Xtarly Pass privacy notice

[PENDING: English translation of the Spanish draft. It is not part of the legal opinion and has not been reviewed by counsel; see the Spanish version.] Anything that does not come from the Xtarly Pass compliance opinion of 29 September 2026 is marked [PENDING: …] and has not been written here. This notice is not copied from Xtarly Rewards' notice (opinion §1.3).

1. Controller

[PENDING: name or company name and address of whoever provides Xtarly Pass]

Privacy contact: [PENDING: email for privacy requests]

2. Your organizer account data

[PENDING: data processed about the organizer's account and payments, purposes, transfers and how to exercise the rights of access, rectification, cancellation and objection. Xtarly is the controller of this data (opinion §3.2 b); the opinion does not include the text]

3. Data of an event's guests: Xtarly as processor

Processing clause of the Xtarly Pass Terms (section 2; text of opinion §1.4):

You decide whom you invite and which of your guests' data you load into Xtarly Pass. For that data, you are the controller and Xtarly acts as processor: it processes it only on your behalf and for what you instruct when you use the service, which is generating your event's passes, showing them at their link and recording entry.

Xtarly does not use your guests' data for its own purposes, does not sell it, does not use it to send them advertising and does not combine it with other customers' data.

To generate the passes, Xtarly shares with Apple (Apple Wallet) and with Google (Google Wallet) the data shown on the pass. The data is hosted with the infrastructure providers that Xtarly lists in its privacy notice.

If a guest contacts Xtarly to exercise their rights over their data, Xtarly will let you know so that you handle it, and will follow your instructions.

[PENDING: text for guests on whom to ask for access, correction or deletion of their data (the pass page footer, opinion §3.3, refers them to the organizer)]

[PENDING: text for guests about the technical data Xtarly records on its own account (Apple device identifier and token, entry records); the opinion leaves it as a question for counsel (A4)]

4. Infrastructure providers

[PENDING: list of hosting and payment providers (opinion §1.3 mentions hosting and Stripe); names and countries to be confirmed]

5. Changes to this notice

Last updated: [PENDING: publication date]