Privacy Policy

Who controls your data

Sisu Software Oy (business ID 3634070-1), registered in Finland at Sorakatu 9 A 75, 20730 Turku, Finland and represented by Mikko Juhani Sysikaski, is the controller of the personal data described here. It applies to senders, travelers, recipients, and delegates. Depending on where you are, the EU/EEA GDPR, the UK GDPR, the Philippine Data Privacy Act (RA 10173), Japan's Act on the Protection of Personal Information (APPI), Thailand's Personal Data Protection Act (PDPA), the UAE's Personal Data Protection Law, Vietnam's Law on Personal Data Protection, Bahrain's Personal Data Protection Law (PDPL), and/or Saudi Arabia's Personal Data Protection Law (PDPL) give you specific rights, set out below. Our representative in the United Kingdom is John Reyes, in Thailand Angel Garcia, in Bahrain Jenny Santos, and in Saudi Arabia Joshua Romero. We have appointed a Data Protection Officer, who oversees how we handle your data and is your direct contact for anything in this policy or any of your rights — dpo@pasabay.eu. For anything else about privacy, privacy@pasabay.eu.

What we collect

Data you give us:

• Account data — name, email, phone (if provided), credentials, language, and settings. The name on your ID stays private: other members see only your Name on Pasabay. We share your ID name only to resolve a dispute or when the law requires.
• Profile data — your Name on Pasabay, photo/avatar, other photos you add to your profile, bio, links to your Facebook profile or page or your Instagram profile if you add them or ask us to, and route or trip information you choose to share. Adding a profile photo, or other photos to your profile, shows them, with your Name on Pasabay, on your public profile — a page that works without an account and can be found by search engines. You can remove them at any time on your profile, though we cannot remove copies a search engine has already made. Facebook and Instagram links are shown on that same page until you remove them in Edit profile.
• Identity-verification data — the ID document you submit and the details it contains, used to verify your identity. If you live in South Korea, the ID check also asks your date of birth, and we report your name and date of birth, with the deliveries you were rewarded for, to Korea's National Tax Service each quarter, as Korea's VAT law requires.
• Transaction data — listings, trips, requests, item descriptions and values, agreements, and delivery confirmations.
• Content — chat messages and reactions, voice messages and videos (deleted after 7 days), photos and notes (including dispute evidence), and reviews — including reviews you write about members you did pasabay with outside the app, shown on their profile with your name until you delete them.

We also collect some data automatically — device and technical data, app-usage data, and, when a delivery code is entered, a timestamp and location geostamp as proof that delivery happened. We do not track your continuous location, and we don't knowingly collect data from anyone under 18.

Why we use it

We use your data to create and run your account and the marketplace, verify identity and prevent fraud, confirm and prove delivery, handle disputes, send transactional messages, keep the Service secure, and comply with the law. Our legal bases include performing our contract with you, our legitimate interests in trust and safety, legal obligations, and — where required, such as the identity check that compares your selfie with your ID — your consent. Where we rely on consent you can withdraw it at any time; where we rely on legitimate interests you can object. We do not profile you, run analytics on how you use Pasabay, or send you marketing.

Identity verification — special handling

Your identity document is reviewed by a person, for identity only — never for immigration, credit, background, or profiling. We store a salted, hashed representation of document data to detect duplicate accounts (one identity, one account); we don't use it to build a profile of you. Identity data is stored securely with restricted access and deleted on request once no legal-retention duty applies. We do not sell it and don't share it except with the vetted processors and legal recipients below.

Rewards

Every member takes part in our rewards programme (see the Invite and Rewards Terms). We record who introduced you (by link or code), what you earn and why, and what we pay you and when. If someone introduced you, they see in Your invites your Name on Pasabay and whether you've passed the ID check and completed a first delivery. If you named them before 6 October 2026, they see your Name on Pasabay only once you complete a delivery. To pay you, we need your name and your GCash number, which you save in Account → Rewards or email to hello@pasabay.eu. We use this data to run the programme under those terms, to check each delivery is genuine, and to keep our accounts. To check a delivery is genuine, we also note a scrambled code for the internet connection you use, and in the app a random code it keeps on your phone, when you take a step in a deal or send a message (never your address or a phone ID), so we can see if two accounts share one. We delete them after 180 days. We keep your GCash number until you change it or delete your account. If you delete your account while we owe you money, we keep your name, email and GCash number until we've paid you. We keep payment records as long as accounting law requires, even after you delete your account.

