Privacy Policy

3.1 Account and Registration Data

When you create an account, we collect:

• Full name
• Email address
• Password (stored in encrypted, hashed form)
• Country of residence
• Phone number (if provided)
• Profile photograph (if uploaded)

3.2 Pet Profile Data

When you create a pet profile on the Platform, we collect:

• Pet name, species, breed, age, and sex
• Pet photographs uploaded by you
• Veterinary records, vaccination history, and health notes entered by you
• Microchip numbers or other identification data (if entered)
• QR Tag assignment and activation data

3.3 Transaction and Payment Data

When you make a purchase or complete a financial transaction on the Platform, we collect:

• Billing name and address
• Transaction amount, currency, and date
• Payment method type (e.g., card type, last four digits)
• Transaction identifiers and order references

Full payment card details are processed exclusively by our third-party payment processor, Stripe, Inc., and are not stored on PawPass servers. PawPass does not have access to full card numbers, CVV codes, or bank account details. See Section 11 (Third-Party Processors) for further details.

3.4 Booking and Service Data

When you use the booking functionality on the Platform, we collect:

• Service type, date, time, and location of booking
• Name of the Partner booked
• Booking status, modifications, and cancellation history
• Reviews and ratings you submit for Partners

3.5 QR Tag and Device Data

In connection with the QR Tag product, we collect:

• QR Tag activation date and assignment to pet profile
• Scan event data, including date, time, and general geographic region of scans (where technically available)
• Device type and operating system of the scanning device (where technically captured)

3.6 Communication Data

When you contact us or communicate through the Platform, we collect:

• Email correspondence content
• Support ticket data and case history
• Any personal data you include in communications voluntarily

3.7 Usage and Technical Data

When you interact with the Platform, we automatically collect:

• IP address
• Browser type and version
• Operating system
• Device identifiers
• Pages visited, time spent, and clickstream data
• Referring URLs
• Session identifiers
• Error logs and performance diagnostics

3.8 Cookie and Tracking Data

We use cookies and similar tracking technologies as described in our Cookie Policy, available at https://www.pawpass.rs/en. Cookie data may include session identifiers, preference settings, analytics identifiers, and advertising-related identifiers (where applicable and consented to).

3.9 Location Data

The Platform may collect general location data derived from IP address for the purpose of localizing content and complying with regional legal requirements. Precise GPS-level location data is not collected unless you explicitly grant such permission via your device settings.

3.10 Sensitive Data

We do not intentionally collect special categories of sensitive personal data as defined under GDPR Article 9 (such as health data relating to humans, racial or ethnic origin, political opinions, religious beliefs, or biometric data). Veterinary and health records relating to pets are not classified as sensitive personal data under applicable human-focused data protection frameworks, but we nonetheless treat such data with a high standard of care and confidentiality.

4.1 Performance of a Contract

Processing is necessary for the performance of a contract to which you are a party, or to take steps at your request before entering into a contract. This basis applies to:

• Creating and managing your account
• Processing bookings and transactions
• Fulfilling QR Tag orders and activations
• Providing customer support in relation to Platform services

4.2 Legitimate Interests

Processing is necessary for the purposes of legitimate interests pursued by PAWPASS LLC or a third party, except where such interests are overridden by your interests or fundamental rights. This basis applies to:

• Fraud prevention and Platform security
• Service improvement and Platform analytics
• Internal reporting and operational management
• Enforcing our Terms of Service
• Direct marketing to existing customers (subject to opt-out rights)

4.3 Compliance with Legal Obligations

Processing is necessary to comply with a legal obligation to which PawPass is subject. This basis applies to:

• Compliance with applicable tax and financial reporting requirements
• Responding to lawful requests from public authorities
• Maintaining records required by law

4.4 Consent

Where we rely on consent as our legal basis, you will be asked to provide explicit, informed, and freely given consent prior to the relevant processing activity. Consent-based processing applies to:

• Marketing communications (email newsletters, promotional offers)
• Non-essential cookies and tracking technologies
• Any processing not covered by another lawful basis

You have the right to withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. Withdrawal of consent can be effected by contacting us at office@pawpass.rs or using opt-out mechanisms provided in communications.

4.5 Vital Interests

In exceptional circumstances, we may process personal data where necessary to protect the vital interests of a person (e.g., in the context of a pet safety emergency facilitated through the QR Tag system). Such processing is limited to what is strictly necessary.

6.1 Service Providers and Data Processors

We share personal data with third-party service providers who process data on our behalf as Data Processors, pursuant to written data processing agreements that require them to maintain appropriate security standards and process data only on our documented instructions. Categories of such processors include:

• Payment processors (Stripe, Inc.) for transaction processing.
• Cloud hosting and infrastructure providers for Platform hosting and data storage.
• Email service providers for transactional and marketing communications.
• Analytics providers for Platform usage analysis.
• Customer support software providers.
• Fraud detection and cybersecurity providers.

