PassKit In-App Privacy Notice Pass Holders

1. Who is responsible for your data?

Your digital wallet pass (for example, a membership card, loyalty card, ticket, voucher, or stored value pass in Apple Wallet or Google Wallet) is issued by the business that provided it to you (the “Issuing Merchant”). The Issuing Merchant determines why and how your personal information is used.

PassKit, Inc. (“PassKit”, “we”, “us”, or “our”) provides the technology platform that powers the wallet pass. When we process personal information related to your pass, we do so solely on behalf of the Issuing Merchant and in accordance with their documented instructions.

PassKit processes personal information under a written data processing agreement with the Issuing Merchant. In data protection terms, the Issuing Merchant is the data controller and PassKit is a data processor (or service provider).

2. What information may be processed?

When you add or use a wallet pass powered by PassKit, the following categories of information may be processed on behalf of the Issuing Merchant:

• Pass identifier (unique pass ID stored on your device)
• Membership or account number
• Points balance or stored value
• Tier or status level
• Voucher or reward information
• Activation, update, and expiry dates
• Date and time of transactions or updates
• Limited technical information required to deliver, maintain, and update the pass (such as wallet platform or device type)

PassKit does not collect payment card numbers, bank account details, or other sensitive financial information through wallet passes.

3. Why this information is processed

Personal information associated with your wallet pass is processed for purposes such as:

• Issuing and delivering the wallet pass
• Validating access, rewards, tickets, or membership status
• Updating balances, tiers, or rewards following transactions
• Preventing fraud, abuse, or misuse of the programme
• Maintaining platform security, integrity, and reliability

PassKit does not use pass holder personal information for independent marketing purposes. We may use aggregated or anonymised information (which does not identify individuals) to improve our services.

4. Your privacy rights

The Issuing Merchant controls how your personal information is used in connection with your wallet pass. If you wish to exercise any privacy rights (such as access, correction, deletion, restriction, or objection), please contact the Issuing Merchant directly.

Where required under applicable law, PassKit will support the Issuing Merchant in responding to valid data subject requests in accordance with our contractual obligations. If you contact PassKit directly, we may forward your request to the Issuing Merchant.

5. Sub-processors and data sharing

PassKit uses trusted infrastructure providers and service providers (“sub-processors”) to operate and support the platform. These sub-processors are subject to contractual confidentiality and data protection obligations.

PassKit may also disclose personal information where required by law or to protect the rights, safety, or security of PassKit or others.

6. International data transfers

Personal information may be processed in the United States, United Kingdom, European Economic Area, or other jurisdictions where PassKit or its sub-processors operate. Where required by law, PassKit implements appropriate safeguards for international data transfers in accordance with applicable data protection legislation.

7. Security and retention

PassKit implements technical and organisational safeguards designed to protect personal information, including access controls, encryption, monitoring, and other security measures appropriate to the nature of the data processed.

Personal information is retained only as long as necessary to provide services to the Issuing Merchant and to comply with applicable legal obligations. The Issuing Merchant determines the retention period for wallet pass data.

8. Contact information

For questions about your specific wallet pass, membership, rewards, or transactions, please contact the Issuing Merchant directly.

For questions about PassKit's role as a platform provider:
Email: privacy@passkit.com

PassKit, Inc.
131 Continental Drive, Suite 301
Newark, Delaware 19713
United States