Privacy Policy
When you use Passcreator, you trust us with your data. We are aware of this responsibility and explain in this privacy policy what data we collect, how we process it and what security measures we take. It applies to our website passcreator.com and to the Passcreator platform, which our customers use to create, distribute and manage digital wallet passes.
Passcreator is aimed at business customers. If you save a wallet pass on your smartphone, you are an end user. In that case, the company that issued the pass is responsible for protecting your personal data, and its privacy policy applies to you. At the end of this policy we additionally explain how wallet apps handle data in general.
1. Data protection at a glance
General information
The following information provides a simple overview of what happens to your personal data when you use this website or the Passcreator platform. Personal data is any data by which you can be personally identified. Detailed information on data protection can be found in the privacy policy set out below this text.
Data collection on this website
Who is responsible for data collection on this website?
Data processing on this website is carried out by the website operator. You can find the operator's contact details in the section "Information on the controller" in this privacy policy.
How do we collect your data?
On the one hand, your data is collected when you provide it to us. This may be data you enter in a contact form or provide when registering a Passcreator account.
Other data is collected automatically or with your consent by our IT systems when you visit the website. This is mainly technical data (e.g. internet browser, operating system or time of the page view). This data is collected automatically as soon as you enter this website.
What do we use your data for?
Some of the data is collected to ensure that the website and the platform are provided without errors. Other data may be used to analyse your user behaviour. Where contracts are concluded or initiated via the website, the data transmitted is also processed for contract offers, orders or other order enquiries.
What rights do you have regarding your data?
You have the right at any time to receive information free of charge about the origin, recipients and purpose of your stored personal data. You also have the right to request the rectification or erasure of this data. If you have given consent to data processing, you can revoke this consent at any time with effect for the future. You also have the right, under certain circumstances, to request the restriction of the processing of your personal data. Furthermore, you have the right to lodge a complaint with the competent supervisory authority.
You can contact us at any time regarding this and any other questions on data protection.
Analysis tools and third-party tools
When you visit this website, your surfing behaviour may be statistically evaluated. This is done primarily with so-called analysis programs. Detailed information on these analysis programs can be found in the following privacy policy.
2. Hosting and content delivery networks (CDN)
We host the content of our website and the Passcreator platform with the following provider:
Hetzner
The provider is Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (hereinafter Hetzner). The servers are located exclusively in data centres within the European Union. For details, please refer to Hetzner's privacy policy: https://www.hetzner.com/legal/privacy-policy/.
Hetzner is used on the basis of Art. 6(1)(f) GDPR. We have a legitimate interest in the most reliable presentation of our website and provision of our platform. If corresponding consent has been requested, processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and Section 25(1) TDDDG, insofar as the consent includes the storage of cookies or access to information in the user's device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent can be revoked at any time.
Data processing agreement
We have concluded a data processing agreement (DPA) for the use of the above service. This is a contract required by data protection law, which ensures that the provider processes the personal data of our website visitors and users only in accordance with our instructions and in compliance with the GDPR.
Myra
This website uses services of Myra Security GmbH, Landsberger Str. 187, 80687 Munich, Germany. Myra provides a security platform that includes encrypted data transmission (TLS/"SSL"), a content delivery network (CDN) to optimise delivery of the website and a web application firewall (WAF) to protect against cyberattacks and other abusive access.
When the website is used, requests are technically routed through Myra's systems and automatically analysed there in order to detect and ward off attacks and to ensure the availability and performance of the online offering. In particular, the following data may be processed: the IP address of the requesting device, the content accessed and the time of access, information on browser and operating system, transmitted header information and other log data required for detecting and defending against attacks.
Technically necessary cookies and comparable technologies may be used to operate the Myra services; these are assigned to the category "Necessary" in the website's consent banner. They are required for the secure operation and basic functionality of the website and cannot be deselected.
Processing is carried out for the purpose of providing the website securely and stably, ensuring the confidentiality and integrity of transmitted data and protecting IT systems against overload and other attacks. The legal basis is Art. 6(1)(f) GDPR. The legitimate interest lies in ensuring the technical security of the website and warding off threats. The use of Myra is necessary for the secure technical operation of the online offering. Insofar as the use of Myra technologies falls within the scope of Section 25(2) TDDDG, it is carried out to provide a telemedia service expressly requested by the user.
A data processing agreement pursuant to Art. 28 GDPR exists between the controller of this website and Myra, providing for appropriate technical and organisational measures to protect personal data. Further information on data processing by Myra can be found in Myra Security's privacy policy: https://www.myrasecurity.com/en/privacy/
3. General information and mandatory information
Data protection
The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.
When you use this website or the Passcreator platform, various personal data is collected. Personal data is data by which you can be personally identified. This privacy policy explains what data we collect and what we use it for. It also explains how and for what purpose this is done.
