This Privacy Policy explains how Passumo ("Passumo", "we", "us") collects, uses, and protects personal data when you use our website and our digital loyalty-card service (the "Service"). We are committed to handling personal data in line with the EU General Data Protection Regulation (GDPR) and applicable data-protection law.
1. Who we are
Passumo provides digital loyalty cards that businesses ("Merchants") offer to their customers ("End Customers") through Apple Wallet and Google Wallet.
- For personal data about Merchants, website visitors, and Merchant account holders, Passumo is the data controller.
- For End Customer personal data collected through a Merchant's loyalty program, the Merchant is the controller and Passumo acts as a data processor on the Merchant's behalf, under the Merchant's instructions.
Passumo is not currently registered as a separate legal entity. You can reach the party responsible for privacy at hey@passumo.com.
2. Data we collect
From Merchants
- Account and contact details (name, email address).
- Business details used to build your loyalty card. During onboarding we may retrieve information about your business from public sources (for example, your public business listing and your website), such as business name, address, category, logo, and brand colours.
- Content you create in the Service, such as card designs and campaigns.
From End Customers who join a loyalty program
- Contact details you provide on a join page, such as name and email address or phone number, depending on how the Merchant configures the program.
- Loyalty activity, such as visits, stamps, points, and rewards redeemed.
- Wallet pass identifiers needed to issue and update your pass.
Automatically
- Basic technical data required to operate the Service securely (for example, IP address and device/browser information contained in server logs).
3. How we use personal data
- To provide, operate, and secure the Service.
- To issue loyalty passes to Apple Wallet and Google Wallet and keep them up to date as customers earn stamps or rewards.
- To send service and loyalty communications (such as pass updates and, where enabled, push notifications) on the Merchant's behalf.
- To provide support and respond to enquiries.
- To comply with legal obligations.
4. Legal bases (GDPR)
Where we act as a controller, we rely on:
- Performance of a contract: to provide the Service to Merchants who sign up.
- Legitimate interests: to secure, maintain, and improve the Service, where not overridden by your rights.
- Consent: where required, for example for optional communications; you may withdraw consent at any time.
- Legal obligation: where we must process data to comply with the law.
When we process End Customer data on a Merchant's behalf, the Merchant is responsible for establishing the lawful basis for that processing.
5. Sub-processors and service providers
We use a limited set of trusted providers to run the Service. They process personal data only as needed to provide their service to us:
- Supabase: application database, authentication, and hosting.
- Apple: Apple Wallet pass issuance and updates.
- Google: Google Wallet pass issuance and updates.
- Vercel AI Gateway: AI-assisted card and content generation.
- Unsplash: stock imagery used in card designs.
We do not sell personal data. A current sub-processor list is available on request at hey@passumo.com.
6. International transfers
Some providers may process data outside the European Economic Area. Where that happens, we rely on an appropriate transfer mechanism (such as the European Commission's Standard Contractual Clauses) to protect your data.
7. Retention
We keep personal data for as long as needed to provide the Service and for the purposes described above, and then delete or anonymise it, unless a longer period is required by law. Merchants control the retention of their End Customers' data and can request deletion at any time.
8. Your rights
Subject to applicable law, you may have the right to access, correct, delete, or receive a copy of your personal data (portability), to restrict or object to certain processing, and to withdraw consent. To exercise these rights, contact us at hey@passumo.com. If Passumo processes your data on behalf of a Merchant, we will forward your request to that Merchant or ask them to instruct us. You also have the right to lodge a complaint with your local data-protection authority.
9. Cookies
Our website uses only the cookies and local storage strictly necessary to operate. If we add analytics or marketing tools in the future, we will update this policy and, where required, ask for your consent.
10. Children
The Service is intended for businesses and is not directed at children. We do not knowingly collect personal data from children.
11. Changes to this policy
We may update this policy from time to time. When we do, we will revise the "Last updated" date above and, where appropriate, notify you.
12. Contact
Questions about this policy or your personal data? Email us at hey@passumo.com.