Who this notice covers
This notice explains how MyPass365 handles personal information in connection with our website, managed event services and MyPass365 applications, including Mobile, Control Centre, scanning and related event tools. References to an app feature apply only where that feature is available and used.
We aim to handle information lawfully, fairly and transparently under South Africa’s Protection of Personal Information Act (POPIA), and the General Data Protection Regulation (GDPR) where it applies to the processing. This notice describes our approach; it is not a certification of compliance.
The current website is a design and information preview. Its event hub contains fictional examples and does not connect visitors to live event records. App release status is shown on the ecosystem page.
MyPass365 and event organisers
For enquiries, business relationships and administration that we determine, MyPass365 acts as the responsible party under POPIA, or controller under GDPR where applicable.
For event accreditation, an organiser or another contracted entity may determine the purposes and rules, with MyPass365 acting as an operator or processor on documented instructions. The role depends on the service arrangement. The event’s own notice should identify its responsible party, purposes and contact details; it supplements this notice.
Contact info@mypass365.com to identify the responsible party for a particular service or event and to route a privacy request.
Information involved
Depending on the service and event requirements, information may include:
- Names, contact details, organisation, job role and account or application references.
- Accreditation photographs, identity or passport information, date of birth and supporting documents where necessary for the stated application or verification purpose.
- Event applications, approval decisions, categories, dates, zones, credentials, wristbands, hospitality allocations and collection records.
- Vehicle, driver, parking and permit details, together with barcode validation and access records such as time, gate, zone and result.
- Service correspondence, support requests and relevant technical records such as device, browser, IP address and security or diagnostic information.
Not every service collects every category. Sensitive or special personal information, including health or ethnicity information, needs a specific lawful justification and appropriate safeguards. Do not send unnecessary identity documents or sensitive information through a general enquiry.
Where information comes from
Information may come directly from you, your employer or organisation representative, an event organiser, an authorised accreditation contractor, or an agreed ticketing or service provider. Access records are created when a credential is validated. Where information comes from another source, the applicable event or service notice should explain that source and the information used.
If you provide information about someone else, ensure you are authorised to do so and that they receive the relevant privacy information.
Why information is used
Typical purposes are responding to enquiries; scoping and delivering agreed services; creating and supporting accounts; processing event applications; producing and distributing credentials; managing hospitality, parking and vehicle permissions; validating access; supporting event teams; and resolving queries, security incidents or legal obligations.
The legal justification depends on the purpose. It may be steps requested before a contract or performance of a contract, a legal obligation, a legitimate interest such as proportionate event access administration or fraud prevention, or valid consent. Legitimate interests must be balanced against your rights. Special-category information requires an additional applicable legal condition.
Required fields and the consequences of not providing information should be explained at collection. Missing information may prevent the relevant application, credential or requested service from being completed. Optional choices should remain separate from essential processing.
Marketing consent is not inferred merely from visiting this site or making an enquiry. Direct marketing must follow applicable law, and you may ask to stop it at any time. Necessary event or service messages are distinct from marketing.
Apps, permissions and access decisions
Where a released app requests access to a camera, photos or files, its permission prompt and feature context should explain the purpose, such as an accreditation photograph, document upload or barcode scan. Notification permissions and preferences can be managed through the app or device where supported. Declining a permission may limit the related feature.
Credential validation checks event permissions and can create an access record. For questions about an approval or access outcome, contact the event team or info@mypass365.com so the decision can be referred for review. Where applicable law protects you against a solely automated decision with legal or similarly significant effects, you may request the relevant safeguards, including human review and the opportunity to contest it.
Signing out, uninstalling an app or clearing its local account settings does not necessarily delete records held for an event. The current Mobile “Remove account” action is a local reset, not server-side erasure. Use the privacy-request route below to request deletion of information held by the relevant responsible party.