We would like to point out that data transmission on the internet (e.g. when communicating by e-mail) may have security gaps. Complete protection of data against access by third parties is not possible.
Information on the controller
The controller for data processing on this website and the Passcreator platform is:
Passcreator GmbH
Walter-Gropius-Str. 15
80807 Munich, Germany
Commercial register: HRB 232134, Munich Local Court
VAT ID: DE815685987
Phone: +49 89 2500 7997
E-mail: hello@passcreator.com
The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data (e.g. names, e-mail addresses, etc.).
Storage period
Unless a more specific storage period is stated in this privacy policy, your personal data will remain with us until the purpose for the data processing no longer applies. If you assert a legitimate request for erasure or revoke your consent to data processing, your data will be deleted unless we have other legally permissible reasons for storing your personal data (e.g. retention periods under tax or commercial law); in the latter case, deletion takes place once these reasons cease to apply.
General information on the legal bases for data processing
If you have consented to data processing, we process your personal data on the basis of Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR if special categories of data pursuant to Art. 9(1) GDPR are processed. In the case of explicit consent to the transfer of personal data to third countries, data processing is also based on Art. 49(1)(a) GDPR. If you have consented to the storage of cookies or to access to information in your device (e.g. via device fingerprinting), data processing is additionally based on Section 25(1) TDDDG. Consent can be revoked at any time. If your data is required for the performance of a contract or for the implementation of pre-contractual measures, we process your data on the basis of Art. 6(1)(b) GDPR. Furthermore, we process your data if this is necessary to fulfil a legal obligation on the basis of Art. 6(1)(c) GDPR. Data processing may also be carried out on the basis of our legitimate interest pursuant to Art. 6(1)(f) GDPR. The legal bases applicable in each individual case are explained in the following paragraphs of this privacy policy.
Data protection officer
We have appointed a data protection officer.
Karl Fröhlich
Certified data protection officer
E-mail: privacy@passcreator.com
Information on data transfers to third countries
As a rule, we process your data within the European Union or the European Economic Area. Where individual service providers process data in third countries, this is done only on the basis of an adequacy decision of the European Commission (for US providers, for example, a certification under the EU-US Data Privacy Framework) or the standard contractual clauses of the European Commission pursuant to Art. 46 GDPR, supplemented by additional safeguards where necessary. The mechanism that applies in each case is stated for the individual service in this privacy policy.
Recipients of personal data
In the course of our business activities, we work with various external parties. In some cases, this also requires the transfer of personal data to these external parties. We only pass on personal data to external parties if this is necessary in the context of the performance of a contract, if we are legally obliged to do so (e.g. transfer of data to tax authorities), if we have a legitimate interest in the transfer pursuant to Art. 6(1)(f) GDPR or if another legal basis permits the data transfer. When using processors, we only pass on our customers' personal data on the basis of a valid data processing agreement. In the case of joint processing, a joint controller agreement is concluded.
Revocation of your consent to data processing
Many data processing operations are only possible with your express consent. You can revoke consent you have already given at any time. The lawfulness of the data processing carried out until the revocation remains unaffected by the revocation.
Right to object to data collection in special cases and to direct marketing (Art. 21 GDPR)
IF DATA PROCESSING IS CARRIED OUT ON THE BASIS OF ART. 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION; THIS ALSO APPLIES TO PROFILING BASED ON THESE PROVISIONS. THE RESPECTIVE LEGAL BASIS ON WHICH PROCESSING IS BASED CAN BE FOUND IN THIS PRIVACY POLICY. IF YOU OBJECT, WE WILL NO LONGER PROCESS YOUR PERSONAL DATA CONCERNED UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS (OBJECTION PURSUANT TO ART. 21(1) GDPR).
IF YOUR PERSONAL DATA IS PROCESSED FOR THE PURPOSE OF DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH MARKETING; THIS ALSO APPLIES TO PROFILING INSOFAR AS IT IS RELATED TO SUCH DIRECT MARKETING. IF YOU OBJECT, YOUR PERSONAL DATA WILL SUBSEQUENTLY NO LONGER BE USED FOR THE PURPOSE OF DIRECT MARKETING (OBJECTION PURSUANT TO ART. 21(2) GDPR).
Right to lodge a complaint with the competent supervisory authority
In the event of breaches of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, their place of work or the place of the alleged breach. The right to lodge a complaint is without prejudice to any other administrative or judicial remedy.
Right to data portability
You have the right to have data that we process automatically on the basis of your consent or in performance of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another controller, this will only be done insofar as it is technically feasible.
