Terms of Service

These terms are an agreement between the founder and operator of PassTally, a sole trader based in China, whom you can reach at hello@passtally.com (“PassTally”, “we”, “us”) and the business that creates a PassTally account (“you”). By creating an account or using PassTally you accept these terms on behalf of your business. PassTally is for business use only; it is not offered to consumers.

1. The service

PassTally lets you record prepaid session packages, check customers in, keep a history of every check-in, and share a member card link with your customers. PassTally is a record-keeping tool: it does not take payments from your customers. You remain responsible for the services you sell, the prices you charge and any refunds to your customers.

2. Your account and team

3. Plans, payment and refunds

4. Your data

5. Acceptable use

You must not:

We may suspend an account that breaks these rules or puts others at risk. Where we can, we will tell you first and give you a chance to fix the problem.

6. Availability and changes

We work to keep PassTally available and your data safe, but we do not promise it will always be available or error-free, and we may need planned maintenance. We may improve or change features. If we remove a major paid feature, you may cancel and receive a pro-rata refund for the unused part of your paid period.

We may update these terms. For important changes we will give owners at least 30 days’ notice by email or in the app. If you continue to use PassTally after that, the new terms apply.

7. Cancelling and closing your account

8. Liability

9. General

Schedule: Data processing terms

This schedule applies when we process personal data on your behalf (“Customer Personal Data”), and is intended to meet Article 28 of the UK GDPR and EU GDPR.

  1. Details of processing. Subject matter and purpose: providing PassTally to you. Duration: while your account is open, then until deletion as set out below. Data subjects: your customers and your staff. Types of data: names, contact details, notes you choose to record, packages, check-in history and member card links. We do not expect special category data; see section 5 of the terms.
  2. Instructions. We process Customer Personal Data only on your documented instructions, which are these terms and your use of the service, unless the law requires otherwise (in which case we will tell you unless the law prevents it).
  3. Confidentiality. Everyone we authorise to process Customer Personal Data is bound by confidentiality.
  4. Security. We maintain appropriate technical and organisational measures, including encryption in transit and at rest, access control by role, hashed sign-in codes and session tokens, an append-only check-in history, and regular backups.
  5. Sub-processors. You authorise the sub-processors listed in our Privacy Policy. We will give you at least 30 days’ notice of a new sub-processor by updating that list and emailing owners; you may object, and if we cannot address your objection you may cancel and receive a pro-rata refund. We impose data protection terms on each sub-processor that are no less protective than these and remain responsible for them.
  6. International transfers. We operate PassTally from China, and Customer Personal Data is accessed from China. To the extent this is a restricted transfer, you (as data exporter) and we (as data importer) agree to the EU standard contractual clauses (Commission Implementing Decision (EU) 2021/914, Module Two: controller to processor) together with the UK International Data Transfer Addendum, which are incorporated into these terms by reference, with the details in item 1 of this schedule as the description of the transfer and the security measures in item 4 as Annex II. For sub-processors outside the UK or EEA, we use adequacy regulations or equivalent safeguards.
  7. Assistance. Taking into account the nature of the processing, we help you respond to requests from individuals (the app lets you view, edit, export and delete customer records) and with security, breach notification, impact assessments and regulator consultations.
  8. Breaches. We will notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data, with the information you reasonably need to meet your own obligations.
  9. Deletion and return. You can export your data at any time. When you delete your account, we delete Customer Personal Data from live systems immediately and from backups within 30 days, unless the law requires us to keep it.
  10. Audits. We will make available the information reasonably necessary to show compliance with this schedule, and respond to reasonable written questions. Any on-site audit requires reasonable notice and is at your cost, no more than once a year unless required by a regulator or following a breach.