Privacy Policy for the Passit Service
Updated 21.10.2026
1. Data Controller
PassIt Oy
Y: 3507189-6
Malminkatu 8
20100 TURKU
2. Contact Person for the Register
Juuso Vira
PassIt Oy
+358 40 159 8579
info@passit.fi
3. Name of the Register
Passit customer register
4. Purpose of Processing Personal Data
Personal data is processed to provide the Passit service, for customer service and communication related to the services, and to analyze and develop the service. In the Passit service, the user collects points and uses rewards, benefits, and multi-pass and membership cards at participating businesses. Personal data is processed to manage these points, rewards, benefits, and cards between the user and the business.
PassIt Oy also processes personal data to plan its own business operations, such as managing customer relationships between itself, its partners, and customers, as well as for marketing purposes, personalizing services, targeting marketing, ensuring usability and functionality, and preventing and investigating abuse.
Based on the marketing consent given by the user, businesses using the service can send the user targeted benefits and messages based on, for example, visits or accumulated points. Businesses receive statistics on their transactions, which do not show individual user data.
5. Data content of the register
The following types of data concerning the data subjects may be processed in the register:
Name
Role
ID (Passit identifier)
Update date
Age group, gender, and city (optional)
App language
Marketing consent and the time it was given or withdrawn
Number of stamps and points per business
Points issued, cancellations, and reward redemptions with timestamps
Received benefits and messages, as well as their reading and usage
Multi-pass and membership cards: top-ups, usage times, validity, and usage timestamps
Redeemed promo codes
Device identifier for push notifications
Apple Wallet and Google Wallet card details (name and Passit identifier)
Based on the information provided by the data subject and the actions performed in the service, marketing may be targeted to the data subject. We collect technical data about the use of the service and the technical features of the devices as described in more detail below. The collection of data is automatic. Such data includes:
IP address (and country of location), unique identification numbers used by devices, location data based on cell tower, WLAN, or GPS positioning (based on separate consent), device details, operating system type and software versions, browser type and language settings, actions and their times in the services, the website that referred to the service and the website to which the user moved from the service, server, and domain. If the user links their user account to third-party services, such as Facebook, Instagram, or another social media service, we receive the information specified in connection with the linking from that service.
The application uses location data with the user's permission to calculate the distance to the business. The distance is calculated on the user's device, and the location is not stored.
6. Regular sources of information
Registered by the user themselves through the Passit service. The service includes mobile applications for iOS and Android mobile operating systems. When visiting, the staff of the businesses using the service record points, reward and benefit redemptions, as well as multi-use and membership cards to the user's account. Public directories may be used to update personal data.
7. Disclosure of information
PassIt Oy may disclose information within the limits permitted and required by applicable legislation. Personal data may be disclosed to selected partners of PassIt Oy in order to provide the services.
PassIt Oy is the data controller. Businesses using the service process their customers' data on behalf of PassIt Oy. For its own business, the company can see the customer's name, points, multi-use and membership cards, and transactions. The business cannot see the user's data in other businesses.
The following data processors are used in providing the service: Google (Firebase and Google Cloud: database, login, server functions, and push notifications) and Apple and Google (Apple Wallet and Google Wallet cards, if the user adds the card).
The service uses artificial intelligence (Google Gemini) to generate statistical reports for businesses and to translate businesses' own texts. Only aggregated statistical data and the businesses' own texts are sent to the AI, not users' names, email addresses, or identifiers.
Data may be disclosed from the register for direct marketing purposes of partners, provided that the data subject has given their explicit consent to this. Partners may not disclose this data further.
Data may be disclosed in connection with a potential acquisition, merger, outsourcing, or business sale, as well as in connection with a group relationship or other financial association to the parties involved. We may also disclose user data to other third parties if the user has given their consent, for example, by connecting the service to third-party services, such as social media services or otherwise.
8. Data retention
PassIt Oy retains personal data only for as long as is necessary to provide the Passit service to registered users, or until the registered user deletes their user account from the Passit service or otherwise notifies PassIt Oy that they have stopped using the service.
Data is stored in electronic form on our service provider's servers, which are protected in accordance with industry standard practices. The servers are under continuous monitoring. We will be notified of any data breaches without delay and will immediately inform the parties concerned upon receiving such information.
9. Protection of the register
PassIt Oy uses up-to-date practices to protect personal data. This means that we use physical, administrative, and technical security measures to reduce the risk of personal data loss and to mitigate misuse, unauthorized access, disclosure, or modification. We store your personal data on secure servers, where only authorized personnel can access the data on these servers. The staff and owner of the business using the service can only see the customer data of their own business. PassIt Oy may also protect the user's personal data using Secure Sockets Layer ("SSL") or other similar encryption methods.
10. Cookies
The data controller uses cookies to implement the PassIt Oy service. A cookie is a small text file sent to and stored on the user's computer or other device. Cookies are used to facilitate the use of the application and to improve the user experience. Cookies can also be used to evaluate the use of the application and the marketing of services. Cookies do not harm users' computers or files.
Analysis services, such as Google Analytics, also use cookies to generate analyses and for user management. Third-party services are subject to their own privacy policies and terms of use, and PassIt Oy is not responsible for the collection or processing of data by these operators, including cookies and other tracking technologies as well as links. We recommend that you familiarize yourself with the terms of use and privacy statements of these third-party services.
11. Your rights
Right of access
You have the right to inspect what data concerning you has been stored in the register. We will provide the information in the format required by law.
Right to demand rectification of data
You have the right to demand the correction or completion of incorrect, inaccurate, incomplete, outdated, or unnecessary data. You can change your name, age group, gender, city, and application language yourself in the application profile.
Right to demand erasure of data
You can ask us to delete your personal data from our systems. You can also delete your user account yourself in the application profile. We will carry out the measures in accordance with your request, unless we have a legitimate reason not to delete the data. The data may not be immediately deleted from all our backup or other similar systems.
Right to restrict processing of data
You can ask us to restrict the processing of certain personal data. A request to restrict the processing of data may result in more limited opportunities to use our website and services.
Right to object to processing of data
You may also request restrictions on the processing of your personal data if your data is processed for purposes other than performing our service or fulfilling a legal obligation. Objecting to the processing of personal data may lead to more limited possibilities to use our website. You have the right to opt out of electronic direct marketing by following the instructions included in all marketing messages we send.
Right to data portability
You have the right to receive your personal data from us in a structured and commonly used format so that you can transmit the data to another controller.
Right to withdraw consent
If the processing of your data is based on consent, you have the right to withdraw your consent at any time. You can withdraw your marketing consent from the switch in the app profile, after which businesses will no longer be able to send you targeted rewards and messages.
You also have the right to lodge a complaint with a supervisory authority and the right to object to the use of your data for direct marketing purposes.
12. Changes to the privacy policy
PassIt Oy may change this privacy policy from time to time. We therefore encourage you to regularly check the privacy policy to notice any changes. Material changes will be notified to the email address provided by the user, or we will ask you to accept the new terms when they are introduced.