1. Who we are and what this notice covers
Passiro ApS, registration number 46722248, of Gammel Kongevej 60, 1850 Frederiksberg C, Denmark, operates Passiro and is the controller for the processing described in this notice. Contact us about privacy at privacy@passiro.com or through our contact form.
This notice covers visitors to our websites, prospective customers, account users, business and supplier contacts, and people who contact us. It applies across Free, Pro, Business and Enterprise and related services, whether or not you pay us. Separate notices may apply to recruitment or employment and will be provided where relevant.
When we process information about visitors to a customer's website on that customer's behalf, the customer determines the purposes of that processing and normally acts as controller. We act as its processor under our Data Processing Agreement. If the customer is itself a processor, we act as a sub-processor. The customer's privacy notice explains that website's processing. This distinction depends on the activity, not the subscription plan.
2. Information and sources
Depending on your interaction with us, we process:
- Account and contact information, such as name, business email, organisation, role, account identifiers and authentication information.
- Commercial information, such as selected plan, orders, billing contact, billing address, tax information, payment status and transaction references.
- Communications, including enquiries, support requests and information you choose to send us.
- Technical information, including IP addresses, browser and device information, timestamps, security events and relevant platform activity.
- Preference and evidence records, such as communication preferences, marketing-consent records and the version and time of contract acceptance.
We receive information directly from you, from your organisation's account administrator, from your use of our websites and Service, and from providers used for authentication or payment. If you select Google sign-in, we receive the identity information authorised and supplied through that sign-in flow: your Google account identifier, name and email address. We do not receive your Google password.
We do not buy contact lists or use data-enrichment services. We may receive business-contact information from events or partners you have dealt with. Where Article 14 GDPR or an equivalent transparency requirement applies because we obtained personal data from a source other than you, we will provide the required information within the applicable statutory timeframe, unless a lawful exception applies.
Public declarations contain the business and contact information customers choose to publish. Scans can encounter personal information in publicly available content, screenshots or URLs. Personal information within customer-controlled scan content and consent records is handled under the DPA where we process it on the customer's behalf.
3. Why we use information and our legal bases
Create and administer organisation accounts, give users access and deliver service communications
Information: Account, contact and relevant activity data
Legal basis: Our legitimate interests in providing the Service to your organisation, GDPR Article 6(1)(f). Where you personally are the contracting party, necessary processing instead relies on Article 6(1)(b).
Answer enquiries, demonstrate the Service and discuss a potential purchase
Information: Contact details, correspondence and business needs
Legal basis: Legitimate interests in responding to business enquiries, Article 6(1)(f); Article 6(1)(b) where taking requested steps towards a contract with you personally.
Process subscriptions, payments and accounting records
Information: Commercial and billing information
Legal basis: Article 6(1)(f) for administering organisational purchases, Article 6(1)(b) where you personally contract, and Article 6(1)(c) for applicable accounting and tax duties.
Provide support and resolve operational issues
Information: Correspondence and relevant account or technical information
Legal basis: Legitimate interests in supporting customers and maintaining a functioning service, Article 6(1)(f), or Article 6(1)(b) where applicable to your own contract. Customer content accessed on instructions remains governed by the DPA.
Protect accounts, detect misuse and investigate security events
Information: Authentication, IP, event and access data
Legal basis: Legitimate interests in protecting our systems and users, Article 6(1)(f), and specific legal duties under Article 6(1)(c) where applicable.
Understand and improve our own website and platform
Information: Necessary operational statistics, such as page requests and error reports, and feedback you send us. We do not use optional analytics tools.
Legal basis: Article 6(1)(f) for proportionate operational analysis not requiring consent. If we introduce optional analytics, we will rely on your consent under Article 6(1)(a) and ask for it first.
Send promotional emails
Information: Contact details and marketing preferences
Legal basis: Your consent under Article 6(1)(a), together with applicable electronic-marketing requirements. Refusing or withdrawing consent does not affect your account.
Manage supplier relationships and business administration
Information: Professional contact and correspondence data
Legal basis: Legitimate interests in running our business, Article 6(1)(f), and applicable legal obligations under Article 6(1)(c).
Document agreements and establish, exercise or defend legal claims
Information: Relevant agreement, communication and transaction records
Legal basis: Legitimate interests in evidencing agreements and protecting legal rights, Article 6(1)(f); Article 6(1)(c) where retention or disclosure is legally required.
We assess the necessity of processing based on legitimate interests and balance those interests against your rights. We do not use acceptance of our Terms as general consent to personal-data processing. We do not use customer visitor data for our own advertising or unrelated profiling under the processing described in the DPA.
4. Required information and optional choices
Information identified as required during signup or checkout is necessary to create and secure an account or fulfil the order. Without it, we may be unable to provide the requested function. Optional profile information, marketing consent and consent to optional website tracking are not conditions for using the Service.
Service messages about security, billing, agreed services and material contract changes are distinct from promotional messages. You can unsubscribe from promotional messages using the link provided or by contacting us at privacy@passiro.com.
5. Cookies and similar technologies
Our websites and platform use only necessary technologies for functions such as authentication, sessions and security. We do not use optional analytics or advertising technologies, so we do not ask for consent to them; if we introduce them, we will ask first, as described under Your choices in our Cookie Policy. Our Cookie Policy identifies the actual technologies, providers, purposes and lifetimes.
Customer websites have their own cookie choices and privacy notices. Agreeing to use Passiro does not consent on behalf of visitors to tracking on those websites.
6. Recipients
We disclose relevant information to providers supporting our hosting, infrastructure, authentication, communications, customer support and payment operations, as needed for the relevant purpose. Providers acting on our behalf are subject to appropriate contractual instructions and protections. Some payment or authentication providers may act as independent controllers for particular activities under their own notices.