Information, rectification and erasure
Within the framework of the applicable statutory provisions, you have the right at any time to free information about your stored personal data, its origin and recipients and the purpose of the data processing and, if applicable, a right to rectification or erasure of this data. You can contact us at any time regarding this and any other questions on the subject of personal data.
Right to restriction of processing
You have the right to request the restriction of the processing of your personal data. You can contact us at any time for this purpose. The right to restriction of processing exists in the following cases:
– If you dispute the accuracy of your personal data stored by us, we usually need time to verify this. For the duration of the verification, you have the right to request the restriction of the processing of your personal data.
– If the processing of your personal data was or is unlawful, you can request the restriction of data processing instead of erasure.
– If we no longer need your personal data but you need it to exercise, defend or assert legal claims, you have the right to request the restriction of the processing of your personal data instead of erasure.
– If you have lodged an objection pursuant to Art. 21(1) GDPR, a balance must be struck between your interests and ours. As long as it has not yet been determined whose interests prevail, you have the right to request the restriction of the processing of your personal data.
If you have restricted the processing of your personal data, this data may, apart from being stored, only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or a Member State.
SSL or TLS encryption
For security reasons and to protect the transmission of confidential content, such as orders or enquiries that you send to us as the site operator, this site uses SSL or TLS encryption. You can recognise an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock symbol in your browser line.
If SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.
Security measures
In accordance with Art. 32 GDPR, we take organisational, contractual and technical security measures in line with the state of the art to ensure that the processing of personal data complies with data protection law and to protect the data we process against accidental or intentional manipulation, loss, destruction or access by unauthorised persons. Our information security management system is certified to ISO/IEC 27001. The technical and organisational measures are described in our data processing agreement: https://www.passcreator.com/en/data-processing-agreement
4. Data collection on this website
Cookies
Our websites use so-called "cookies". Cookies are small data packets and do not cause any damage to your device. They are stored on your device either temporarily for the duration of a session (session cookies) or permanently (permanent cookies). Session cookies are automatically deleted at the end of your visit. Permanent cookies remain stored on your device until you delete them yourself or they are automatically deleted by your web browser.
Cookies may originate from us (first-party cookies) or from third-party companies (so-called third-party cookies). Third-party cookies enable the integration of certain services of third-party companies within websites (e.g. cookies for processing payment services).
Cookies have various functions. Numerous cookies are technically necessary, as certain website functions would not work without them (e.g. logging in to the Passcreator platform). Other cookies may be used to evaluate user behaviour or for advertising purposes.
Cookies that are required to carry out the electronic communication process, to provide certain functions you have requested (e.g. for login) or to optimise the website (e.g. cookies to measure the web audience) (necessary cookies) are stored on the basis of Art. 6(1)(f) GDPR unless another legal basis is specified. The website operator has a legitimate interest in storing necessary cookies for the technically error-free and optimised provision of its services. If consent to the storage of cookies and comparable recognition technologies has been requested, processing is carried out exclusively on the basis of this consent (Art. 6(1)(a) GDPR and Section 25(1) TDDDG); consent can be revoked at any time.
You can set your browser so that you are informed about the setting of cookies and only allow cookies in individual cases, exclude the acceptance of cookies for certain cases or in general, and activate the automatic deletion of cookies when closing the browser. If cookies are deactivated, the functionality of this website may be restricted.
You can find out which cookies and services are used on this website in this privacy policy.
Consent management (consent banner)
When you first visit our website, we show you a consent banner in which you decide which non-necessary cookies and services may be loaded. The banner was developed in-house by Passcreator; no third-party provider is used and no data is transferred to third parties.
We distinguish three categories: "Necessary" (required for the operation of the website, set without consent), "Analytics" (Google Analytics) and "Marketing" (Zoho PageSense, Google Ads). Services in the "Analytics" and "Marketing" categories are only loaded once you have consented in the banner. We store your selection in a technically necessary cookie on your device, together with the time of your decision, so that we can recognise your settings on subsequent visits and demonstrate consent. You can change or revoke your selection at any time via the website's cookie settings.
The legal basis for storing your selection is Art. 6(1)(c) GDPR in conjunction with Section 25(2) TDDDG (documentation obligation) and our legitimate interest in legally compliant consent management (Art. 6(1)(f) GDPR).
Server log files
The provider of the pages automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are: browser type and version, operating system used, referrer URL, host name of the accessing computer, time of the server request and IP address. This data is not merged with other data sources.
This data is collected on the basis of Art. 6(1)(f) GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimisation of its website and in detecting and investigating misuse. Log files are stored for security reasons for a maximum of seven days and then deleted. Data whose further retention is required for evidence purposes is excluded from deletion until the respective incident has been finally clarified.
