Privacy & Security Policy

At a glance

• PAN never scans people in the background.
• Nothing happens unless you choose to use PAN.
• Face recognition and payments are optional and revocable.
• You only get marketing, including offers from merchants, if you opt in.
• You can delete your data at any time.
• We never sell your data.

Who we are

PAN is responsible for your personal data under this policy (the data controller).

PAN, Finchley Road, London NW2.

For any question or request about your data, email data@get-pan.com.

What data we collect

Depending on how you use PAN, we may collect:

• Account and contact details, such as your name, email and mobile number.
• Biometric data, only with your explicit consent.
• Payment details, handled by our regulated payment provider. PAN does not store full card details.
• Transaction and loyalty activity, such as where you paid, what you spent and the points or rewards you earned.
• How you found PAN, such as the merchant or campaign that brought you in.
• Device, diagnostic and security information, such as crash reports and sign-in records.
• Your consent choices and any messages you send us.

Face recognition (important)

Signing up with your face is part of the PAN service, but it is your choice.

We ask explicitly before creating or storing any biometric data.

• We do not store photos or videos of your face.
• We store a secure mathematical representation instead.
• If a face match is uncertain, we ask for extra verification, such as digits of your mobile number.
• You can withdraw biometric consent at any time.

Withdrawing biometric consent immediately disables face recognition and deletes associated biometric data.

How we use your data, and why

We only use your data when the law allows it. For each use, the reason is in brackets.

• To run PAN for you: identify you at checkout, process payments and apply rewards (to provide the service you signed up for).
• To recognise your face (your explicit consent).
• To tell you when PAN is ready, if you join the waitlist (your consent).
• To send you news and offers, including offers from merchants you use, tailored to your activity, if you opt in (your consent).
• To credit the merchant or campaign that brought you to PAN, and to apply offers (our legitimate interests).
• To keep PAN secure and prevent fraud (our legitimate interests).
• To improve PAN, using combined or de-identified data where we can (our legitimate interests).
• To meet our legal and regulatory obligations (legal obligation).

PAN processes personal data in line with UK GDPR and EU GDPR.

If you join the waitlist

Before the PAN app is available, you can join the waitlist at get-pan.com. We collect your name, your email and where you found us, such as the merchant where you scanned a sign-up code and any offer that was showing.

• If you sign up more than once, we keep each sign-up.
• If you create a PAN account with the same email, we link your sign-ups to it.
• Merchants only see how many people signed up through them, not who.

Offers and rewards

Some merchants or campaigns may offer a reward for joining PAN.

• An offer belongs to the sign-up it came with.
• Your offer is the one from your first sign-up. Signing up again, anywhere, doesn't change it. If your first sign-up had no offer, a later one won't add one.
• We check an offer is still valid before we apply it.
• We record when a reward is given and used, to prevent misuse.

Participating merchants

Merchants that accept PAN are independent businesses.

• When you pay or collect points with a merchant, they receive the details of that transaction and the account details needed to support it, such as your name and email.
• Merchants can see your activity with them through PAN, such as your purchases and rewards at their business. They don't see your activity with other merchants.
• If you opt in to offers, merchants can create offers that PAN sends to you, based on your activity with them. Merchants don't receive your contact details for this.
• Merchants never receive your biometric data or full card details.

Each merchant is responsible for how it uses the data it receives, under its own privacy policy.

Who we share data with

• Service providers who help us run PAN, such as hosting, payment processing, mobile verification, messaging and notifications, and error monitoring. They only use your data on our instructions.
• Participating merchants, as described above.
• Banks and payment networks, to complete your payments.
• Professional advisers, regulators, law enforcement and others, where the law requires it or to protect PAN and the people who use it.
• A buyer or investor, if PAN's business is sold or restructured. Your data stays protected under this policy.
• Anyone else, only with your permission.

International transfers

Some of our service providers process data outside the UK. When they do, we make sure your data is protected to UK standards, for example by using contracts approved for use in the UK.

Security

Security is built into PAN from the start.

We minimise the data we collect and restrict where it can be accessed.

• Sensitive data is encrypted in transit and at rest.
• Biometric data is encrypted before it is stored.
• Your phone and merchant devices never receive stored biometric data.
• Face matching happens in controlled server environments.

How long we keep data

• Waitlist details: up to 24 months after your last sign-up, unless you create an account.
• Biometric data: until you withdraw consent or delete your account.
• Account, transaction and reward records: while you have an account, then only as long as the law requires (for example, financial records).

Your rights and choices

You are always in control. You can:

• Withdraw biometric consent instantly, and delete your biometric data.
• Remove payment methods.
• Opt out of marketing, including offers from merchants.
• Ask for a copy of your data.
• Ask us to correct or delete your data, including a waitlist sign-up.
• Object to, or ask us to limit, how we use your data.
• Ask for your data in a format you can take elsewhere.
• Delete your account entirely.

To make a request, email data@get-pan.com. If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ico.org.uk).

Our website

get-pan.com does not use advertising or tracking cookies.

Age

PAN is for people aged 18 and over. We don't knowingly collect data from anyone younger.

Changes to this policy

PAN is an evolving product.

If we make important changes, we will explain them clearly in the app and at get-pan.com/privacy.