MyPass365 Scanner and optional driving-licence scanning
Where an event enables optional driving-licence scanning, MyPass365 Scanner reads the holder’s name and personal identification number and links them to the barcode of an event access device, such as a wristband, badge or sticker. The associated access record includes event and company or permit references, entry/exit direction, scan time, access point and scanner details. The identification number is not displayed on the operator’s scan-result screen; it remains personal information even when hidden.
The information is used for event access and attendance administration and, where necessary and lawful, an identified event-security investigation or a request from a competent authority. It must not be used for advertising, unrelated profiling, general surveillance or unrestricted identification-number searches. Reading a licence does not authenticate the document or establish entitlement to enter an event.
Your choice and the collection notice
The operator must explain the collection before scanning and make the event’s privacy notice available. You can choose Skip licence and continue with a staff access-device scan without licence identity. Separate permit and admission requirements still apply and must be explained separately. Presenting a document is not blanket consent and does not replace a lawful basis or a collection notice.
The event notice must identify the responsible party, its contact details, the purpose and lawful basis, and how to exercise your rights. The respective roles of MyPass365 and the organiser depend on the service arrangement described above. Licence capture uses Scandit technology; this notice does not assert that all SDK processing stays on the device. Applicable service-provider arrangements, storage locations and transfer safeguards must be established before operational use.
Licence-identity retention
The required retention period for licence-derived names and identification numbers is 30 days after the event ends. At expiry, that identity must be deleted or irreversibly de-identified, including in retained access records and derived reports. Other access records may follow the general retention approach below, but that does not automatically extend the licence-identity period. There is no blanket incident, audit or backup exception to this policy; any legally required longer retention needs a separately reviewed lawful basis, restricted access and a release/deletion procedure.
Implementation status: the current Scanner review build includes local expiry cleanup when the app next runs. This does not itself delete server records. Server deletion, report/export restrictions, backup expiry and safeguards against restoring expired identity are still being verified. Optional licence-identity collection must not be enabled for operational use until those controls and the event-specific notice are confirmed. This policy is not a statement that system-wide deletion has already been verified.
Restricted access and disclosure
Full identification numbers must be restricted to authorised personnel with a documented operational need and excluded from routine attendance reports and general exports. Any disclosure to event security or a competent authority must be authorised, recorded and limited to what is reasonably necessary for a specific lawful purpose. The same restrictions apply to third-party copies.
For access, correction, deletion, an objection or a privacy concern, follow Your rights and privacy requests or contact info@mypass365.com to identify the relevant event responsible party. You may also contact the Information Regulator.
Organisations and scanner operators should also read the Scanner responsibilities in our terms.
MyPass365.My.Do — WhatsApp task assistant
MyPass365 Pty Ltd provides My.Do to help participating company teams turn text messages into proposed tasks, clarify requests, confirm assignments and review confirmed work in a dashboard.
Information and purposes
When you use My.Do, we may process your WhatsApp phone number and message identifiers; messages you send or forward; your linked workspace identity; proposed task titles and descriptions; assignees, deadlines and clarification responses; confirmation decisions; and timestamps, delivery status, security and audit records.
We use this information to link authorised users, interpret requests, prepare and revise proposals, create tasks following explicit confirmation, display work in the workspace, deliver service replies and investigate failures or misuse. OpenAI interpretation alone does not confirm a task. My.Do is not intended to make employment, disciplinary or other significant decisions about people.
Only forward information you are authorised to share. Avoid unnecessary personal information, passwords, identity documents and sensitive staff or customer records. People whose information appears in forwarded messages should receive appropriate privacy information.
Providers and workspace access
WhatsApp/Meta processes communications through its platform. Relevant message text and limited staff context are sent to OpenAI for task interpretation. Supabase provides the pilot’s database and backend infrastructure, and the concept dashboard is hosted through OpenAI Sites. These services may process information outside South Africa, subject to applicable arrangements and transfer requirements.
My.Do requests that OpenAI does not store interpretation responses as application conversation history. This setting does not guarantee zero provider retention.
Task information may be visible to people with access to the relevant workspace. The current shared concept does not yet provide individual staff permission boundaries.
