Privacy Policy

Last updated: 23 September 2026

1. Who we are

PassTheDay is an online platform that allows customers to discover and book Day Passes, Spa & Wellness experiences, Day Rooms and other daytime experiences offered by participating hotels, resorts, spas and other venues.

For personal information collected through the PassTheDay website and booking platform, PassTheDay acts as the data controller unless otherwise stated.

Participating hotels, resorts, spas and other venues may separately act as data controllers for information they receive in connection with providing your booked experience.

2. Information we collect

The information we collect depends on how you use PassTheDay.

Information you provide when making a booking

This may include:

• First and last name
• Email address
• Telephone number
• Country
• Booking date
• Number of guests
• Selected venue
• Selected experience
• Booking price
• Booking reference
• Special requests you choose to provide
• Information relating to changes or cancellations

Account information

If you create a PassTheDay account, we may collect:

• Name
• Email address
• Telephone number
• Login information
• Account status
• Booking history

Passwords are stored securely using the authentication system used by our website and are not visible to PassTheDay staff in plain text.

Google Sign-In

If you choose to register or sign in using Google, Google may provide us with basic information associated with your Google account.

Depending on the permissions requested, this may include:

• Your name
• Email address
• Google account identifier
• Profile image

We use this information only to authenticate you and create or connect your PassTheDay account.

Using Google Sign-In does not give PassTheDay access to your Gmail messages, Google Drive files, contacts or other Google services unless additional permission is specifically requested.

3. Payment information

When you make a paid booking, payment is processed using our payment provider Viva Wallet.

PassTheDay may receive information relating to the transaction, such as:

• Amount paid
• Payment status
• Transaction reference
• Payment date
• Refund status
• Limited payment method information

PassTheDay does not normally receive or store your complete debit or credit card number, security code or full card details. These are handled by the relevant payment provider.

The payment provider processes information according to its own privacy policy and security procedures.

4. Information collected automatically

When you use our website, certain technical information may be collected automatically.

This may include:

• IP address
• Browser type
• Device type
• Operating system
• Pages visited
• Date and time of visits
• Referring website
• Website activity
• Approximate location derived from IP address
• Cookie and consent preferences

This information may be used to operate the website, maintain security, diagnose technical problems and understand how visitors use PassTheDay.

5. Contact forms and communications

If you contact PassTheDay through a website form, email or another communication channel, we may collect:

• Your name
• Email address
• Telephone number where provided
• The contents of your message
• Any other information you voluntarily provide

We use this information to respond to your enquiry and provide customer support.

General enquiries may be handled through: contact@passtheday.com

Booking-related enquiries may be handled through: reservations@passtheday.com

6. How we use your information

We may use personal information to:

• Process and confirm bookings
• Take and verify payments
• Send booking confirmations
• Send booking information to the relevant venue
• Manage cancellations, changes and refunds
• Create and manage customer accounts
• Allow customers to view booking history
• Authenticate users
• Provide customer support
• Respond to enquiries
• Communicate important information about bookings
• Prevent fraud and misuse
• Maintain website security
• Improve the operation of PassTheDay
• Maintain financial and accounting records
• Comply with legal obligations
• Establish or defend legal claims

We will not use personal information for purposes that are incompatible with the reason it was originally collected unless permitted by applicable law.

7. Legal basis for processing

Under applicable data protection law, we process personal information using one or more legal bases.

Performance of a contract

We process information where it is necessary to provide the service you requested. For example, we need your name, email address and booking information to make and administer a reservation.

Legal obligations

We may process and retain information where necessary to comply with accounting, tax, regulatory or other legal requirements.

Legitimate interests

We may process information where reasonably necessary for legitimate business interests, including:

• Preventing fraud
• Maintaining website security
• Improving our services
• Managing customer enquiries
• Protecting our legal rights

Where we rely on legitimate interests, we consider those interests against your privacy rights.

Consent

Where required, we may ask for your consent before processing information. Examples may include certain marketing communications, optional cookies or analytics technologies.

Where processing is based on consent, you may withdraw your consent.

8. Sharing information with venues

When you book an experience, we must provide the relevant hotel, resort, spa or other Partner with enough information to fulfil your booking.

This may include:

• Your name
• Booking reference
• Email address
• Telephone number
• Booking date
• Number of guests
• Experience purchased
• Amount or payment status where relevant
• Special requests associated with the booking

The Partner needs this information so that it can recognise and provide your reservation when you arrive.

After receiving your information, the Partner may process it according to its own privacy obligations and policies.

9. Other organisations we may share information with

We may share personal information with service providers necessary to operate PassTheDay.

These may include:

• Payment processors
• Website hosting providers
• Email service providers
• IT and website developers
• Authentication providers
• Cloud service providers
• Analytics providers
• Security and fraud-prevention providers
• Accounting and professional advisers

These organisations receive only information reasonably necessary for the relevant service.

