1. Data controller
Passly is operated by LABS Beyond AB (“Passly”, “we”, “us”). LABS Beyond AB is the data controller for the processing of personal data described in this policy.
If you have questions about this policy or how we process your personal data, contact us at hello@passly.se.
2. What personal data we collect
We collect personal data that you provide directly and data generated when you use the service. We may also receive data from connected systems, such as Shopify and Fortnox, when you enable integrations.
- Identity and account data, such as name, email address and login information.
- Business data, such as company details and service settings.
- Integration data from Shopify and Fortnox, such as orders, products, inventory changes, invoices and accounting records.
- Ticket and event data, such as ticket IDs, QR and check-in status and event information provided by customers.
- Support and communication data from email and other contact channels.
- Technical and security data, such as IP address, browser and device data, logs and event timestamps.
3. Why we process personal data
We process personal data to provide, operate and improve Passly:
- To create and manage accounts and access.
- To sell tickets and synchronise with Shopify and Fortnox.
- To manage ticket administration and check-in.
- To provide support and answer questions.
- To prevent abuse and maintain security, reliability and traceability.
- To comply with legal obligations, including accounting and tax rules.
4. Legal bases for processing
- Contract: processing is necessary to provide the service under an agreement with you or your organisation.
- Legitimate interest: for example support, operations, security and improving the service (Article 6(1)(f) GDPR).
- Legal obligation: for example requirements under the Swedish Bookkeeping Act.
- Consent: where consent is required. You can withdraw consent at any time.
5. Who we share personal data with
- Processors acting on our instructions, such as hosting, infrastructure, support and technical service providers.
- Independent controllers, such as Shopify, Fortnox, banks and payment providers, who are responsible for their own processing.
- Authorities or other recipients when required by law or a valid legal request.
- In connection with a business transaction, such as a merger or acquisition.
We never sell your personal data.
6. Where we process personal data
We primarily process personal data within the EU/EEA. If a transfer outside the EU/EEA is necessary, we make sure lawful safeguards are in place, such as the European Commission’s standard contractual clauses.
7. How long we keep personal data
- Account and business data is kept while the account is active.
- Support and communication records are normally deleted or anonymised within 12 months, unless longer storage is required.
- Accounting records are kept for at least seven years as required by Swedish law.
- Security and technical logs are kept for limited periods based on operational and security needs.
8. Cookies
A cookie is a small text file stored in your browser. Passly only uses cookies that are needed for the website and platform to work. We do not use cookies for analytics or marketing, so we do not need to ask for your consent.
| Cookie | Purpose | Retention |
|---|---|---|
| Session cookie | Keeps you logged in to the Passly platform. | Until you log out or the session expires |
| XSRF-TOKEN | Protects forms against forged requests. | For the session |
| passly_locale | Remembers whether you chose Swedish or English. | 30 days |
If we start using cookies for analytics or marketing in the future, we will ask for your consent before they are set and update this policy.
You can delete or block cookies in your browser settings. If you block necessary cookies, logging in may not work.
9. Security
We protect your data with technical and organisational measures, such as encrypted connections and restricted access. No security measures are perfect, so please do not send sensitive information to us through insecure channels.
10. Third-party websites
Our website may link to websites and platforms run by others, such as Shopify and Fortnox. Please read their privacy policies when you visit them. We are not responsible for how they process personal data.
11. Children
Passly is built for businesses and event organisers and is not intended for children. If a child in your care has given us personal data, contact us and we will delete it.
12. Your rights
Under the General Data Protection Regulation (GDPR) you have the right to:
- access your personal data,
- have inaccurate or incomplete data corrected,
- have your data erased in certain situations,
- restrict processing in certain situations,
- object to processing based on legitimate interest and to direct marketing,
- receive your data in a portable format.
13. How to exercise your rights
Send your request to hello@passly.se, preferably from the email address registered with us. We may need to verify your identity. We respond without undue delay and normally within one month.
14. Complaints
If you believe we process your personal data incorrectly, contact us at hello@passly.se. You can also contact the Swedish Authority for Privacy Protection (IMY).
15. Changes to this policy
We may update this policy, for example when the service or the law changes. The latest version is always available here, with the date it was last updated.