Enquiries by e-mail, telephone or fax
If you contact us by e-mail, telephone or fax, your enquiry, including all resulting personal data (name, enquiry), will be stored and processed by us for the purpose of handling your request. We do not pass on this data without your consent.
This data is processed on the basis of Art. 6(1)(b) GDPR if your enquiry is related to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, processing is based on our legitimate interest in the effective handling of enquiries addressed to us (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR) if this has been requested; consent can be revoked at any time.
The data you send to us via contact enquiries remains with us until you request its erasure, revoke your consent to storage or the purpose for data storage no longer applies (e.g. after your request has been processed). Mandatory statutory provisions, in particular statutory retention periods, remain unaffected.
Zoho SalesIQ
We use Zoho SalesIQ (hereinafter "Zoho SalesIQ") to process user enquiries via our support channels or live chat systems. The provider is Zoho Corporation GmbH, II. Hagen 7, 45127 Essen, Germany (hereinafter "Zoho").
Messages you send to us are stored in the Zoho SalesIQ ticket system or answered by our staff in the live chat. When you communicate with us via Zoho SalesIQ, we and Zoho SalesIQ store, among other things, your name and e-mail address, if you have provided them, and your chat histories. The browser you use, your operating system, your IP address and your location are also recorded. This data is compiled in a profile.
Messages addressed to us remain with us until you request their erasure or the purpose for data storage no longer applies (e.g. after your enquiry has been processed). Mandatory statutory provisions, in particular statutory retention periods, remain unaffected.
Zoho SalesIQ is used on the basis of Art. 6(1)(f) GDPR. We have a legitimate interest in processing your enquiries as quickly, reliably and efficiently as possible. If corresponding consent has been requested, processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and Section 25(1) TDDDG, insofar as the consent includes the storage of cookies or access to information in the user's device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent can be revoked at any time.
Zoho processes the data of EU customers in data centres within the European Union.
We have concluded a data processing agreement (DPA) for the use of the above service. This is a contract required by data protection law, which ensures that the provider processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.
Further information can be found in the privacy policy of Zoho SalesIQ: https://www.zoho.com/salesiq/gdpr.html.
Zoho Desk (ticket system)
We manage support requests that reach us by e-mail, via the contact form or from the platform in the Zoho Desk ticket system. The provider is Zoho Corporation GmbH, II. Hagen 7, 45127 Essen, Germany (hereinafter "Zoho").
Zoho Desk stores your name, e-mail address, company, the content of your request and the processing history. Zoho processes the data of EU customers in data centres within the European Union.
Zoho Desk is used on the basis of Art. 6(1)(b) GDPR insofar as your request relates to a contract, and otherwise on the basis of Art. 6(1)(f) GDPR. We have a legitimate interest in handling requests quickly, traceably and efficiently. Requests addressed to us remain with us until you ask us to delete them or the purpose for storing the data no longer applies. Mandatory statutory retention periods remain unaffected.
We have concluded a data processing agreement (DPA) with Zoho. For details, see Zoho's privacy policy: https://www.zoho.com/privacy.html and https://www.zoho.com/gdpr.html.
Zoho CRM
We use Zoho CRM. The provider is Zoho Corporation GmbH, II. Hagen 7, 45127 Essen, Germany (hereinafter "Zoho").
Zoho CRM enables us, among other things, to manage existing and potential customers and customer contacts and to organise sales and communication processes. The use of the CRM system also enables us to analyse and optimise our customer-related processes. Customer data is stored on Zoho's servers in the European Union. Details of Zoho CRM's functions can be found here: https://www.zoho.com/crm/features.html.
Zoho CRM is used on the basis of Art. 6(1)(f) GDPR. The website operator has a legitimate interest in the most efficient possible customer management and customer communication. If corresponding consent has been requested, processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and Section 25(1) TDDDG, insofar as the consent includes the storage of cookies or access to information in the user's device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent can be revoked at any time.
Zoho processes the data of EU customers in data centres within the European Union. We have concluded a data processing agreement (DPA) with Zoho. For details, see Zoho's privacy policy: https://www.zoho.com/privacy.html and https://www.zoho.com/gdpr.html.
5. Use of the Passcreator platform
Registration and user account
You can register on the Passcreator platform to create, distribute and manage wallet passes. We use the data entered for this purpose only for the use of the respective offer or service for which you have registered. The mandatory information requested during registration must be provided in full. Otherwise we will reject the registration. User accounts are not public and are not indexed by search engines.
For important changes, such as to the scope of the offer or technically necessary changes, we use the e-mail address provided during registration to inform you.
The data entered during registration is processed for the purpose of implementing the user relationship established by the registration and, if applicable, for initiating further contracts (Art. 6(1)(b) GDPR).