6.2 Partner Service Providers

When you book a service with a Partner through the Platform, we share your name, contact information, pet profile data relevant to the service, and booking details with the relevant Partner. Partners operate as independent data controllers for data received in this context and are responsible for their own processing under their own privacy policies. PawPass is not responsible for Partner data handling practices beyond the scope of our platform relationship.

6.3 QR Tag Scan Recipients

When a third party scans your pet's QR Tag, the pet profile information you have made publicly visible in the QR Tag profile will be displayed to that person. You control what information is included in the QR Tag profile through your account settings. PawPass is not responsible for how third parties who scan the QR Tag use the displayed information. You should include only the information you are willing to share with members of the public.

6.4 Business Transfers

In the event of a merger, acquisition, reorganization, sale of all or substantially all assets, or other change of corporate control, personal data may be transferred to the successor entity as part of that transaction. We will notify you of any such transfer and any material changes to this Privacy Policy that may result from the transaction via email or prominent Platform notice, where required by applicable law.

6.5 Legal and Regulatory Disclosures

We may disclose personal data where required to do so by applicable law, court order, regulatory directive, or enforceable governmental request. We may also disclose data where necessary to: (a) enforce our Terms of Service or other agreements; (b) protect the rights, property, or safety of PawPass, our users, or the public; or (c) detect, prevent, or address fraud, security, or technical issues.

6.6 Aggregated and Anonymized Data

We may share aggregated, anonymized, or de-identified data that cannot reasonably be used to identify you, for the purposes of industry research, analytics reporting, marketing, and platform improvement. Such data does not constitute personal data under applicable law.

6.7 No Sale of Personal Data

PAWPASS LLC does not sell, rent, or trade personal data to third parties for their own independent marketing or commercial purposes. For California residents: PawPass does not "sell" or "share" personal information as those terms are defined under the CCPA/CPRA.

8.1 Account Data

Account data is retained for the duration of your active account relationship with PawPass. Following account deletion or termination, we retain core account records (name, email, account ID) for a period of five (5) years to comply with applicable legal, tax, and contractual obligations, and to facilitate the resolution of any disputes arising from the prior account relationship.

8.2 Transaction and Payment Records

Transaction records, including purchase history, invoice data, and payment confirmations, are retained for a minimum of seven (7) years from the date of the transaction, in compliance with applicable U.S. federal and state tax and financial recordkeeping requirements, and as necessary to comply with EU VAT and accounting regulations where applicable.

8.3 Pet Profile and Health Records

Pet profile and health record data is retained for the duration of your account relationship and for a period of three (3) years following account deletion, to enable account recovery and to address potential disputes or claims. Users may request deletion of pet data earlier through the account settings or by contacting office@pawpass.rs, subject to any applicable legal holds.

8.4 Booking and Service Records

Booking records are retained for five (5) years from the date of the service to support dispute resolution, chargeback management, and regulatory compliance.

8.5 Marketing and Communication Data

Marketing consent records are retained for the duration of the opt-in plus three (3) years following unsubscribe, to demonstrate compliance with applicable marketing laws. Unsubscribed users' email addresses are retained on suppression lists to prevent future unwanted communications.

8.6 Technical and Log Data

Server logs, IP address records, and technical usage data are retained for a maximum period of twelve (12) months from collection, unless a longer retention period is required for security investigations or legal proceedings.

8.7 Deletion and Anonymization

At the end of applicable retention periods, personal data is either permanently deleted from our systems and those of our processors, or irreversibly anonymized such that it can no longer be linked to an identifiable individual. We do not guarantee deletion from backup systems immediately upon request, but ensure that data in backup archives is subject to controlled access and is purged on a regular schedule not exceeding twelve (12) months from the applicable retention period end date.

9.1 Right of Access (Article 15 GDPR)

You have the right to obtain confirmation as to whether we process personal data relating to you, and if so, to receive a copy of that data along with information about the processing purposes, categories of data, recipients, retention periods, and the existence of automated decision-making.

9.2 Right to Rectification (Article 16 GDPR)

You have the right to request that we correct inaccurate personal data or complete incomplete data without undue delay. Many account details can be updated directly through your Platform account settings.

9.3 Right to Erasure (Article 17 GDPR)

You have the right to request the deletion of your personal data where: (a) the data is no longer necessary for the purposes for which it was collected; (b) you withdraw consent and no other legal basis applies; (c) you object to processing and there are no overriding legitimate grounds; (d) the data has been unlawfully processed; or (e) erasure is required to comply with a legal obligation. This right is subject to exceptions, including where processing is necessary for compliance with legal obligations or for the establishment, exercise, or defense of legal claims.

