Privacy Policy

StagePass is operated by:

We have not appointed a Data Protection Officer, as we are not required to under Article 37 GDPR. Privacy enquiries are handled by the management at the address above.

StagePass is a business-to-business access-control tool for live events. Tours, festivals, venues and productions (our customers) use it to issue accreditation passes to their crew, artists, contractors and guests, and to check those passes at a gate — including when the device has no network connection.

StagePass is not available to the general public. Accounts are created and administered by the organisation running the event. If you were given a pass or a login by a production or venue, that organisation — not futureDOCTOR s. r. o. — decides what data about you goes into StagePass.

This distinction determines who you should contact about your data, so it is worth reading.

3.1 We are a processor for event data

For everything our customers put into StagePass about the people they accredit, we act as a processor under Article 28 GDPR. The customer is the controller.

This covers pass holder names, email addresses, badge photos, access permissions, pass and ticket records, and the scan history generated at their gates.

We process this data only on the customer's documented instructions, as set out in the Data Processing Agreement we conclude with each customer. We do not decide what data is collected, who is accredited, or how long a customer keeps its event records. We do not use event data for our own purposes, and we never use it to train machine-learning models.

If you hold a StagePass pass and want to access, correct or delete your data, contact the production, venue or festival that accredited you. They are the controller. If you contact us directly we will forward your request to them and tell you we have done so, but we cannot act on it ourselves without their instruction.

3.2 We are a controller for account and service data

For a smaller set of data we determine the purposes ourselves, and act as controller:

• account data for the administrators and staff who sign in to manage a StagePass tenant (name, work email address, role, profile photo where provided);
• support correspondence you send us;
• billing and contract data for the customer organisation;
• security, abuse-prevention and service-integrity records, such as authentication events and error diagnostics.

For this data, the rights in section 14 can be exercised directly against us.

Badge photos are not biometric data

StagePass shows the badge photo to a human being, who compares it with the person in front of them. The app performs no facial recognition, no template extraction and no automated matching of any kind.

Under Article 9(1) GDPR read with Recital 51, a photograph becomes special-category biometric data only when it is processed “through a specific technical means allowing the unique identification or authentication of a natural person”. StagePass does not do this, so badge photos are ordinary personal data. They are still sensitive in practice, and we treat them accordingly.

StagePass asks for the minimum set of permissions it needs, and each one is used for exactly one thing:

• Camera — scanning pass QR codes at the gate, and capturing a badge photo when accrediting someone. QR codes are decoded entirely on the device; no camera stream is transmitted or recorded.
• Photo library (optional) — choosing an existing badge photo instead of taking one. Only the image you pick is read.
• Notifications (optional) — telling the app that the roster has changed so it can refresh before doors. You can decline and the app continues to work.
• Network access — syncing with the StagePass backend.

Declining the photo library or notification permission does not prevent you from using the app.

We think this list matters as much as the one above.

• No analytics or tracking. The app contains no analytics SDK, no advertising SDK, no crash-reporting SDK and no tracking pixels. We do not build usage profiles.
• No location data. StagePass never requests or accesses device location. A gate is identified by the area an operator selects, not by GPS.
• No advertising. We show no ads and share nothing with ad networks or data brokers.
• No sale of personal data. We do not sell, rent or trade personal data. We never have.
• No contacts, microphone, calendar or health data. The app does not request access to these.
• No use of event data for our own ends. We do not analyse our customers' accreditation data for product research, benchmarking, or model training.

Where we act as processor, the legal basis is determined by our customer as controller — typically the performance of their contract with you, their legitimate interests in securing a venue, or their legal obligations around site safety.

Where we act as controller, we rely on:

• Article 6(1)(b) — performance of a contract: providing the service to the customer organisation and its authorised users.
• Article 6(1)(f) — legitimate interests: keeping the service secure, preventing abuse, diagnosing faults, and defending legal claims. We have assessed these interests against your rights and freedoms.
• Article 6(1)(c) — legal obligation: retaining accounting records and responding to lawful requests from authorities.
• Article 6(1)(a) — consent: for push notifications, which you grant through the operating system prompt and can withdraw at any time in your device settings.

StagePass is built to keep working when the network does not, so it deliberately keeps a copy of operational data on the device itself:

• an encrypted-at-rest local database containing the roster of passes, tickets, events and areas the signed-in account is entitled to see;
• badge photos cached as files, so a face still appears at a gate with no signal;
• a queue of scans recorded while offline, held until they can be delivered to the server;
• authentication tokens, held in the iOS Keychain or the Android Keystore.

