Privacy Policy

Who controls your data

Sisu Software Oy (business ID 3634070-1), registered in Finland at Sorakatu 9 A 75, 20730 Turku, Finland and represented by Mikko Juhani Sysikaki, is the controller of the personal data described here. It applies to senders, travelers, recipients, and delegates. Depending on where you are, the EU/EEA GDPR, the Philippine Data Privacy Act (RA 10173), and/or Japan's Act on the Protection of Personal Information (APPI) give you specific rights, set out below. We have appointed a Data Protection Officer, who oversees how we handle your data and is your direct contact for anything in this policy or any of your rights — dpo@pasabay.eu. For anything else about privacy, privacy@pasabay.eu.

What we collect

Data you give us:

• Account data — name, email, phone (if provided), credentials, language, and settings.
• Profile data — display name, photo/avatar, bio, and route or trip information you choose to share.
• Identity-verification data — the ID document you submit and the details it contains, used to verify your identity only.
• Transaction data — listings, trips, requests, item descriptions and values, agreements, and delivery confirmations.
• Content — chat messages, photos and notes (including dispute evidence), and reviews.

We also collect some data automatically — device and technical data, app-usage data, and, when a delivery PIN is entered, a timestamp and location geostamp as proof that delivery happened. We do not track your continuous location, and we don't knowingly collect data from anyone under 18.

Why we use it

We use your data to create and run your account and the marketplace, verify identity and prevent fraud, confirm and prove delivery, handle disputes, send transactional messages, keep the Service secure, and comply with the law. Our legal bases include performing our contract with you, our legitimate interests in trust and safety, legal obligations, and — where required, such as the identity check that compares your selfie with your ID — your consent. Where we rely on consent you can withdraw it at any time; where we rely on legitimate interests you can object. We do not profile you, run analytics on how you use Pasabay, or send you marketing.

Identity verification — special handling

Your identity document is reviewed by a person, for identity only — never for immigration, credit, background, or profiling. We store a salted, hashed representation of document data to detect duplicate accounts (one identity, one account); we don't use it to build a profile of you. Identity data is stored securely with restricted access and deleted on request once no legal-retention duty applies. We do not sell it and don't share it except with the vetted processors and legal recipients below.

Who we share data with

We do not sell your personal data. We share it only:

• with other users, to make a transaction work — anything you write in chat is shown to the other party as you wrote it, and your identity document is never shown to another user;
• with service providers who process data on our instructions under contract (for example database, authentication, and secure storage; push and email delivery);
• with authorities or legal recipients where we must comply with a valid legal request or defend legal claims; and
• with a successor, if Pasabay is ever part of a merger or asset transfer, with notice and continued protection.

International transfers and retention

Pasabay operates across Finland/EU, the Philippines, and Japan, so your data may be processed outside your country. Where we transfer data internationally we use a lawful mechanism — such as EU Standard Contractual Clauses or an adequacy decision — with appropriate safeguards. We keep personal data only as long as needed: account and transaction data for the life of your account, identity data until no longer needed for verification or a legal duty, evidence for as long as needed to resolve a matter, and logs for a limited period. When you delete your account we delete or anonymise your data, except records the law requires us to keep.

Your rights

Subject to the conditions in applicable law, you can:

• access the data we hold about you and get a copy;
• rectify inaccurate or incomplete data;
• erase your data and delete your account;
• restrict or object to processing, including direct marketing;
• receive certain data in a portable format; and
• withdraw consent where processing is based on it.

Identity review always involves a person, not solely automation. In the Philippines you may complain to the National Privacy Commission; in Japan you may contact the Personal Information Protection Commission; in the EU/EEA you may complain to your local supervisory authority (in Finland, the Office of the Data Protection Ombudsman). To exercise a right, email our Data Protection Officer at dpo@pasabay.eu — we may need to verify your identity first. You do not need an account: recipients and delegates have the same rights, and pasabay.eu/data-request explains how to ask.

Security and children

We use technical and organisational measures appropriate to the risk — access controls, encryption in transit, restricted access to identity data, and monitoring. No system is perfectly secure; if a breach affects your rights we'll notify you and the relevant authority where the law requires. Pasabay is for adults (18+); we don't knowingly collect data from minors, and we'll delete it if we learn we have.

Cookies and changes

The website uses strictly necessary cookies to function, and no analytics or advertising cookies at all — if that ever changes we'll ask for your consent first where it's required. See the Cookie Policy for details. We may update this policy; if a change is material we'll give notice by a reasonable means before it takes effect, and the revised date below shows the current version. If in-app payments are ever introduced, we'll update this policy and the Terms to describe the processor and additional data, with notice, before any charge could apply to you.