Privacy Policy

Controller and contact

The controller is BallPass. Send privacy questions and requests to support@ballpass.fi.

Data we process

Account data: first name, email address, a secure hash of your password, language preference and account role (member, BallPass location staff or admin).

Membership data: selected plan, membership status, trial and billing-period dates, checkouts used in the billing period, scheduled plan changes and cancellations.

Payment data: payments are processed by Stripe. BallPass does not store your card number. From Stripe we receive e.g. a customer identifier, payment status, amounts, invoices and receipts, and an identifier derived from the card that is used to prevent misuse of the free trial.

Borrowing data: ball tubes borrowed and returned, the BallPass location where this happened, timestamps, rental status (e.g. overdue) and return reminders sent.

QR and scan data: your member QR code is short-lived and contains no personal data. For each scan we store the time, BallPass location, the staff member who scanned, the result and any rejection reason.

Referral data: your referral code, whose code you joined with, and referral rewards earned and used.

Inquiries: details sent through the partner inquiry form (e.g. center name, contact person, email, phone and message).

Security data: login sessions and information about failed or unusual scans, used to prevent misuse.

Purposes and legal bases

We process data to perform the membership contract: account management, membership and billing, borrowing and returning ball tubes, and customer support.

Based on legitimate interest we process data to keep the service secure, prevent misuse (such as repeated use of the free trial) and improve the service.

Based on legal obligations we keep accounting records related to payments.

Emails

We send service emails such as password resets, return reminders and notices about trial end, renewal and failed payments. We do not send marketing emails without your consent.

Recipients

Stripe (payment processing), our email service provider (service emails) and the cloud service used to run BallPass.

When you borrow or return a tube, BallPass location staff see your first name, your membership status and the rentals of their own location.

The map uses OpenStreetMap, so your browser loads map tiles directly from their servers.

Some providers may process data outside the EU/EEA. Such transfers rely on the European Commission's standard contractual clauses or another lawful transfer mechanism.

Cookies and browser storage

We only use a strictly necessary login cookie and browser storage to remember your language. We do not use analytics or advertising cookies.

Retention

We keep account data for as long as your account exists. Accounting-related payment data is kept for the period required by law. Other data is deleted or anonymized when no longer needed.

Your rights

You have the right to access your data, have inaccurate data corrected, request erasure or restriction of processing, object to processing based on legitimate interest, and receive your data in a portable format.

To request account deletion or a copy of your data, contact support@ballpass.fi. An active membership and any open rental must be ended before the account is deleted.

You also have the right to lodge a complaint with the Finnish Data Protection Ombudsman.

Security

Passwords are stored as hashes, connections are encrypted, QR codes rotate constantly and are single-use, and access to data is restricted by role.