Privacy Policy

Last updated: 2026-04-23

This Privacy Policy explains how personal information is collected, used, disclosed, stored, and protected when you interact with Cinturon360 and related services operated by RePass Cloud Pty Ltd ("we", "us", or "our").

If you do not agree with this Privacy Policy, do not use the Services.

1. Who We Are

RePass Cloud Pty Ltd
PO BOX 262
Bondi Junction NSW 1355
Australia

Email: hello@repasscloud.com

2. Roles: Controller and Processor

Depending on the context, RePass Cloud may act as either:

• Data controller — when operating our websites, managing accounts, handling billing, or running marketing and business administration activities.
• Data processor / service provider — when processing personal information on behalf of a business customer using Cinturon360.

3. Information We Collect

We may collect information directly from you, from your organisation, from your device or browser, or from service providers that help us operate the Services.

Identity and account data

• Name, email address, organisation name
• User roles and permissions
• Authentication identifiers issued by identity providers

Customer content and business data

Customers may submit traveller profiles, booking or operational data, approval and workflow data, and communications entered into the platform.

Operational, audit, and security logs

IP addresses, authentication logs, application and API access logs, audit logs, error logs, and performance telemetry.

Device and technical data

Browser type, device type, operating system, approximate location from IP, session metadata.

Billing and payment data

Billing contact details and transaction metadata. Payment processing is handled by third-party providers. We do not store full payment card numbers.

4. How We Use Information

• Provide and operate Cinturon360 and related services
• Authenticate users and manage access
• Deliver customer support and respond to enquiries
• Maintain security, detect abuse, prevent fraud
• Manage billing, accounting, and business administration
• Comply with legal obligations
• Improve products and services
• Analyse website usage through analytics tools (with your consent where required)

5. Legal Bases for Processing

• Contract — to provide the Services requested
• Legitimate interests — securing and improving the Services, preventing fraud
• Consent — where required for analytics cookies or optional activities
• Legal obligation — where processing is required by law

6. Cookies and Analytics

We use cookies and similar technologies on this website. The table below describes what we use and why.

We use Google Consent Mode v2. Analytics cookies are blocked by default and only activated if you accept. If you reject, Google Analytics operates in a cookieless, anonymised mode and no cookies are set. We do not use advertising, retargeting, or social media cookies.

You can change your cookie preferences at any time using the Manage Cookies link in the footer, or by clearing your browser's localStorage for this site.

7. Disclosure of Information

We may disclose information to cloud hosting providers, identity providers, payment processors, security vendors, analytics vendors (Google LLC), professional advisers, regulators, and business transferees. RePass Cloud does not sell personal information.

8. Hosting and International Transfers

Australia and New Zealand customers are hosted in Microsoft Azure Australia regions by default. Where information is transferred across borders, we use appropriate safeguards including contractual protections, encryption, and access controls.

Google Analytics data is processed by Google LLC and may be stored in the United States. By accepting analytics cookies, you acknowledge this transfer. See Google's Privacy Policy for details.

9. Security

Security measures include encryption in transit and at rest, role-based access control, multi-factor authentication, audit logging, and incident response procedures.

10. Data Retention

• Security and telemetry logs: generally 90 to 100 days
• Customer content: per customer instructions and contract terms
• Backups: limited periods as part of backup lifecycle management
• Analytics data: up to 14 months (Google Analytics default retention)

11. Your Rights — All Users

You may have the right to access, rectify, erase, restrict processing of, object to processing of, or port your personal information. To exercise any right, contact hello@repasscloud.com. We will respond within 30 days.

12. EU and UK Residents — GDPR / UK GDPR

If you are located in the European Economic Area (EEA) or the United Kingdom, the General Data Protection Regulation (GDPR) or UK GDPR applies to how we handle your personal data.

• Right to access — request a copy of personal data we hold about you
• Right to rectification — request correction of inaccurate data
• Right to erasure — request deletion of your personal data, subject to legal obligations
• Right to restrict processing — request that we limit how we use your data
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interests
• Right to withdraw consent — withdraw cookie or marketing consent at any time without penalty

Analytics cookies require your explicit consent before they fire. You can withdraw consent at any time via the Manage Cookies link in the footer.

If you believe we have not handled your data correctly, you have the right to lodge a complaint with your local supervisory authority (e.g., the ICO in the UK, or your national data protection authority in the EU).

13. Australian Residents — Privacy Act 1988

RePass Cloud Pty Ltd is an Australian company subject to the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

• You may request access to personal information we hold about you (APP 12)
• You may request correction of personal information that is inaccurate, out of date, incomplete, irrelevant, or misleading (APP 13)
• If you are dissatisfied with our handling of a privacy complaint, you may complain to the Office of the Australian Information Commissioner (OAIC)

To make a request or complaint, contact hello@repasscloud.com.

14. California Residents — CCPA / CPRA

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) grant you the following rights:

• Right to know — the categories and specific pieces of personal information collected about you
• Right to delete — request deletion of personal information we have collected, subject to exceptions
• Right to correct — request correction of inaccurate personal information
• Right to opt out of sale or sharing — we do not sell personal information; however, use of Google Analytics may constitute "sharing" under CCPA. You may opt out at any time
• Right to limit use of sensitive personal information
• Right to non-discrimination — we will not discriminate against you for exercising your rights

To exercise your right to opt out of the sale or sharing of personal information, click Your Privacy Choices or use the Manage Cookies link in the footer of any page.

To submit a CCPA request by email: hello@repasscloud.com. We will verify your identity and respond within 45 days, with a possible 45-day extension where reasonably necessary.

Categories of personal information collected (past 12 months):

• Identifiers (name, email address, IP address)
• Internet or electronic network activity (page views, session data via Google Analytics — only if consented)
• Commercial information (if you engage with our services)

We do not sell personal information. We do not knowingly collect personal information from consumers under 16 years of age.

15. Children's Privacy

Cinturon360 is not intended for children under 18. We do not knowingly collect personal information from children.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top indicates when it was last revised. Continued use of the Services after changes constitutes acceptance.

17. Contact Us

RePass Cloud Pty Ltd
PO BOX 262, Bondi Junction NSW 1355, Australia
hello@repasscloud.com