Where a service provider processes information on our behalf, appropriate data protection arrangements are used as required by law. The distinction between a controller and a processor depends on who decides why and how the data is processed.

We may also disclose information where required by law, court order or a competent regulatory or public authority.

10. Marketing communications

We may occasionally send information about PassTheDay services, offers or new experiences where you have agreed to receive such communications or where otherwise permitted by applicable law.

You can unsubscribe from marketing emails at any time using the unsubscribe option included in the email or by contacting us.

Transactional emails relating to an existing booking are not marketing messages and may still be sent when necessary to administer your reservation.

11. Cookies

PassTheDay may use cookies and similar technologies.

Cookies may be used for purposes including:

• Keeping users signed in
• Maintaining shopping cart or checkout information
• Remembering user preferences
• Website security
• Processing bookings
• Remembering cookie choices
• Website analytics
• Measuring website performance

Some cookies are essential for the website to function.

Non-essential cookies, including certain analytics or advertising cookies, will be used in accordance with applicable consent requirements.

Users should be able to accept or refuse optional cookies. EU guidance distinguishes necessary site functionality from optional analytics and third-party cookies and provides users with control over those choices.

Additional information may be provided in our Cookie Policy.

12. Data retention

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected and to meet legal, accounting and regulatory requirements.

Different information may be retained for different periods. For example:

Booking and transaction records may be retained for the period necessary for accounting, tax, dispute and legal purposes. Cyprus company law requires accounting books and supporting transaction records to be retained for six years after the relevant calendar year.

Customer accounts may remain active while the customer maintains an account with PassTheDay.

Customer support communications may be retained for a reasonable period after the enquiry has been resolved.

Website technical and security logs may be retained for shorter periods unless required for investigating security incidents.

Where information is no longer required, it may be deleted or anonymised unless continued retention is required by law.

13. International data transfers

Some of the technology providers used by PassTheDay may operate servers or provide services from countries outside Cyprus or the European Economic Area.

Where personal information is transferred outside the European Economic Area, we will use appropriate safeguards where required by applicable data protection law.

These may include recognised adequacy arrangements, contractual safeguards or other lawful transfer mechanisms.

14. Data security

We take reasonable technical and organisational measures designed to protect personal information against:

• Unauthorised access
• Accidental loss
• Destruction
• Alteration
• Disclosure
• Misuse

These measures may include access controls, encrypted connections, password protection, secure authentication, backups and restricted administrative access.

No internet-based system can guarantee absolute security, but we take reasonable measures appropriate to the nature of the information processed.

15. Your data protection rights

Depending on applicable law and the circumstances, you may have rights relating to your personal information including:

• Right of access — to request information about personal data we hold about you
• Right to rectification — to have inaccurate information corrected
• Right to erasure — to request deletion in certain circumstances
• Right to restriction — to request limits on how information is processed
• Right to data portability — to receive certain information in a portable format
• Right to object — to object to certain processing
• Right to withdraw consent — where processing is based on consent

These are among the principal rights provided by the GDPR.

These rights are not absolute and may be subject to legal exceptions. For example, we may need to retain transaction information even after an account is deleted because of legal accounting requirements.

To exercise your rights, contact: contact@passtheday.com

We may need to verify your identity before responding to certain requests.

16. Complaints

If you have concerns about how PassTheDay processes your personal information, please contact us first so that we can investigate the matter.

You also have the right to lodge a complaint with the appropriate data protection supervisory authority.

For PassTheDay's Cyprus operations, this is the:

Office of the Commissioner for Personal Data Protection – Republic of Cyprus

Your right to complain to a supervisory authority forms part of the information GDPR privacy notices are expected to provide.

17. Children

PassTheDay is intended to allow adults to make bookings.

A parent, guardian or responsible adult may include children as guests where the relevant venue permits children.

Children should not independently create accounts or submit personal information through PassTheDay unless permitted by applicable law.

18. Health and sensitive information

PassTheDay does not normally require customers to provide medical or health information.

Certain spa treatments may require customers to disclose relevant health information directly to the spa or treatment provider before receiving a treatment.

Unless specifically stated otherwise, such information should be provided directly to the venue rather than through PassTheDay.

19. Third-party websites

PassTheDay may contain links to websites operated by hotels, spas, payment providers, Google or other third parties.

Those websites operate under their own privacy policies.

PassTheDay is not responsible for the privacy practices of third-party websites.

20. Changes to this Privacy Policy

We may update this Privacy Policy when our services, technology or legal requirements change.

The latest version will be published on this page with the date of the most recent update.

Material changes may also be communicated through the website or by email where appropriate.