Incident #1E215B · 20 FEB 2026minor
Epassi adds a payment transactions section listing data collected and retention periods
The privacy policy adds a new row (3.1.3) for executing Epassi payment transactions and instruments. It lists data processed (name, employer, transaction details, purchase history, usage logs, device, contact details, account balances), states retention of up to two years after use ends and ten years for financial data, and cites contract, legitimate interest and legal obligation as legal bases. The document date was also updated to 20.2.2026.
Taken from you
- Purchase history, usage logs, device and account balance data are now explicitly listed as processed for payments
- Processing for service 'development' is justified by legitimate interest
- Financial and transaction data retained for ten years
Won back
- Clear statement of retention periods (end of use plus two years; ten years for financial data)
- Stated legal bases for payment data processing
Evidence · 3 of 3 quotes matched in source
Personal data is retained for as long as the end-user uses Epassi services and for up to two years thereafter.+ inserted · ✓ matched in source
Financial and transaction-related data is retained for ten years from the date of creation as required by law.+ inserted · ✓ matched in source
Legitimate interest (service maintenance and development)+ inserted · ✓ matched in source
Archived version ↗ · 131 words changed