Categories of data processed
In the course of platform use, we process the following categories of data of our customers and their users:
– Inventory data, e.g. names and addresses of customers and contact persons
– Contact data, e.g. e-mail addresses and telephone numbers
– Content data, e.g. text input, images and templates for wallet passes
– Contract data, e.g. subject matter of the contract, term, booked plan, billing and payment information
– Usage data, e.g. functions used, access times, number of passes created
– Meta and communication data, e.g. device IDs, IP addresses, log data
We process inventory, contact and contract data to fulfil our contractual services pursuant to Art. 6(1)(b) GDPR. In the course of registration, login and use of the platform, we store the IP address and the time of the respective user action. Storage is based on our legitimate interest and serves to protect users against misuse and other unauthorised use (Art. 6(1)(f) GDPR). This data is not passed on to third parties unless this is necessary to pursue our claims or there is a legal obligation pursuant to Art. 6(1)(c) GDPR.
Pass holder data (processing on behalf of customers)
Personal data that our customers include in wallet passes via the platform or upload for the distribution of passes (data of pass holders, i.e. end users) is processed by us exclusively on behalf of and in accordance with the instructions of the respective customer as a processor within the meaning of Art. 28 GDPR. The customer is the controller for this data. The basis is our data processing agreement, which also contains the technical and organisational measures and the list of our sub-processors: https://www.passcreator.com/en/data-processing-agreement
Payment processing and invoicing
To bill our services, we process our customers' billing and payment data on the basis of Art. 6(1)(b) GDPR and, to fulfil obligations under tax and commercial law, on the basis of Art. 6(1)(c) GDPR. We use the following service providers:
Stripe: Card payments and recurring payments are processed via Stripe. The provider is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland (hereinafter "Stripe"). Stripe receives the data required for the payment (name, e-mail address, billing address, payment method, amount). Pass data is stored exclusively by Stripe, not by us. Stripe may transfer data to Stripe, Inc. in the USA; the transfer is based on the standard contractual clauses of the EU Commission and Stripe's certification under the EU-US Data Privacy Framework. Details: https://stripe.com/privacy
Fastbill: We create and send invoices using the accounting software Fastbill from FastBill GmbH, Frankfurt am Main, Germany. Name, address, e-mail address, invoice items and payment status are processed. We have concluded a data processing agreement with Fastbill. Details: https://www.fastbill.com/datenschutz
E-mail sending via the platform (Mailjet)
E-mails sent by the platform are delivered through the Mailjet service. This covers system messages to our customers (e.g. registration confirmation, password reset, notices about the user account) as well as e-mails with which our customers distribute wallet passes to their pass holders, on request also from the customer's own sender address. The provider is Mailjet SAS, 4 rue Jules Lefebvre, 75009 Paris, France, a company of the Sinch group (hereinafter "Mailjet").
The recipient's e-mail address and name, the content and time of the message and technical delivery information (delivery status, bounces) are processed. We send system messages to customers on the basis of Art. 6(1)(b) GDPR. When sending wallet passes to pass holders, we act as a processor for our customer; in this case Mailjet is our sub-processor and is listed in the list of sub-processors of our data processing agreement. Mailjet is ISO 27001 certified and, according to its own statements, processes the data in data centres within the EU. We have concluded a data processing agreement with Mailjet. Details: https://www.mailjet.com/legal/privacy-policy/
Deletion of data and retention periods
The data stored by us is deleted as soon as it is no longer required for its intended purpose and no statutory retention obligations prevent deletion. If data is not deleted because it is required for other and legally permissible purposes, its processing is restricted. This applies, for example, to data that must be retained for commercial or tax reasons: six years pursuant to Section 257(1) HGB (German Commercial Code: commercial books, inventories, opening balance sheets, annual financial statements, commercial letters, accounting records, etc.) and ten years pursuant to Section 147(1) AO (German Fiscal Code: books, records, management reports, accounting records, commercial and business letters, documents relevant for taxation, etc.).
If you terminate your user account, its data will be deleted unless retention obligations under tax law prevent this. It is the responsibility of users to back up their data before the end of the contract. We are entitled to irretrievably delete all user data stored during the term of the contract after the contract ends.
We use automated processes for deletion. If a user does not log in to the platform for twelve months, they will receive two e-mails within a period of 30 days informing them that their user account will be deleted if they do not log in. We therefore advise users to keep their contact details, in particular their e-mail address, up to date and to add the sender domain passcreator.com to the permitted senders in their e-mail program.
6. Use of artificial intelligence (AI) systems
We use artificial intelligence systems, in particular language models and assistant tools built on them, to support our internal work. We use them to improve and automate internal workflows, for research and analysis, and to improve the quality and speed of our customer service, for example when preparing answers to enquiries, summarising cases or producing drafts.
