Passa Privacy Policy
Prepared: 26 October 2026
Effective date: 26 October 2026
Privacy contact email: hello.pyramidtech@gmail.com
A quick explanation
Passa helps neighbours give, receive, buy and sell useful things. We use information to run accounts, show listings, handle requests, arrange collections and protect the community. Public listing details can be seen by visitors. Private collection arrangements, account security information, reports and staff records are not intended to be public.
You can ask us questions, challenge a decision and exercise privacy rights. You do not have to tell us personal hardship, health details or other sensitive information to deserve a free item. If you are 13–17, read the short guidance for younger members below and involve a trusted adult when arranging collections.
1. Who is responsible for your information?
PYRAMID TECHLAB LTD, registered in England and Wales, company number 17351892, is the controller of personal information used to operate Passa. Our registered address is 4 Brick Kiln Lane, Rainham, ME8 8FR, United Kingdom. Telephone: 07867 290129.
Contact us at hello.pyramidtech@gmail.com or write to our registered address marked “Passa privacy”. A separate data protection officer or representative is not identified here unless we appoint one and update this notice. Do not send passwords or handover codes when contacting us.
2. Information we collect
| Information | Examples and source |
|---|---|
| Account and authentication | Name or display name, email address, a private phone number, a 13+ age declaration, terms acknowledgements and acceptance records, account identifier, verification status, account role and authentication events. Provided by you or by our authentication service. Password handling is delegated to Firebase Authentication; Passa’s application database does not need your plaintext password. |
| Listings | Item titles, descriptions, photographs, category, condition, price where relevant, country, city/neighbourhood, availability and listing timestamps. Provided by the person creating a listing. Images can contain information about people, homes or possessions; check them before uploading. |
| Requests and collections | Application messages, decisions, reservation status, agreed collection time/place, handover confirmation and necessary related references. Supplied by participating members or generated through their activity. |
| Giving balance | Counts of completed free gifts, completed free pickups and active reservations, used to apply participation rules. Calculated from confirmed platform activity. |
| Reports and support | What you tell us, relevant listing/account references, moderation decisions and correspondence needed to investigate or help you. Information may also come from a person reporting a concern about you. |
| Security and administration | Access records, role changes, audit events and technical information needed to operate and protect the service. Hosting and service providers may process IP addresses, device/browser information and diagnostic logs. |
| Notifications | Email address for requested or necessary messages; browser push subscription endpoint and encryption information when you choose to enable push. |
| Payment oversight, where applicable | Provider references, amounts, currency, payment/refund status and links to the relevant buyer, seller and listing. Current oversight is based on Stripe events; this does not mean online checkout or seller payouts are available. We do not store complete card details in the Passa ledger. |
| Device storage | Authentication persistence and locally saved item identifiers. See the Cookie Policy for cookies and similar storage technologies. |
We do not require you to provide a public phone number, precise live location, identity document, health information, religion, ethnicity or financial hardship information as a condition of receiving an ordinary free item. Do not include unnecessary sensitive information in descriptions, messages or reports. If a safeguarding or legal matter requires additional information, we will explain the purpose and handle it appropriately.
Phone numbers are format-checked and stored privately; this does not verify ownership by SMS. They are available to the account holder and authorised administrators and are not placed on public listings. Terms records identify the published version and the time of acceptance. A prelaunch acknowledgement is recorded separately when no terms version is published.
3. How and why we use information
The following table explains the intended purposes and legal bases. Where we rely on legitimate interests, we consider necessity, reasonable expectations, privacy impacts and the particular interests of younger members. Consent is not used as a catch-all basis for essential account operations.