Pasabuy orders

If a seller keeps your order in Pasabuy, the seller decides what they record about you and is responsible for it (the controller); we process it for them. That can be your name, your Facebook name or phone, your address, notes, what you ordered and paid, and what you send through your order link, such as proof of payment and return photos. Ask the seller to see, correct or delete it; we help them answer. Your contact and address are cleared 1 year after your last order with that seller; the rest is deleted when the seller deletes it or their account. If you report an order to us, or keep your orders in My orders with a Pasabay account, we are the controller of that, as for any member.

Who we share data with

We do not sell your personal data. We share it only:

• with other users, to make a transaction work — anything you write in a chat is shown to the people in it as you wrote it (in a group chat, also to anyone who joins it later), and your identity document is never shown to another user;
• with GCash, to pay you a reward;
• with service providers who process data on our instructions under contract (for example database, authentication, and secure storage; push and email delivery);
• with Korea's National Tax Service, for members living in South Korea, as described above;
• with authorities or legal recipients where we must comply with a valid legal request or defend legal claims; and
• with a successor, if Pasabay is ever part of a merger or asset transfer, with notice and continued protection.

International transfers and retention

Pasabay is run from Finland and its main systems are in the EU, so your data may be processed outside your country. Where we transfer data internationally we use a lawful mechanism — such as EU Standard Contractual Clauses or an adequacy decision — with appropriate safeguards. We keep personal data only as long as needed: account and transaction data for the life of your account, voice messages and videos for 7 days, a message you unsend for 30 days (seen only if the other person reports that chat), identity data until no longer needed for verification or a legal duty, evidence for as long as needed to resolve a matter, and logs for a limited period. When you delete your account we delete or anonymise your data, except records the law requires us to keep.

Your rights

Subject to the conditions in applicable law, you can:

• access the data we hold about you and get a copy;
• rectify inaccurate or incomplete data;
• erase your data and delete your account;
• restrict or object to processing, including direct marketing;
• receive certain data in a portable format; and
• withdraw consent where processing is based on it.

Identity review always involves a person, not solely automation. In the Philippines you may complain to the National Privacy Commission; in Japan you may contact the Personal Information Protection Commission; in the United Kingdom you may complain to the Information Commissioner's Office (ICO); in Thailand you may complain to the Personal Data Protection Committee; in Vietnam you may contact the Ministry of Public Security, which supervises personal data protection; in Saudi Arabia you may complain to the Saudi Data and AI Authority (SDAIA); in the EU/EEA you may complain to your local supervisory authority (in Finland, the Office of the Data Protection Ombudsman). To exercise a right, email our Data Protection Officer at dpo@pasabay.eu — we may need to verify your identity first. You do not need an account: recipients and delegates have the same rights, and pasabay.eu/data-request explains how to ask.

Security and children

We use technical and organisational measures appropriate to the risk — access controls, encryption in transit, restricted access to identity data, and monitoring. No system is perfectly secure; if a breach affects your rights we'll notify you and the relevant authority where the law requires. Pasabay is for adults (18+); we don't knowingly collect data from minors, and we'll delete it if we learn we have.

Cookies and changes

The website uses strictly necessary cookies to function, and no analytics or advertising cookies at all — if that ever changes we'll ask for your consent first where it's required. See the Cookie Policy for details. We may update this policy; if a change is material we'll give notice by a reasonable means before it takes effect, and the revised date below shows the current version. If in-app payments are ever introduced, we'll update this policy and the Terms to describe the processor and additional data, with notice, before any charge could apply to you.