In doing so, personal data available to us in the context of the respective business relationship or enquiry may be processed, in particular contact and communication data (e.g. name, e-mail address, company, content of a support request) as well as contract and usage data of our customers. We limit the input of personal data to what is necessary for the respective purpose.
AI systems support our staff. They do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). Results are reviewed by a person before they take effect externally.
The legal basis is our legitimate interest in providing our services efficiently and at a high level of quality and in improving our internal processes (Art. 6(1)(f) GDPR). Where the processing serves to handle an enquiry or to perform a contract, it is additionally based on Art. 6(1)(b) GDPR.
For this purpose we use providers of AI services as processors within the meaning of Art. 28 GDPR and have concluded data processing agreements with them. We select providers and contract models so that input data is not used to train the models. Where a provider processes data outside the European Economic Area, this is done on the basis of an adequacy decision of the European Commission (e.g. the EU-US Data Privacy Framework) or the EU standard contractual clauses. On request, we will name the providers currently in use.
Data entered into AI systems is not stored there for longer than necessary for the respective purpose. The retention periods stated in this policy apply to the underlying records (e.g. support requests, contract documents).
Data of pass holders that our customers process via the Passcreator platform is processed by us as a processor, solely on the instructions of our customers. We apply AI systems to such data only to the extent provided for in our data processing agreement and the list of sub-processors maintained there.
You may object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR), for example by e-mail to privacy@passcreator.com.
7. Analysis tools and advertising
Google Analytics
This website uses functions of the web analytics service Google Analytics (Google Analytics 4). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").
Google Analytics enables us to analyse the behaviour of website visitors. We receive various usage data such as page views, time spent on the site, operating systems used and the user's origin. This data is assigned to the user's device; it is not assigned to a user ID. Google Analytics uses technologies that enable the user to be recognised for the purpose of analysing user behaviour (e.g. cookies or device fingerprinting). Google Analytics 4 does not store the IP address by default; it is used only for rough location determination and then discarded.
Google Analytics is only loaded if you have consented to the "Analytics" category in the consent banner. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Consent can be revoked at any time via the cookie settings.
Google LLC is certified under the EU-US Data Privacy Framework, so an adequacy decision of the European Commission exists for data transfers to the USA; the standard contractual clauses of the European Commission apply in addition. We have concluded a data processing agreement with Google. User and event data stored at Google is deleted after 14 months. More information on how Google Analytics handles user data can be found in Google's privacy policy: https://support.google.com/analytics/answer/6004245?hl=en
Google Ads and conversion tracking
We use Google Ads, an online advertising programme of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). As part of Google Ads we use conversion tracking: if you reach our website via an ad placed by Google, a cookie is set that enables Google and us to recognise whether you have visited certain pages or performed an action (e.g. a registration or demo request). We only receive statistical evaluations, not information that would allow us to identify you personally. Google Ads may also be used to show visitors to our website interest-based ads within the Google advertising network (remarketing).
Google Ads is only loaded if you have consented to the "Marketing" category in the consent banner. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Consent can be revoked at any time via the cookie settings.
Google LLC is certified under the EU-US Data Privacy Framework; the standard contractual clauses of the European Commission apply in addition. Further information can be found in Google's privacy policy at https://policies.google.com/privacy and on Google Ads at https://policies.google.com/technologies/ads.
Zoho PageSense
This website uses the "Zoho PageSense" service of Zoho Corporation GmbH, II. Hagen 7, 45127 Essen, Germany. Zoho PageSense is a tool for web analysis and conversion optimisation. It records, among other things, page views, clicks, scrolling behaviour, interactions with page elements, A/B tests, heatmaps and, where applicable, funnels and form evaluations in order to statistically evaluate the use of the website and improve its structure and content.
Zoho PageSense uses cookies and comparable technologies for this purpose. These cookies are not technically necessary and are assigned to the category "Marketing" in the website's consent banner. In particular, the following data may be processed via these technologies: pages visited, time and duration of the visit, mouse movements and clicks, scroll depth, information on browser and operating system, referrer URL, approximate geographical origin based on the IP address and technical identifiers such as cookie ID, project and variant IDs.
The IP addresses of website visitors are only processed in shortened form. Shortening the IP address rules out a direct personal reference. The evaluation is otherwise based on pseudonymous identifiers, so that the controller cannot directly identify individual persons.
Zoho PageSense is only used if consent to the use of cookies in the category "Marketing" has been given in the consent banner. The legal basis for data processing is consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. The consent given can be revoked at any time with effect for the future via the website's cookie settings. Cookies in the category "Necessary" are not covered by this and serve exclusively for the operation and provision of the basic functionalities of the website.