| Purpose | Information involved | Intended lawful basis |
|---|---|---|
| Create, secure and operate adult members’ accounts and requested features | Account details, verification and necessary activity | Contract: providing the service you request under our terms. |
| Provide an age-appropriate community service to 13–17-year-olds | Minimum account and activity information necessary for the requested service | Legitimate interests in providing a useful and safe service to young people, subject to a documented balancing assessment and safeguarding review. |
| Publish a listing and manage a request, reservation or collection | Listing, application and collection details | Contract for adult members; the carefully assessed legitimate interests described above for younger members. |
| Apply giving rules and maintain accurate handover records | Completed gifts/pickups, reservations and collection confirmations | Legitimate interests in fair access, preventing circumvention and keeping the community functioning. |
| Investigate concerns, prevent abuse and maintain accountability | Reports, support records, security and audit data | Legitimate interests in protecting members and the service; legal obligation where a particular law requires processing or disclosure. |
| Send verification, password reset and necessary security communications | Email address, account information and security events | Contract or legitimate interests in providing and protecting the requested service, as appropriate. |
| Send a welcome message or browser push you specifically request | Contact information or push subscription | Providing the notification service you request; consent where required for the particular communication. Optional marketing requires its own appropriate permission. |
| Maintain payment records if a relevant payment feature or Stripe event applies | Provider references, amounts, parties and status | Contract or legitimate interests in accurate reconciliation; legal obligation for records that legislation specifically requires. |
| Respond to rights requests and comply with lawful obligations | Relevant records and proportionate identity verification | Legal obligation. |
| Optional non-essential tracking or marketing, if introduced | The information identified at the point of choice | Consent where required. These activities must not start merely because you visit the site or accept the Terms. |
We do not sell personal information. We do not currently provide advertising profiles or personalised advertising as a Passa feature. If our purposes materially change, we will update the information we provide and seek a fresh choice where necessary.
4. What other people can see
Public listings: information you choose to publish about an item, its approximate area, and the display name associated with it may be visible to visitors. A person may share a public listing link outside Passa. Do not put a home address, school, phone number, personal documents or identifiable people in public content unless necessary and appropriate.
Applications and collection details: these are limited to participants and authorised staff who need access. A recipient’s private handover code should only be used for the collection process. Do not send it to the person offering the item before meeting.
Staff access: administrative roles have different permissions. Authorised administrators may oversee accounts, listings, applications, collection records, reports, payment oversight and audit information for legitimate operational, safety and support purposes. Staff should not access or reuse information out of curiosity or for unrelated purposes.
Journal and policy content: published content may include the author or publisher label selected by our team and publication/update dates. Private drafts and revision history are separate from the public version.
5. Who helps us provide Passa?
We use service providers for specific functions. Depending on the feature you use, these include:
- Google Firebase Authentication and Firestore: sign-in, verification and application data storage.
- Cloudinary: storing, processing and delivering uploaded images.
- Vercel: website/API hosting and associated delivery, security and diagnostic services.
- Resend, when configured: email delivery for supported Passa messages.
- Browser and operating-system push services: delivering notifications you enable using Web Push. These can include services operated by Google, Mozilla, Apple or Microsoft depending on your browser.
- Stripe, where a relevant payment function applies: payment processing infrastructure or payment-event information used for oversight. Current availability must be checked in the product; this policy does not activate checkout or payouts.
Providers process information needed for their role under appropriate arrangements. A provider may also have its own responsibilities for certain account, fraud prevention or legal purposes. We may use professional advisers, insurers or authorities where necessary and lawful. If the business changes ownership, any necessary transfer of information must be handled lawfully with appropriate notice and safeguards.
We do not disclose information in response to an informal request simply because someone asks. We assess requests, legal requirements, proportionality and the rights and safety of affected members.
6. International processing
We are based in the UK, but providers may process information in other countries. The fact that Passa initially serves UK members does not mean every provider stores all information exclusively in the UK.
Before a restricted transfer, we must identify an appropriate mechanism, such as applicable UK adequacy regulations or approved contractual safeguards together with necessary assessments and supplementary protections. You can ask our privacy contact about the relevant arrangements and how to obtain information about safeguards, subject to legitimate confidentiality and security limits.
Contact our privacy team for information about the processing locations and transfer safeguards relevant to your information. We do not represent that all providers process information only in the UK.
7. How long we keep information
We keep information only for as long as it is needed for its purpose or for a justified legal, safety or dispute-related reason. Retention depends on the type of record, account status, outstanding arrangements, the seriousness and timing of a concern, applicable record-keeping duties and relevant limitation periods. We review continued necessity rather than keeping everything indefinitely.
