Privacy Policy

OpenArt do Brasil Ltda is the controller of data relating to site visitors, leads and customer representatives (account, billing and support data).

For end-user data uploaded by a customer (for example loyalty pass holders, ticket holders or credential holders), the customer is the controller and PassFlow acts as processor, processing data only under the customer's lawful instructions and this Policy.

Account and contact data: name, business e-mail, phone, company, role.

Billing data: company name, tax ID, address and information required for invoicing (card data is handled by the payment provider).

Usage and technical data: IP address, access timestamps, device type, browser, pages visited, application and API logs, also kept to comply with the Brazilian Internet Act.

Data contained in passes issued by the customer: identifiers, name, member number, point balance, seat number, validity and other configured fields.

Cookies and similar technologies, as described in the Cookie Policy.

Providing and operating the platform, issuing and updating passes: performance of contract.

Billing, collection and tax duties: compliance with legal obligation.

Security, fraud prevention and logging: legitimate interest and legal obligation.

Support, improvements and operational communications: performance of contract and legitimate interest.

Marketing communications: consent, revocable at any time.

We share data only as necessary with: cloud infrastructure and hosting providers; Apple Inc. and Google LLC, to issue, update and deliver passes to their wallets; payment and invoicing providers; communication and support tools; and public authorities where required by law or court order.

Some providers may process data outside Brazil. In those cases we rely on contractual clauses and adequate safeguards under LGPD articles 33 and following.

We do not sell personal data.

We keep data as long as necessary for the stated purposes: account data during the contract and up to 5 years afterwards for the regular exercise of rights; access logs for at least 6 months; tax documents for the statutory periods.

End-user data processed as processor is deleted or returned to the customer after the service ends, unless legal retention applies.

We apply technical and organizational measures consistent with the state of the art, including encryption in transit, role-based access control, environment segregation, audit logging and backups.

No system is fully immune. In the event of a relevant security incident we will notify data subjects and the Brazilian data protection authority (ANPD) as required by law.

Under LGPD article 18, data subjects may request: confirmation of processing; access; correction; anonymization, blocking or deletion of unnecessary or non-compliant data; portability; information about sharing; withdrawal of consent; and objection to processing based on legitimate interest.

Requests should be sent to contact@passflow.lat and are answered within statutory deadlines after identity verification.

If your data appears in a pass issued by one of our customers, we forward the request to that controller.

The platform is not intended for people under 18. We do not knowingly collect data from children or adolescents without specific, prominent consent from a parent or legal guardian.

We use essential cookies and, subject to consent, performance and preference cookies. Details and controls are in the Cookie Policy.

This Policy may be updated. The version in force is always the one published on this page, with the update date shown at the top.