receives data

Data may be shared with authorized organization members and vetted providers that support hosting, authentication, payments, email, monitoring, support and analytics. Providers may process data only under appropriate contractual and security obligations.

We may also disclose data where required by law, to protect rights and safety, or as part of a corporate transaction subject to suitable confidentiality measures. PassEU does not sell personal data.

7. International transfers

If personal data is transferred outside the European Economic Area, PassEU will use an approved transfer mechanism where required, such as an adequacy decision or the European Commission's Standard Contractual Clauses, together with supplementary safeguards where appropriate. The final production notice will identify relevant transfer locations and mechanisms.

8. Retention

We retain personal data only for as long as needed for the stated purpose, including to provide the service, maintain security and audit records, resolve disputes, meet financial or legal obligations and enforce agreements.

Account and customer content are kept during the subscription and for a defined export or recovery period after closure. Security logs, invoices, backups and support records follow separate schedules. Exact production periods must be confirmed in the retention schedule before launch.

9. Your data protection rights

Depending on the circumstances and applicable law, you may request access, correction, deletion, restriction, portability or objection; withdraw consent at any time; and complain to your local data protection authority. Withdrawing consent does not affect processing already carried out lawfully.

For data controlled by a PassEU customer, contact that organization first. PassEU will assist the customer as required. We may need to verify identity before completing a request.

10. Security

PassEU uses proportionate technical and organizational measures designed to protect personal data, including access controls, encrypted transport, logging, backups and secure development practices. No online service can guarantee absolute security, so customers should also use strong authentication and appropriate role assignments.

11. Children

PassEU is a business service and is not directed to children. Accounts should be created only by people authorized to act for an organization. If you believe a child has provided personal data directly to PassEU, contact us so the situation can be reviewed.

12. Changes and contact

We will update this Policy when processing activities or legal requirements change. Material changes will be highlighted through an appropriate service or email notice.

Privacy questions and rights requests may be submitted through the contact page. The final notice will add the controller's legal name, postal address, dedicated privacy email and, where required, Data Protection Officer details.