A data processing agreement pursuant to Art. 28 GDPR exists between the controller of this website and Zoho, providing for appropriate technical and organisational measures to protect personal data. Zoho processes the data of EU customers in data centres within the European Union.
Further information on data processing by Zoho can be found in Zoho's privacy policy at https://www.zoho.com/privacy.html and in the specific information on Zoho PageSense at https://www.zoho.com/pagesense/ and https://www.zoho.com/pagesense/cookie-policy.html.
8. Newsletter
Newsletter data
If you would like to receive the newsletter offered on the website, we require an e-mail address from you as well as information that allows us to verify that you are the owner of the e-mail address provided and that you agree to receive the newsletter. No further data is collected, or only on a voluntary basis. We use newsletter service providers, described below, to handle the newsletter.
Zoho Campaigns
This website uses Zoho Campaigns to send newsletters. The provider is Zoho Corporation GmbH, II. Hagen 7, 45127 Essen, Germany (hereinafter "Zoho").
Zoho Campaigns is a service that can be used, among other things, to organise and analyse the sending of newsletters. The data you enter for the purpose of subscribing to the newsletter is stored on Zoho's servers in the European Union.
Data analysis by Zoho Campaigns
With the help of Zoho Campaigns, we are able to analyse our newsletter campaigns. For example, we can see whether a newsletter message has been opened and which links, if any, have been clicked. In this way we can determine, among other things, which links were clicked particularly often.
We can also recognise whether certain predefined actions were carried out after opening or clicking (conversion rate). For example, we can see whether you made a purchase after clicking on the newsletter. Zoho Campaigns also enables us to divide newsletter recipients into different categories ("clustering"). Newsletter recipients can be divided, for example, by industry, company size or region. In this way, newsletters can be better adapted to the respective target groups. If you do not want Zoho Campaigns to analyse your data, you must unsubscribe from the newsletter. We provide a corresponding link in every newsletter message for this purpose.
Data localisation
Zoho Campaigns uses data localisation. Customer data from the European Union is stored and processed exclusively in data centres within Europe. Assignment to the data region takes place automatically based on the domain selected during registration and the IP address. When registering via campaigns.zoho.eu, the European data centre is assigned by default. Further information on data localisation at Zoho and the data centres used can be found at https://www.zoho.com/know-your-datacenter.html and https://www.zoho.com/campaigns/help/developers/data-centers.html.
Data processing is based on your consent (Art. 6(1)(a) GDPR). You can revoke this consent at any time with effect for the future.
We have concluded a data processing agreement (DPA) for the use of the above service. This is a contract required by data protection law, which ensures that the provider processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.
Detailed information on the functions of Zoho Campaigns can be found at the following link: https://www.zoho.com/campaigns/features.html. Zoho Campaigns' privacy policy can be found at: https://www.zoho.com/privacy.html and https://www.zoho.com/gdpr.html.
Mailjet
We also use Mailjet to send newsletters and product information. The provider is Mailjet SAS, 4 rue Jules Lefebvre, 75009 Paris, France (hereinafter "Mailjet"). The data you enter for the purpose of subscribing to the newsletter is stored on Mailjet's servers in the EU.
With the help of Mailjet we can analyse our newsletter campaigns. For this purpose, the newsletters contain a so-called web beacon (a pixel-sized file) that is retrieved from Mailjet's server when the newsletter is opened. Technical information such as browser, system, IP address and time of retrieval is collected; we evaluate whether and when a newsletter was opened and which links were clicked. If you do not want Mailjet to analyse your data, you must unsubscribe from the newsletter. We provide a corresponding link in every newsletter message for this purpose.
Data processing is based on your consent (Art. 6(1)(a) GDPR). You can revoke this consent at any time with effect for the future. We have concluded a data processing agreement (DPA) with Mailjet. For details, see Mailjet's privacy policy: https://www.mailjet.com/legal/privacy-policy/
Storage period
The data you provide to us for the purpose of subscribing to the newsletter is stored by us or the newsletter service provider until you unsubscribe from the newsletter and is deleted from the newsletter distribution list after you unsubscribe or after the purpose no longer applies. We reserve the right to delete or block e-mail addresses from our newsletter distribution list at our own discretion within the scope of our legitimate interest pursuant to Art. 6(1)(f) GDPR. Data stored by us for other purposes remains unaffected.
After you unsubscribe from the newsletter distribution list, your e-mail address may be stored by us or the newsletter service provider in a blacklist if this is necessary to prevent future mailings. The data from the blacklist is used only for this purpose and is not merged with other data. This serves both your interest and our interest in complying with the legal requirements when sending newsletters (legitimate interest within the meaning of Art. 6(1)(f) GDPR). Storage in the blacklist is not limited in time. You can object to the storage if your interests outweigh our legitimate interest.
