Additional information for people in the European Union, the European Economic Area, Switzerland and the United Kingdom. It supplements the Privacy Notice and the Terms.
1. Controller and representatives
- Controller: [PENDIENTE: Razón social / nombre legal del titular], [PENDIENTE: Domicilio completo (calle, número, colonia, C.P., ciudad, estado, país)] · [PENDIENTE: Correo de privacidad (p. ej. privacidad@wepassly.com)].
- EU representative (Art. 27 GDPR): [PENDIENTE: Representante en la UE (RGPD art. 27 / DSA art. 13): nombre y dirección].
- UK representative (Art. 27 UK GDPR): [PENDIENTE: Representante en el Reino Unido (UK GDPR art. 27): nombre y dirección].
- Data protection officer: [PENDIENTE: Persona o departamento responsable de datos personales / DPO].
2. Legal bases
Contract (Art. 6.1.b) to provide the service; legal obligation (6.1.c) for invoicing, accounting and responding to authorities; legitimate interest (6.1.f) for security and abuse prevention and, with respect to guests, so that the host can organize their event; consent (6.1.a) for analytics, the "remember account" feature and, as explicit consent (Art. 9.2.a), for health data provided by a guest. Details in Purposes.
You may object at any time to processing based on legitimate interest on grounds relating to your particular situation.
3. International transfers
Your data is processed in the United States and, where applicable, in Mexico. We use the European Commission's standard contractual clauses (Decision 2021/914) and the UK addendum, or the EU-U.S. Data Privacy Framework when the provider is certified, together with supplementary measures (encryption, minimization, access control). You can request a copy of these safeguards at [PENDIENTE: Correo de privacidad (p. ej. privacidad@wepassly.com)]. We do not send personal data to countries without adequate safeguards.
4. Your rights and the supervisory authority
Access, rectification, erasure, restriction, portability, objection, withdrawal of consent and the right not to be subject to decisions based solely on automated processing with significant effects (Passly does not make such decisions). You can exercise them in the Privacy Center and we respond within one month.
You can lodge a complaint with the supervisory authority of your country of residence, of your place of work or of the place of the alleged infringement (in Spain, the AEPD; in the United Kingdom, the ICO).
6. Digital Services Act (DSA)
- Point of contact for authorities (Art. 11) and for users (Art. 12): [PENDIENTE: Correo legal (p. ej. legal@wepassly.com)]. Languages: Spanish and English.
- Legal representative in the EU (Art. 13): [PENDIENTE: Representante en la UE (RGPD art. 27 / DSA art. 13): nombre y dirección].
- Notice of illegal content (Art. 16): form in Intellectual Property.
- Statement of reasons and appeal (Art. 17): when we restrict content or an account, we explain the reason and how to appeal (Terms).
7. Consumer rights
If you are a consumer, you have a 14-day right of withdrawal and an online withdrawal function: see Withdrawal. The mandatory consumer protection rules of your country of residence also apply to you, and you can bring a claim before its courts.
8. Artificial Intelligence Act
We indicate which content has been generated with AI and how our AI features work in Use of artificial intelligence.
Version history
- v1.0 · October 1, 2026 · Material change — First published version.