Privacy Notice
Version 1.0 · Effective 2026-10-14
This notice explains how Identity Lab, UAB, company code 306161668, Mileišiškių g. 66, Vilnius LT-10211, Lithuania ("Soverio", "we") processes personal data as controller when it operates the Pasai platform at https://pasai.eu (the "Service").
Our contact for data protection: contact@soverio.com.
When we are not the controller
Companies use the Service to manage their product passports. The content of a company's workspace is processed by us on that company's behalf:
- its products, documents and passports;
- the accounts of its staff;
- its suppliers' submissions;
- the access logs of its passports.
That company is the controller of that data. Please contact the company to exercise your rights; we help it answer.
What we process, why, and on what legal basis
| Who | Data | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| Users of the Service | Name, e-mail address, password (stored only as a hash), multi-factor authentication settings, role, workspace, sign-in times, IP address and browser identifier | Signing you in securely, protecting accounts and the platform | Article 6(1)(b) for our customers' contract; Article 6(1)(f), our legitimate interest in a secure service |
| Users of the Service | Acceptance records: which version of our terms you accepted, when, from which IP address, and, if you accepted for a company, your position | Proving which terms apply | Article 6(1)(f); Article 6(1)(c) where the law requires us to keep evidence |
| Billing contacts of our customers | Company name, contact name, e-mail address, billing address, VAT number, invoices. Card details go directly to Stripe and never reach us | Billing, invoices, accounting | Article 6(1)(b); Article 6(1)(c), accounting law |
| People who contact us | Name, e-mail address, company, your message | Answering you | Article 6(1)(f) |
| Everyone using the Service | Error reports, with personal data removed before sending | Fixing faults | Article 6(1)(f) |
Cookies and similar storage
We use only what the Service needs to work:
- Sign-in session cookies, set by our identity provider while you are signed in.
- A cookie that remembers whether the menu is collapsed, kept 7 days.
- Your chosen language, kept in your browser.
- A language cookie on public passport pages, set only when you choose a language, and kept one year.
We use no analytics or advertising cookies.
Who receives data
| Recipient | Role | Location |
|---|---|---|
| Contabo GmbH | Hosting provider | European Union |
| Google Cloud EMEA Limited (Ireland) | E-mail relay | EU and US |
| Stripe Payments Europe, Limited (Ireland) | Payment processing | EU and US |
| The company whose workspace you use | Sees your activity in its workspace's audit log | — |
| Authorities | Only where the law requires it | — |
Where data leaves the European Economic Area, we rely on an adequacy decision or the European Commission's standard contractual clauses. Ask us for a copy.
How long we keep data
| Data | Period |
|---|---|
| Account data | While the account exists. After its deletion, only in backups (up to 12 weeks) and in the records kept as evidence below |
| Sign-in sessions | Until you sign out or the session expires |
| The audit trail of actions in a workspace, with IP address and browser identifier | For the retention period of the passports concerned, as evidence of who did what. It is never altered |
| Acceptance records | For the life of the agreement and 10 years after, as evidence |
| Billing records | The period Lithuanian accounting law requires |
| Messages to us | 2 years after the last contact |
| Backups | Up to 12 weeks in the normal backup cycle |
Your rights
You can ask us for the following:
- access to your personal data;
- its correction or erasure;
- restriction of its processing;
- its portability.
You can also object to processing based on our legitimate interest. Write to contact@soverio.com. We answer within one month.
You may lodge a complaint with a supervisory authority. In Lithuania, that is the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, https://vdai.lrv.lt). You can also complain in the EU country where you live or work.
Changes
We publish each new version of this notice with its date. If a change affects you materially, we tell you in the Service.