The providers handling Passiro's own business data are:
- Cloudflare, Inc. (USA): website delivery, network security and protection of forms against automated misuse.
- Google Ireland Limited (Ireland): business email, support correspondence and, if you choose it, Google sign-in. Google acts as an independent controller for your Google account.
- Google Cloud EMEA Limited (Ireland, with storage in Finland): encrypted backups.
- Stripe Payments Europe, Limited (Ireland): payments, invoices and tax calculation. Stripe acts as an independent controller for some payment activities, such as fraud prevention and its own legal obligations.
Sub-processors that handle Customer Personal Data on our customers' behalf are listed in Annex 3 of the DPA.
Your organisation's authorised administrators can access account information and activity needed to manage that organisation's use. Information you publish in a hosted declaration is public. We may also disclose necessary information to professional advisers, competent authorities where law requires, or parties to a genuine business transfer subject to appropriate confidentiality and data-protection safeguards. We do not sell personal data.
7. International transfers
We host our application and databases on servers we operate ourselves in Denmark, and our backups are stored in Finland. Some providers belong to US groups or deliver content from the data centre nearest you, which may be outside the EEA, and provider support may access data from the United States. For those transfers we use the applicable lawful mechanism: the EU–US Data Privacy Framework where the recipient is certified, or the European Commission's standard contractual clauses, together with required assessments and supplementary measures. The providers and their locations are listed in section 6.
You can contact us at privacy@passiro.com or through our contact form for information about the mechanism for a particular transfer and a copy of the relevant safeguards, subject to lawful redaction. UK or other local transfer requirements will be addressed where applicable. Hosting in the EU does not, by itself, describe every potential provider transfer.
8. Retention
We keep information for the relevant purpose and delete or irreversibly anonymise it when no longer needed, subject to specific legal retention duties and necessary legal claims. The following periods apply:
Active account and profile information
Retention period or criterion: While the account remains active; deleted or irreversibly anonymised within 30 days after closure, except records separately needed below.
Sign-in history
Retention period or criterion: 12 months from each sign-in, so you and your organisation can review recent account access.
Accounting and tax records
Retention period or criterion: For the statutory period under the Danish Bookkeeping Act, which is 5 years from the end of the financial year to which the records relate.
Support correspondence
Retention period or criterion: 24 months after the request is resolved, unless needed for an identified ongoing dispute.
Security and technical logs
Retention period or criterion: No more than 30 days from collection; relevant incident records may be isolated until the investigation and any justified follow-up are complete, and no longer than 12 months unless needed for a legal claim.
Contract-acceptance and necessary dispute records
Retention period or criterion: During the agreement and for 5 years thereafter, assessed against applicable limitation periods and actual claims.
Unconverted sales enquiries
Retention period or criterion: 12 months after the last substantive interaction.
Community posts
Retention period or criterion: Published until you or a moderator remove them; removed or irreversibly anonymised within 30 days after your account is closed.
Marketing information
Retention period or criterion: Until withdrawal or 24 months without any interaction with us; limited evidence of consent retained for 5 years after it ends, and a minimal suppression record where needed to honour opt-outs.
Optional analytics
Retention period or criterion: Not applicable. We do not use optional analytics tools.
Backups of our controller data
Retention period or criterion: Deleted or overwritten within 90 days following operational deletion; access restricted to recovery needs.
Customer Personal Data, including consent logs and scan content, follows the customer's instructions and the separate DPA retention schedule. Closing an account is different from downgrading it: an account continuing on Free remains active. Irreversible anonymisation is different from replacing names with identifiers; identifiable or pseudonymous records remain personal data.
9. Your rights
Subject to the applicable conditions, you may request access, correction, deletion, restriction and portability of your personal data. You may object to processing based on legitimate interests, and you may object to direct marketing at any time. Where we rely on consent, you may withdraw it without affecting the lawfulness of earlier processing.
Contact us at privacy@passiro.com or through our contact form. We may request proportionate identity verification. We normally respond within one month; where the law permits an extension because of complexity or number of requests, we will explain it within that first month.
You may complain to the Danish Data Protection Agency, Datatilsynet, at Datatilsynet, or another competent supervisory authority, including in the EEA country where you live or work. You do not have to contact us first.
For information controlled by a customer website, contact that website's operator. If we receive a request about information we process on a customer's behalf, we will route it to the customer and assist under our DPA.
Additional rights under local law
Depending on where you live and whether a local privacy law applies to Passiro's processing as a controller, you may have additional rights, which can include rights to know or access personal information, correct it, delete it, obtain a portable copy, and opt out of certain sale, sharing, targeted advertising or profiling activities. We do not sell or share personal information, and we do not use it for targeted advertising or for profiling with legal or similarly significant effects, as those terms are defined in US state privacy laws. We will honour verified requests to the extent required by applicable law and will not unlawfully discriminate against you for exercising applicable privacy rights.
10. Security and automated decisions
We apply technical and organisational safeguards proportionate to the risks, including access restricted to authorised personnel, multi-factor authentication for administrative access, encryption in transit and at rest, regular encrypted backups, monitoring and documented processes for handling security incidents. The measures for data we process on customers' behalf are described in Annex 2 of the DPA.
We do not use solely automated decision-making that produces legal or similarly significant effects on you. If such processing is introduced, we will first provide the required information about its operation, significance, consequences and applicable rights.
11. Updates
We will keep this notice current and identify its latest version. Where a material change affects how we process your information, we will bring it to your attention through an appropriate direct notice before the new processing where required. If consent is required for a new purpose, we will obtain it separately. Continued use is not treated as consent to a revised privacy notice.