UK GDPR & DATA PRIVACY

Privacy Policy & Data Protection Notice

Effective date: 28 September 2026 · Last updated: September 2026

Summary for UK & International Users

URPASS complies with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018), and the Privacy and Electronic Communications Regulations (PECR).

When you register for an event organized by a third-party host, the Event Organizer is the Data Controller, and URPASS acts as the Data Processor. When you create an organizer account with URPASS, URPASS is the Data Controller of your account information.

1. Who We Are

URPASS ("we", "our", "us") operates the digital event registration, ticketing, pass generation, and entrance check-in platform available at urpass.space.

If you have questions regarding this Privacy Policy or your data protection rights under the UK GDPR, you can contact our Data Protection desk at:

Email: privacy@urpass.space / srinithin@yespstudio.com
Address: Yesp Corporation, Data Protection Office
Subject: UK GDPR Data Subject Access / Erasure Request

2. The Data We Collect

We collect personal information depending on how you interact with our platform:

Event Attendees: Full name, email address, mobile phone number, ticket tier, custom registration answers configured by the organizer (e.g. dietary requirements, company, student ID number), check-in timestamp, and entry gate location.
Event Organizers & Staff: Name, work email address, organization name, billing details, password hash, IP address, and role permissions (Admin, Event Manager, Scanner).
Payment & Billing Data: Transaction ID, invoice address, VAT / GST number, card brand, and last 4 digits. Full credit/debit card numbers and bank security codes are processed directly by our PCI-DSS Level 1 certified payment partners (Stripe and Razorpay) and are never stored on URPASS servers.
Technical & Log Data: Browser type, operating system, device camera access for QR scanning (camera video stream is processed entirely client-side and never recorded or transmitted to servers), IP address, and approximate geolocation.

3. Lawful Basis for Processing (UK GDPR Article 6)

Under the UK GDPR, we process your personal data under the following legal bases:

Performance of a Contract (Article 6(1)(b)): To deliver digital event passes, issue tax invoices, process payments, and validate your ticket entry at the gate.
Legitimate Interests (Article 6(1)(f)): To detect duplicate QR ticket entry, prevent fraud, secure our servers, and ensure scanner speed and reliability.
Legal Obligation (Article 6(1)(c)): To comply with tax, statutory accounting, and financial reporting laws (e.g. HMRC VAT and Indian GST invoicing).
Consent (Article 6(1)(a)): For optional promotional updates, non-essential cookies, or specialized registration field questions.

4. How Long We Keep Your Data

We retain attendee data only for as long as necessary to fulfill the purposes of the event and satisfy legal, accounting, and reporting obligations:

Event Pass & Check-In Logs: Retained for 12 months following event completion, after which organizers can archive or permanently delete attendee lists.
Financial Invoices & Receipts: Retained for 6 years in compliance with HMRC and statutory tax rules.
Inactive User Accounts: Deleted or anonymized after 24 months of total inactivity.

5. Your Rights Under UK GDPR

As a data subject in the United Kingdom or European Economic Area, you have significant rights:

Right of Access (Article 15): Request a copy of all personal data we hold about you.
Right to Rectification (Article 16): Request correction of inaccurate or incomplete data.
Right to Erasure / Right to be Forgotten (Article 17): Request deletion of your attendee pass data and personal profile.
Right to Restrict Processing (Article 18): Ask us to restrict how we use your information.
Right to Data Portability (Article 20): Receive your data in a structured, machine-readable format (CSV/JSON).
Right to Object (Article 21): Object to any processing based on legitimate interests.

To exercise any of these rights, email us at privacy@urpass.space. We respond to all verified UK GDPR requests within 30 days without charge.

You also have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner's Office (ICO), at ico.org.uk.

6. Cookies & PECR Compliance

Under the Privacy and Electronic Communications Regulations (PECR), we use strictly necessary cookies to keep you signed in and preserve session security. Non-essential analytical cookies require your explicit prior consent via our cookie banner.

You can modify your cookie preferences at any time by clearing your browser cache or clicking "Cookie Preferences" in our footer.

7. Data Processing Addendum (DPA) for Organizers

For corporate, university, and business organizers acting as Data Controllers under the UK GDPR, our standard Data Processing Addendum (DPA) governs all attendee processing. By using URPASS to collect registrations, you agree to our standard contractual clauses ensuring GDPR-compliant data processing.

Home