Xtarly Pass terms and conditions

[PENDING: English translation of the Spanish draft. It is not part of the legal opinion and has not been reviewed by counsel; see the Spanish version.] The clauses of sections 2 and 3 and the trademark line come from the Xtarly Pass compliance opinion of 29 September 2026 (§1.4, §2.4 and §7.5). Anything marked [PENDING: …] is missing and has not been written here. [PENDING: counsel's review of sections 2 and 3 (questions A1 and A2 of the opinion)]

1. Who provides the service

[PENDING: name or company name, tax address and contact details of whoever provides Xtarly Pass, as they must appear in these terms]

Contact: [PENDING: contact email and phone]

2. Your guests' data

2.1 You decide whom you invite and which of your guests' data you load into Xtarly Pass. For that data, you are the controller and Xtarly acts as processor: it processes it only on your behalf and for what you instruct when you use the service, which is generating your event's passes, showing them at their link and recording entry.

2.2 Xtarly does not use your guests' data for its own purposes, does not sell it, does not use it to send them advertising and does not combine it with other customers' data.

2.3 To generate the passes, Xtarly shares with Apple (Apple Wallet) and with Google (Google Wallet) the data shown on the pass. The data is hosted with the infrastructure providers that Xtarly lists in its privacy notice.

2.4 Xtarly keeps administrative, technical and physical security measures to protect that data, and will notify you without undue delay if it detects a breach that affects it.

2.5 Xtarly deletes or anonymizes your guests' data [PENDING: 30] days after your event ends, under the terms of the [PENDING: Retention] section. You can delete a guest earlier at any time.

[PENDING: the opinion (§4.3 and §4.4) makes the 30-day deletion claim conditional on the scheduled purge existing with an alert when it fails, on the Apple pass being voided before the purge and on the Google Wallet object being expired and stripped of the name. Confirm those conditions before publishing this clause and the Retention section]

2.6 If a guest contacts Xtarly to exercise their rights over their data, Xtarly will let you know so that you handle it, and will follow your instructions.

3. Your warranties as organizer

3.1 By loading guests' data you declare that (a) you have a legitimate basis to process it for that purpose; (b) you will make your privacy notice available to them; (c) you will not load sensitive personal data, and (d) you are authorized to use on the passes the names, logos and trademarks you upload. If a guest or an authority complains about data you loaded, handling it is up to you as controller. Xtarly will support you with the information it has available.

4. Retention

[PENDING: retention text (opinion §4.4), approved but publishable only when conditions 1 to 3 of §4.3 are met]

5. Pre-sale and payments

[PENDING: pre-sale conditions (opinion §6.3), on hold until the accountant answers questions C1 and C2]

6. Trademarks

Apple, Apple Wallet, and iPhone are trademarks of Apple Inc., registered in the U.S. and other countries. Google Wallet is a trademark of Google LLC.

7. Effective date

Last updated: [PENDING: publication date]