This policy applies to the FavPass mobile application published by Fav Limited on Google Play and the Apple App Store under application identifier io.favcrm.favpass. Merchant use of other FavCRM products is covered by the FavCRM Privacy Policy.
Who we are
Fav Limited (“Fav Limited”, “we”, “us”, or “our”) operates FavPass. FavPass helps members discover and interact with participating businesses, manage passes and bookings, join activities, and access authorized merchant tools.
Questions about this policy or your personal data can be sent to [email protected].
Scope and roles
This policy describes Fav Limited's handling of personal data in FavPass and its supporting services. Participating merchants also control information about their own customers, transactions, bookings, attendance, and services. A merchant's own privacy notice may therefore apply alongside this policy.
When authorized merchant staff use FavCRM business functions inside FavPass, Fav Limited may process merchant and customer records on the merchant's instructions as described in the FavCRM Privacy Policy.
Data we collect
Depending on the features you use, we may collect or process:
- Account and profile data — email address, name, phone number, profile photo, language, date of birth, gender, account identifiers, and authentication records. If you use a passkey, biometric verification remains on your device; we receive the credential information needed to verify the passkey, not your face or fingerprint data.
- Membership, booking, and commerce data — passes, loyalty points, tiers, memberships, packages, reservations, attendance, orders, receipts, payment status, and related activity supplied by you or participating merchants.
- Courses, events, games, and community data — registrations, teams, results, ratings, reviews, invitations, saved venues, and profile or activity details you choose to share with other participants.
- Merchant activity — staff permissions, schedules, member lookups, check-ins, booking actions, and audit information when you use authorized merchant tools.
- Location — approximate or precise location when you grant permission, used to show relevant businesses, activities, and venues near you. You can instead choose a location manually.
- Photos and camera — a photo you select for your profile and camera access when authorized merchant staff scan a booking or member QR code for check-in.
- Calendar — write-only calendar access when you choose to add a booking, event, or course session to your device calendar.
- Notifications — push notification tokens, preferences, and delivery metadata used to send booking, activity, and account alerts you enable.
- Device, usage, security, and support data — device type, operating system, app version, IP address, timestamps, diagnostic logs, security events, and information you include in a support request.
Payment providers may collect payment credentials directly under their own privacy policies. We receive transaction references, status, and other information needed to complete and support the purchase.
How we use data
- Provide, personalize, and maintain FavPass accounts and features.
- Authenticate users and protect the service against fraud, abuse, and security threats.
- Connect members with participating merchants and other activity participants.
- Process bookings, check-ins, memberships, orders, payments, and support requests.
- Send service notifications and communications you request or enable.
- Diagnose problems and improve the reliability, safety, and performance of FavPass.
- Comply with legal obligations and enforce our Terms of Service.
How we share data
We may share personal data with:
- Participating merchants — businesses whose passes, bookings, memberships, activities, or services you access, so they can provide and administer those services.
- Other FavPass users — profile, game, team, review, or activity information that a feature makes visible to participants or that you choose to publish.
- Service providers — hosting, notifications, authentication, maps, payments, email, and support providers that process data to help us operate FavPass.
- App platforms — Google Play and Apple may process app distribution, purchase, device, and diagnostic information under their own policies.
- Legal, safety, and corporate recipients — when required by law, needed to protect rights or safety, or in connection with a merger, financing, or asset transfer, subject to applicable safeguards.
We do not sell your personal data.
Permissions and your choices
FavPass requests device permissions only when a related feature needs them. You can deny or revoke location, camera, photo, calendar, Face ID, or notification access in your device settings. Some related features may then be unavailable. You can also update available profile information and notification preferences in the App.
Retention and deletion
We keep personal data only for as long as needed for the purposes described above. Account data is generally retained while your account is active. When you request account deletion, eligible account data may be deleted immediately; requests that require support review are processed within seven days.
We may retain specific records where reasonably necessary for legal, tax, accounting, fraud prevention, security, or dispute-resolution purposes. A participating merchant may separately retain its transaction, booking, attendance, or payment records under its own legal obligations. We delete or anonymize data when the applicable retention period ends.
See Delete your FavPass account and data for the in-app and web request paths, what is deleted, and what may be retained.
Security and international transfers
We use reasonable administrative, technical, and organizational safeguards designed to protect personal data in transit and at rest. No system is completely secure. Data may be processed in Hong Kong and in other locations where we or our providers operate, which may have different data protection laws from your location.
Your rights
Depending on applicable law, you may have rights to access, correct, delete, or restrict the use of your personal data, or to object to certain processing. To make a request, use the deletion options described above or email [email protected]. We may need to verify your identity before completing a request.
Children
FavPass is not directed to children under 13, and we do not knowingly collect personal data from children under 13. If you believe a child has provided personal data without appropriate authorization, contact us so we can investigate and take appropriate action.
Changes to this policy
We may update this policy as FavPass changes or as legal requirements evolve. We will post the revised policy on this page and update the “Last updated” date. We may also give notice in the App or by email when appropriate.
Contact
Fav Limited — FavPass
Email: [email protected]
Account deletion: favcrm.io/favpass/delete-account/