9. Plugins and tools
Google Fonts (local hosting)
This site uses so-called Google Fonts, provided by Google, for the uniform display of fonts. The Google Fonts are installed locally. No connection to Google servers takes place.
Further information on Google Fonts can be found at https://developers.google.com/fonts/faq and in Google's privacy policy: https://policies.google.com/privacy.
Google reCAPTCHA
We use the "Google reCAPTCHA" service ("reCAPTCHA") on this website to ensure that entries in forms in Passcreator are made by a natural person and not by automated programs (bots). The provider is Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google").
reCAPTCHA analyses the behaviour of website visitors based on various characteristics. This analysis begins automatically as soon as a page with embedded reCAPTCHA is accessed. In particular, the following data is processed for evaluation:
– IP address of the device used
– URL of the page on which reCAPTCHA is embedded (referrer)
– language set in the browser and time zone
– screen and window resolution
– installed browser plugins
– browser and operating system type
– mouse movements, scrolling and other interactions on the page accessed
– duration of the visit and keystrokes, where applicable
– existing Google cookies and an existing Google account, if you are logged in to Google.
Processing is carried out for the purpose of securing our online forms against abusive, automated use and ensuring the stability and security of our systems. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in securing the website and protecting against automated attacks and spam. Insofar as reCAPTCHA is only loaded after your consent as part of the consent banner, the additional legal basis is your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. If it is used as a technically necessary security measure, it is additionally based on Section 25(2) TDDDG.
Google operates servers worldwide, so personal data may also be processed outside the European Union. A transfer of personal data to the USA to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, cannot be ruled out. Google LLC is certified under the EU-US Data Privacy Framework, so an adequacy decision of the EU Commission pursuant to Art. 45 GDPR exists for data transfers to the USA. Standard contractual clauses of the EU Commission may also be used.
Further information on data processing in connection with reCAPTCHA can be found in Google's privacy policy at https://policies.google.com/privacy and in the reCAPTCHA-specific information at https://developers.google.com/recaptcha.
10. Amendment of this privacy policy
We reserve the right to amend this privacy policy so that it always complies with current legal requirements or to implement changes to our services or data processing. The new privacy policy will then apply to your next visit. We ask users to inform themselves regularly about its content.
11. Privacy information for end users (pass holders)
If you download wallet passes (content e.g. for Apple Wallet, Google Wallet or third-party apps on Android), there is usually no direct contractual relationship between you and Passcreator. The controller for the processing of your data is the issuer of the pass, i.e. the Passcreator customer. We process your data on its behalf. Below we summarise information that is relevant when using wallet passes. When a Passcreator customer provides passes, it decides whether Google Wallet or a third-party app is used on Android devices. Apple Wallet is always used on iPhones. The functionality of the three variants is explained below.
Passes in Apple Wallet (iOS)
When you save a pass created with Passcreator in the Wallet app on your iPhone, you usually visit a website first. This so-called download page is delivered via our infrastructure (Hetzner, Myra), may use Google reCAPTCHA and may contain personal data. Whether personal data is included depends on how the issuer (the Passcreator customer) configures the wallet pass. Wallet passes are small files that contain all the information needed to display the pass, such as images and text.
Once you save the wallet pass, your iPhone sends a message to the Apple Push Notification Service (APNS) including a random identifier (Device Library Identifier). This identifier is also sent to Passcreator by your phone. It is used to update wallet passes but does not identify you personally in any way. If the wallet pass contains personal information, the issuer can see whether the pass has been stored on your phone. The wallet pass information is only exchanged between you (your device) and Passcreator. The APNS service serves only as an intermediary to initiate communication.
If you delete the pass or disable push notifications, the APNS will notify us so that no updates will be sent to your phone from that point on. If the issuer updates the wallet pass, we send the identifier to the APNS. This in turn notifies your device that it should retrieve the updated wallet pass from Passcreator.
Passes on Android (third-party apps)
The third-party apps for displaying wallet passes on Android work as described for Apple Wallet, with the difference that Google's push notification service is used.
Passes on Android (Google Wallet)
Passes in Google Wallet are a fully server-based service. This means that the definition of what a pass looks like and what information it represents is stored on Google's servers. This is governed by Google Wallet's terms of use and privacy policy.
When you save a pass in Google Wallet, that pass was previously created on Google's servers (i.e. the images and text that appear on the pass are stored there). The moment you click the button to save the pass, the pass is linked to your Google account and automatically synchronised to all devices on which you have set up Google Wallet.
Your rights as a pass holder
Please address requests for information, rectification and erasure to the issuer of your pass, as the issuer is the controller within the meaning of the GDPR. If you contact us, we will forward your request to the issuer and support them in responding.
Version: September 2026