| Record category | Retention criteria |
|---|---|
| Account information | While an account is active and needed to provide the service; afterwards only information needed to close arrangements, deal with legitimate concerns or meet obligations. |
| Listings, applications and collections | While an item or arrangement is active and for a justified period afterwards to resolve enquiries, disputes, inaccurate balances or safety concerns. Public visibility and backend retention are separate questions. |
| Moderation, reports and security/audit events | As necessary to investigate, evidence proportionate decisions, prevent repeated abuse and meet legal obligations. Sensitive material should receive additional review and access limits. |
| Payment or accounting records | For applicable legal record-keeping duties and genuine reconciliation or dispute needs; requirements depend on the actual transaction and the company’s role. |
| Push subscriptions | While needed to provide the requested notifications, with invalid or withdrawn subscriptions removed through the operational process. Browser permission can be withdrawn independently. |
| Content revisions | While needed to manage published statements, correct mistakes, preserve accountability or address a legitimate legal issue. |
| Backups and provider logs | According to the documented backup/log lifecycle, subject to access limits and appropriate handling of deletion requests. A deletion from the live system may not immediately remove a record from every backup. |
Contact our privacy team to ask about retention, request account closure or exercise your deletion rights. These requests are handled through support; a self-service account deletion feature and an automatic application-level deletion schedule are not currently available. Retention and any exceptions are assessed against the criteria above.
8. Your choices and rights
Depending on the circumstances and lawful basis, you may request access to your information; correction; erasure; restriction of use; or a portable copy of information you provided. Rights are not absolute: we will explain any applicable exception or reason we cannot fully comply.
You have a right to object to processing based on legitimate interests. Tell us the processing you object to and your particular circumstances. We will assess the objection and explain whether we must stop or whether a lawful reason permits continued processing. You can object to direct marketing at any time.
Where processing relies on consent, you may withdraw it as easily as you gave it. Withdrawal does not make earlier processing unlawful or remove an independent lawful need to retain particular records. You may turn off push permission in browser/device settings, and clear or restrict local device storage; doing so may sign you out or remove locally saved items.
Contact hello.pyramidtech@gmail.com or write to us. We may ask for proportionate information to verify identity or authority, especially where a request could disclose another person’s information. We normally respond to a rights request within one month, subject to lawful extensions or other applicable rules which we will explain. Requests are normally free; any lawful exception will be explained before a charge is made.
If you do not provide information essential to an account or collection, we may be unable to offer that feature. You may still be able to read public information without registering.
9. Giving rules and decisions about accounts
Giving eligibility uses counts of completed free gifts, free pickups and active reservations. Initially five free pickups are allowed; another completed gift is needed before the sixth, a second before the tenth, and further milestones follow. A request may be prevented when the calculated allowance is exhausted. Paid sales do not count as completed free gifts.
These are community participation controls, not a credit score, financial eligibility assessment or decision about access to essential public services. We do not ask you to prove sensitive personal hardship to satisfy them. Contact support if information is inaccurate or a decision needs human review. Staff may also review reports and restrict accounts based on relevant activity; you can ask us to reconsider a decision.
If we introduce solely automated decisions with legal or similarly significant effects, we must provide the required explanation and safeguards before using them. This notice does not claim that all moderation is automated.
10. Younger members and safeguarding
Passa’s intended minimum age is 13. If you are 13–17, use a display name and photos that reveal as little as possible about you. Do not publish a school, timetable, personal phone number or exact address. Involve a parent or guardian and have a trusted adult present for collections.
Your information is not automatically available to a parent merely because they ask. We consider your rights, maturity, any authority the person has and what is necessary to protect you. If we learn that an account belongs to someone under 13, we will assess the situation, restrict access where appropriate and take proportionate steps concerning the information.
Services accessible to children require particular care, high privacy protections and explanations younger members can understand. The age declaration at signup is a statement from the member; it is not independent age verification. Contact us about a concern involving a younger member.
11. Keeping information secure
We use measures intended to reduce unauthorised access and misuse, including authenticated API access, role permissions, private collection information and administrative records. No online system can guarantee absolute security.
You can help by keeping credentials private, checking uploaded photographs and not sharing codes in advance. Tell us promptly about a suspected account compromise or privacy incident. We assess incidents and notify affected people or regulators when the law requires it.
12. Concerns and complaints
Please contact us first if you are concerned about our use of information. We will acknowledge a data protection complaint within the applicable statutory period, consider it without unnecessary delay and explain the outcome and any available next steps. You may contact the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint or telephone 0303 123 1113. You may also have rights through the courts.
You do not have to obtain our permission to contact the ICO. Other regulators or legal rights may apply if we offer services in another country in the future.
13. Updates to this policy
We will show a last-updated date and explain material changes where appropriate. Publishing an update does not by itself authorise a new purpose that requires a different lawful basis or fresh consent. Our Cookie Policy and Terms provide related information, but neither replaces your privacy rights.