Last updated: 9 September 2026

This Privacy Policy explains how PASSECOSYSTEM OÜ, trading as PASS Global ("PASS", "we", "us"), collects, uses and protects personal data when you visit https://pass.eu.com (and related domains including pass.ua), contact us, apply for a course, or use our scouting, education and consulting services.

We process personal data in accordance with the EU General Data Protection Regulation (GDPR). If you take part in our programmes in Brazil, Brazil's General Data Protection Law (LGPD) may also apply.

If you do not agree with this Policy, please do not use the website or send us personal data.

The organisation responsible for your personal data (the data controller) is:

• Legal entity: PASSECOSYSTEM OÜ (trading as PASS Global)
• Registered address: Pirita tee 26c/1, apt. 8, 12011 Tallinn, Harju maakond, Estonia
• Registry code: 17532793
• VAT (KMKR): EE103000512

For privacy requests, email office@pass.ua. Enquiries about university programmes can also be sent to university@pass.ua.

We only collect data needed to respond to you, deliver our services, take payment, or operate the website. Depending on how you interact with us, this may include:

We use personal data only for the purposes below, and only where we have a legal basis under GDPR:

• To respond to enquiries and provide support. Legal basis: legitimate interests, or taking steps at your request before entering a contract.
• To enrol you on a course, deliver training and related materials, and communicate about the programme. Legal basis: performance of a contract.
• To process payments and keep records required for accounting and tax. Legal basis: performance of a contract and legal obligation.
• To operate, secure and improve the website, including measuring traffic with Google Tag Manager and Vercel Analytics. Legal basis: legitimate interests. Where cookies are not strictly necessary, we rely on consent where the law requires it.
• To send service messages about your enquiry or course. Legal basis: performance of a contract or legitimate interests.
• To send marketing about PASS services where you have asked for it or it is otherwise permitted. Legal basis: consent, or legitimate interests where applicable. You can opt out at any time.

We do not sell your personal data. We share it only with providers who help us run the website and deliver services, and only as needed:

• Notion — storing contact and course applications
• Google (Google Tag Manager and, where used, Google Forms) — website analytics and course selection tests
• Vercel — hosting the website and website analytics
• Portmone — processing course payments
• Telegram and WhatsApp — if you choose to contact us through those apps
• Tools used to deliver a programme, such as Zoom, Skillcorner and UnderSports, where that programme includes them
• Professional advisers and public authorities where the law requires it, or to establish, exercise or defend legal claims
• A buyer of our business or assets, if we sell all or part of the company

These parties may use your data only for the purposes we instruct, except where they act as independent controllers (for example payment providers and messaging apps, under their own terms).

PASS is established in Estonia (European Economic Area). Some of our providers are located outside the EEA, including in the United States (for example Notion, Google and Vercel).

Where we transfer personal data outside the EEA, we do so on the basis of an adequacy decision where one exists, or standard contractual clauses and other safeguards required by GDPR.

We keep personal data only as long as needed for the purpose it was collected:

• Contact form enquiries: while we handle your request and for up to 24 months afterwards, unless you ask us to delete it sooner
• Course applications, enrolment and payment records: for the duration of the programme and then as required by Estonian accounting and tax law (generally 7 years)
• Website analytics: according to the retention settings of Google and Vercel Analytics
• Correspondence on Telegram, WhatsApp or email: for as long as needed to support you and manage our relationship

When data is no longer needed, we delete or anonymise it.

We use HTTPS (TLS) to encrypt data in transit between your browser and our website, and we limit access to personal data to people who need it for their work.

No method of transmission or storage is completely secure. We cannot guarantee absolute security of data sent over the internet.

A cookie is a small file stored on your device that helps the website function or understand how it is used. We currently use:

• Strictly necessary cookies — needed for the site to work, for example security and load balancing.
• Analytics cookies and similar technologies — Google Tag Manager (which may load Google Analytics or similar tags) and Vercel Analytics, so we can understand visits, popular pages and technical issues. These are not required for the site to work.

We do not currently use advertising, social-plugin or Adobe cookies on this website.

You can block or delete cookies in your browser settings. Blocking some cookies may affect how the site works.

Under GDPR you have the right to:

• access the personal data we hold about you
• ask us to correct inaccurate data
• ask us to delete your data, in certain cases
• object to processing based on legitimate interests, including direct marketing
• ask us to restrict processing, in certain cases
• receive your data in a portable format, where processing is based on consent or a contract and is carried out by automated means
• withdraw consent at any time, where we rely on consent (this does not affect processing already carried out)
• lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), https://www.aki.ee, or with your local supervisory authority

If Brazilian LGPD applies to you, you also have the rights provided by that law, including confirmation of processing, access, correction, and anonymisation or deletion of unnecessary data.

To exercise your rights, email office@pass.ua. We will respond within one month of receiving a valid request. We may need to verify your identity first.

Some data is required to provide a service (for example a paid course). If you do not provide it, we may not be able to enrol you or respond.

Our website and services are aimed at adults. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

We may update this Policy from time to time. The "Last updated" date at the top of this page will change when we do. If changes are material, we will provide a more prominent notice, for example on the website or by email where we have your address.