Data Processing Agreement (DPA)

Subject matter: hosting and processing of data required to create, issue, distribute, update, void and analyse digital passes compatible with third-party wallets.

Duration: for the term of the agreement, plus the retention periods in clause 8.

Nature and purpose: automated collection, storage, use, transmission, update and deletion, solely to provide the contracted service.

Categories of data subjects: end customers, employees, members, guests, passengers, visitors and other individuals to whom the Customer issues passes.

Categories of data: identity and contact data (name, email, phone), pass identifiers (serial number, barcode, membership or seat number), pass usage data (install, update, removal) and technical metadata (IP address, device, access logs).

The Customer must not upload sensitive personal data, children's data or full financial data without a specific prior written agreement with PassFlow.

Process personal data only under the Customer's documented instructions, unless required by law, in which case PassFlow will notify the Customer in advance where permitted.

Never sell, rent, share for advertising or use Customer data for its own purposes, except for aggregated and anonymised platform performance statistics.

Maintain confidentiality, including through equivalent written commitments from staff and contractors.

Apply the technical and organisational measures described in the Security & SLA policy.

Reasonably assist the Customer, within available platform features, with data subject requests, impact assessments and regulator communications.

Ensure a valid legal basis and transparency towards data subjects for all personal data uploaded or processed, including its own privacy notice.

Ensure accuracy, relevance and minimisation of the data submitted, and correctly configure retention, permissions and integrations.

Respond, as Controller, to data subject requests and competent authorities, including the ANPD.

Additional instructions requiring development, extraordinary resources or a change of scope may be charged separately or refused where technically unfeasible or unlawful.

The Customer grants general authorisation for PassFlow to engage sub-processors, notably cloud infrastructure, transactional email, observability, support and anti-fraud providers.

PassFlow imposes data protection obligations on each sub-processor that are no less protective than this DPA, and remains liable to the Customer for their acts.

An up-to-date list of relevant sub-processors is available on request. Material changes are notified with reasonable notice; the Customer may object on reasonable grounds and, absent a solution, terminate the affected part of the service without penalty.

The service is delivered in Brazil, and processing may occur in datacentres of global providers located abroad for hosting, redundancy and content delivery.

In such cases PassFlow relies on mechanisms permitted by the LGPD, such as standard contractual clauses, specific contractual safeguards or transfers to countries with an adequate level of protection.

PassFlow will notify the Customer without undue delay, and as a rule within 48 hours of confirmation, of any security incident likely to create relevant risk or harm to data subjects.

The notice will contain the information then available on the nature of the incident, data involved, measures taken and recommendations, and will be supplemented as the investigation progresses.

Notification to the ANPD and to data subjects is the Customer's responsibility as Controller, with reasonable support from PassFlow.

The platform provides lookup, correction, export, voiding and deletion features for passes and related data, enabling the Customer to respond directly to data subject requests.

If a data subject contacts PassFlow directly, the request is forwarded to the Customer unless the law requires otherwise.

On termination, the Customer may export its data within 30 calendar days.

After that period, personal data is deleted or anonymised within 90 days, except where retention is required to comply with legal or regulatory obligations, for the regular exercise of rights, or for access logs required by the Brazilian Internet Act.

Backup copies are overwritten according to the technical retention cycle and remain subject to the same confidentiality and security obligations.

On reasonable request and at most once every 12 months, PassFlow will provide documentation and questionnaire responses evidencing compliance with this DPA.

On-site audits or penetration tests require prior written agreement, at least 30 days' notice, a confidentiality undertaking, a defined scope and Customer funding, with no impact on service availability or other customers' data.

Liability under this DPA is subject to the limitations of liability in the Terms of Use, except where prohibited by law.

In case of conflict between this DPA and the Terms of Use regarding personal data protection, this DPA prevails. For all other matters, the Terms of Use prevail.

Data Protection Officer contact: contact@passflow.lat.