9.4 Right to Restriction of Processing (Article 18 GDPR)

You have the right to request that we restrict processing of your personal data where: (a) you contest the accuracy of the data (restriction applies while accuracy is verified); (b) processing is unlawful but you oppose erasure; (c) we no longer need the data but you require it for legal claims; or (d) you have objected to processing pending verification of whether our legitimate grounds override yours.

9.5 Right to Data Portability (Article 20 GDPR)

Where processing is based on consent or contractual necessity and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit it to another controller without hindrance from us.

9.6 Right to Object (Article 21 GDPR)

You have the right to object at any time to processing of your personal data based on legitimate interests (Article 6(1)(f) GDPR), including profiling on that basis. Where you object, we will cease processing unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or for the establishment, exercise, or defense of legal claims. You have an unconditional right to object to processing for direct marketing purposes.

9.7 Rights Relating to Automated Decision-Making (Article 22 GDPR)

PawPass does not subject users to fully automated decision-making that produces legal or similarly significant effects without human review. If we implement any such processes in the future, we will update this Privacy Policy and implement appropriate safeguards as required by Article 22 GDPR.

9.8 California Privacy Rights (CCPA/CPRA)

California residents have the following additional rights under the CCPA/CPRA:

• Right to Know: The right to request disclosure of categories and specific pieces of personal information collected, the sources of collection, the business purpose, and categories of third parties with whom data is shared.
• Right to Delete: The right to request deletion of personal information collected by PawPass, subject to applicable exceptions.
• Right to Correct: The right to request correction of inaccurate personal information.
• Right to Opt-Out of Sale or Sharing: PawPass does not sell or share personal information for cross-context behavioral advertising purposes. If this practice changes, California residents will be notified and provided an opt-out mechanism.
• Right to Limit Use of Sensitive Personal Information: To the extent we collect sensitive personal information as defined under the CPRA, California residents may request limitations on its use and disclosure.
• Right to Non-Discrimination: PawPass will not discriminate against you for exercising any CCPA/CPRA rights.

California residents may submit requests by contacting office@pawpass.rs with the subject line "California Privacy Request". We will verify your identity before processing your request and will respond within 45 days, or up to 90 days where an extension is necessary and notice is provided.

9.9 How to Exercise Your Rights

To exercise any of the rights described in this Section, please submit a written request to office@pawpass.rs. Include sufficient information to verify your identity and to identify the specific data or processing activity to which your request relates. We will respond within 30 calendar days of receipt for GDPR/UK GDPR requests, and within 45 days for CCPA/CPRA requests, with the possibility of extension where permitted by law. We will not charge a fee for processing reasonable requests, except where requests are manifestly unfounded or excessive, in which case we may charge a reasonable administrative fee or refuse to act on the request.

9.10 Right to Lodge a Complaint

If you are a resident of the EEA or UK and believe that our processing of your personal data violates applicable data protection law, you have the right to lodge a complaint with your local supervisory authority. A list of EEA supervisory authorities is available at https://edpb.europa.eu. The UK supervisory authority is the Information Commissioner's Office (ICO), reachable at https://ico.org.uk. We encourage you to contact us first at office@pawpass.rs so that we may address your concern directly.

11.1 Stripe, Inc.

Payment processing on the Platform is handled by Stripe, Inc. ("Stripe"), a PCI-DSS Level 1 certified payment processor. When you submit payment information, it is transmitted directly to Stripe's secure servers. PAWPASS LLC does not store full payment card numbers, CVV codes, or bank account credentials on its own servers. Stripe processes payment data pursuant to its own Privacy Policy, available at https://stripe.com/privacy, and its terms of service. By making a payment on the Platform, you agree to be bound by Stripe's applicable policies.

11.2 Analytics Providers

We may use third-party analytics services, such as Google Analytics or equivalent providers, to help us understand how users interact with the Platform. These providers may collect usage and technical data through cookies and similar technologies. Analytics data is processed in aggregated or pseudonymized form. You may opt out of analytics tracking through our Cookie Policy consent mechanism or through provider-specific opt-out tools.

11.3 Email and Communication Providers

We use third-party email service providers to deliver transactional and marketing communications. These providers process your email address and communication metadata on our behalf as Data Processors under appropriate data processing agreements.

11.4 Cloud Infrastructure Providers

Our Platform is hosted on third-party cloud infrastructure. Hosting providers store and process Platform data, including personal data, on our behalf in accordance with data processing agreements and applicable security standards.

11.5 Third-Party Links and Integrations

The Platform may contain links to third-party websites or integrate with third-party services. This Privacy Policy does not apply to third-party platforms. We encourage you to review the privacy policies of any third-party platforms you access through or in connection with the Platform. PAWPASS LLC is not responsible for the privacy practices of third parties.