Pilot limits, retention and privacy requests
The current concept uses synthetic task content and demo staff identities. Linking a test phone still involves processing its real phone number and related technical records. Real operational staff or customer content must not be introduced until appropriate access, retention and operating controls are established.
Information follows the retention approach in this notice. Exact My.Do retention periods and automated deletion controls remain to be finalised before operational use; this notice does not claim that automatic deletion is already implemented.
To request access, correction, deletion or removal of your linked phone, email info@mypass365.com with the subject “My.Do privacy request.” Do not include passwords, access tokens or pairing codes.
International services and transfers
Events, service providers and infrastructure may operate in more than one country. A transfer outside South Africa must meet POPIA’s applicable conditions. Where GDPR applies, transfers outside the EEA must use a permitted transfer mechanism, such as an applicable adequacy decision or appropriate contractual safeguards, unless a lawful exception applies.
You can ask us which recipients and countries apply to your service and how to obtain information about the relevant safeguards. This notice does not imply that all information is stored in South Africa or that a particular country has an adequacy decision.
Retention and security
The specific 30-day licence-identity policy takes precedence over the general approach below for names and identification numbers captured from a driving licence.
Information should be retained only for as long as needed for its purpose and any applicable contractual, legal, audit or dispute requirements. Relevant factors include the event lifecycle, completion of services, outstanding queries, legal retention duties and the organiser’s authorised retention instructions. Records should then be securely deleted or de-identified as appropriate; restricted backups may remain until their normal deletion cycle.
Our approach is to use technical and organisational safeguards appropriate to the risk, including access restrictions and secure handling. No system can guarantee absolute security. Security incidents must be assessed and reported to the relevant parties, regulators and affected people where the applicable law requires it. Contact us promptly if you suspect misuse of your information.
Your rights and privacy requests
Depending on the applicable law and circumstances, you may request access to information about you, correction of inaccurate information, deletion, restriction, or objection to processing. GDPR may also provide data portability. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. Rights are subject to applicable conditions and exceptions.
Email info@mypass365.com with the subject “Privacy request” and a brief description of your request, the relevant app or event, and a contact address. Do not include passwords, one-time codes or full identity documents in an initial email. Proportionate identity verification may be needed before information is disclosed or changed.
Requests should be handled within the applicable statutory time limits. Where MyPass365 acts for an organiser, we will help direct the request to the appropriate responsible party. An explanation should be provided if a lawful exception prevents a request from being fulfilled.
You may complain directly to South Africa’s Information Regulator. Where GDPR applies, you may also complain to the competent supervisory authority, including in the country of your habitual residence, work or the alleged infringement. You do not have to complete an internal complaints process first.
Children’s information
Children’s information requires particular care. Where a service involves a child, the organiser and MyPass365 must identify the applicable lawful basis and obtain authorisation from a parent, guardian or other competent person where required. Relevant age and consent rules depend on the jurisdiction and service. We do not apply a blanket “under 13” rule to all event processing.
This website and linked services
The event-brief builder processes entries in your browser and uses session storage to carry your answers from the homepage and retain the draft while you move between steps or reload in the same tab. It is not an account or server-side save. Use “Clear this draft” to remove it; browsers normally clear session storage when the tab closes, although session restoration may retain it. If storage is unavailable, the dedicated builder keeps answers only while that page remains open. Downloading creates a local file; choosing email opens your email application for you to review and send. The website does not automatically submit that brief. Do not enter sensitive accreditation records into the planning tool.
The preview’s hosting and sign-in provider processes information under its own notices. Social links open third-party services with their own policies. See our cookie policy for the site’s current storage and tracking position.
Contact and updates
Privacy enquiries: info@mypass365.com
MyPass365, 670 Lobelia Street, Moreletapark, Pretoria, 0044, South Africa.
This notice may be updated as services, laws or processing practices change. The date at the top identifies the edition. Material changes should be brought to users’ attention through an appropriate channel. Event-specific collection notices and agreed service terms remain relevant.