This on-device data is protected by the device's own operating-system sandbox and platform encryption. It is removed when you sign out or uninstall the app. Because this cache can contain personal data about a customer's crew, devices running StagePass should be passcode-protected and should not be shared outside the accredited team.

Push notifications are used only to prompt the app to synchronise, so that a gate device holds a current roster before doors open. They carry no accreditation content beyond what is needed to trigger that refresh.

To deliver them we send a Firebase Cloud Messaging registration token, the platform, a per-installation identifier and the app version to our backend. Delivery is then handled by Google (Firebase Cloud Messaging) and, on iOS, by Apple (Apple Push Notification service).

You can turn notifications off at any time in your device settings.

We disclose personal data only to the following categories of recipient, and only as far as necessary:

Each is engaged under a data processing agreement containing the guarantees required by Article 28 GDPR.

We also disclose personal data where we are legally obliged to do so, or where it is necessary to establish, exercise or defend legal claims. Should our business be transferred, personal data may pass to the acquirer; we would inform affected customers beforehand.

We do not share personal data with anyone else. In particular, we share nothing with advertisers, data brokers or social networks.

Our infrastructure — application servers, database and image storage — is hosted in the European Union, and event data stays there in normal operation.

The push notification services operated by Google and Apple may involve processing in the United States. These transfers take place under the European Commission’s Standard Contractual Clauses together with the EU–US Data Privacy Framework, supported by the supplementary technical measures described in section 13. Only a device token and the minimal trigger payload described in section 9 are involved — never accreditation data or badge photos.

Event data (processor role). We keep it for as long as our customer's account is active and they instruct us to. When a customer's contract ends, we delete or return their data within 90 days, except where EU or Slovak law requires us to keep it longer. Customers can delete individual records at any time from within the product.

Account data (controller role). Kept while the account is active, then deleted within 90 days of closure.

Security and authentication logs. Kept for up to 12 months, then deleted.

Billing and accounting records. Kept for 10 years, as required by Slovak accounting and tax law.

Support correspondence. Kept for 24 months after a matter is closed.

Backups are cycled on a rolling basis and fully overwritten within 35 days, so data deleted from the live system may persist in backups for that period.

• All traffic between the app and our servers is encrypted with TLS.
• Data is encrypted at rest on our servers and in object storage.
• Badge photos are stored in a private bucket and are never publicly readable; the app retrieves them through short-lived, signed URLs.
• Authentication uses short-lived access tokens with rotating refresh tokens, held on the device in the platform secure store (iOS Keychain / Android Keystore).
• Every tenant's data is isolated, and access is scoped by role — a guard account cannot read the administrative directory.
• Access to production systems by our staff is restricted to named personnel, requires multi-factor authentication, and is logged.

No system is perfectly secure. If a personal data breach occurs, we will notify the supervisory authority within 72 hours where Article 33 GDPR requires it, and inform affected customers without undue delay so that they can meet their own obligations as controllers.

Under the GDPR you have the right to request access to your personal data, its rectification or erasure, restriction of processing, portability, and to object to processing based on legitimate interests. Where processing rests on consent, you may withdraw it at any time without affecting the lawfulness of what came before.

Which of us to contact:

• If you hold a StagePass pass — contact the production, venue or festival that accredited you. They are the controller of your data. We will help them respond.
• If you have a StagePass administrator or guard account, or have corresponded with us — write to privacy@futuredoctor.group. We respond within one month, as required by Article 12(3) GDPR.

You also have the right to lodge a complaint with a supervisory authority. Ours is:

You may also complain to the authority in your own country of residence or workplace.

A StagePass scan produces an automated grant-or-deny result by comparing a pass against the permissions and scan window the customer configured. A human operator is always present at the gate, sees that result, and decides what to do about it. There is no automated decision producing legal effects or similarly significant effects within the meaning of Article 22 GDPR.

StagePass is a professional tool for accredited event personnel and is not directed at children. We do not knowingly process the data of anyone under 16 in a controller capacity. Where a customer accredits a minor — a young performer, for instance — that customer is the controller and is responsible for the legal basis.

We update this policy when the app or our processing changes. The date at the top always reflects the current version. For material changes we notify customer organisations by email before the change takes effect, and where the law requires it we will seek fresh consent.