Everything we are required to tell you — written to be read. PASS is operated by Oventro Technologies Ltd, a company registered in England & Wales, and is available to users worldwide.
This policy explains what personal data we collect about you, why we collect it, how we use and share it, how long we keep it, and the rights you have. It applies to the PASS mobile apps, the PASS website at pass.kitchen, and the PASS desktop application (together, the Service).
Oventro Technologies Ltd (trading as PASS) is the data controller for personal data processed through the Service, except where we act as a processor on behalf of a hiring venue (see section 8). You can reach our privacy team at hi@getonpass.com or by post at the address at the end of this policy.
Where a hiring venue uses PASS to source, assess, contact or retain records about candidates, that venue is an independent controller of the personal data it collects, views or exports through the Service, and its own privacy notice will apply to those activities.
PASS is available worldwide. People sign up from many countries, including the United Kingdom, the European Economic Area (EEA), the United States and elsewhere. Oventro Technologies Ltd is established in the United Kingdom and is the controller of your personal data. In this policy, GDPR means the UK GDPR (the retained EU General Data Protection Regulation as it forms part of the law of England and Wales, together with the Data Protection Act 2018) and, because we offer the Service to people in the EEA, the EU GDPR (Regulation (EU) 2016/679), which applies to that processing under its Article 3(2). Your own country's data-protection law may also apply to you, and nothing in this policy takes away rights you have under the mandatory law of the country where you live.
Because we offer the Service to people in the EEA but are not established there, we are appointing a representative in the European Union under Article 27 of the EU GDPR. Until that appointment is finalised, you can raise any EU data-protection matter with our privacy team at hi@getonpass.com, marked for the attention of our EU representative, and we will publish the representative's name and contact details here once appointed. EU representative: to be appointed.
We have not appointed a statutory Data Protection Officer (DPO). Responsibility for data protection sits with our privacy team, which is accountable for how PASS handles personal data and is your first point of contact for any privacy question, request or complaint. Reach the privacy team at hi@getonpass.com. We keep the need for a DPO under review as the Service grows and will appoint one if the law requires it.
We collect the following categories of personal data, depending on how you use the Service:
Some information you choose to provide — for example, documents that reveal your nationality or ethnic origin as part of a right-to-work check — is special category data under the UK GDPR. We process it only where you have given explicit consent, or where processing is necessary for the purposes of carrying out obligations in the field of employment law, and we apply additional safeguards. You are never required to upload special category data to use the core Service.
We collect data directly from you when you create an account, build your profile, or contact us; from other users (for example, a head chef who verifies your role, or a venue that rates a trial); automatically from your device when you use the Service; and from our service providers (for example, fraud-prevention and payment partners).
Under the UK GDPR we must have a lawful basis for each use of your personal data. Our uses and bases are:
Where we rely on legitimate interests, we have carried out a balancing assessment to ensure our interests do not override your rights. You may ask us for details of that assessment.
PASS uses automated systems, including machine-learning models ("PASS AI"), to generate match scores and to rank chefs against a venue's stated needs based on verified work history, vouches, skills, availability and cook-off performance. This is profiling as defined by the UK GDPR.
These systems assist human decision-making; they do not, by themselves, produce legal or similarly significant effects on you without human involvement. A venue's decision to contact, trial or hire you is always made by a person at that venue. If a decision that significantly affects you were ever made solely by automated means, you would have the right to obtain human intervention, to express your point of view, and to contest the decision. You can ask us how a score was produced by emailing hi@getonpass.com.
PASS is a network, so some data is shared by design. You control much of what is visible:
We do not sell your personal data. We share it only with:
When a hiring venue uses PASS to build a candidate shortlist, record trial outcomes, or export data for its own hiring records, the venue determines how it uses that data and is an independent controller. We act as the venue's processor for those specific activities under a data-processing agreement. Questions about a venue's use of your data should be directed to that venue.
PASS is available worldwide, and our service providers — including our AI, payment, hosting, error-monitoring and identity partners — are based in several countries, including the United States. Your personal data may therefore be transferred to and processed in countries outside the one you live in, including outside the UK and the EEA. Where we transfer personal data out of the UK, we protect it with a safeguard recognised under the UK GDPR — a UK adequacy regulation (such as the UK Extension to the EU–US Data Privacy Framework, the "UK–US Data Bridge"), the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. Where we transfer personal data out of the EEA, we rely on an EU adequacy decision or the EU Standard Contractual Clauses. In each case the transfer is supported by a transfer risk assessment where required. You may request a copy of the relevant safeguard.
We keep personal data only as long as necessary for the purposes above:
Subject to conditions in the law, you have the right to:
To exercise any right, email hi@getonpass.com or use the in-app tools. We will respond within one month. There is normally no charge.
We would like the chance to resolve any concern first, so please contact us. If you are in the UK, you have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113. If you are in the EEA, you have the right to lodge a complaint with the data-protection supervisory authority in your country (you can find yours through the European Data Protection Board at edpb.europa.eu), and you may also contact our EU representative (see section 1). If you are in the United States, you may raise a concern with your state Attorney General. Wherever you live, you may be able to complain to your local data-protection regulator.
We use technical and organisational measures appropriate to the risk — including encryption in transit, access controls, least-privilege staff access, logging and regular review. No system is perfectly secure, but we take our responsibility for your data seriously and will notify you and the relevant regulator of a personal-data breach where the law requires.
PASS is not for anyone under 18. We do not knowingly collect data from children. If you believe a minor has an account, tell us and we will remove it.
We may update this policy from time to time. If we make a material change we will notify you in the app or by email before it takes effect. The "Effective" date above shows the current version.
We use a small set of trusted providers to run the Service, each acting on our instructions under a written contract. They include: Railway (application hosting), Cloudflare R2 (media storage), Resend (transactional email), Stripe (venue payments and billing), Sightengine (content moderation), Anthropic and OpenAI (AI matching and assistant features), Google (address and place look-ups, and "Sign in with Google"), Apple ("Sign in with Apple"), CARTO and OpenStreetMap (map tiles), Sentry (crash and error monitoring), and, where enabled, Twilio (SMS verification). Several are based in the United States, and your data may be transferred there under the safeguards described in section 9. None of them use your data for their own purposes, none are advertising networks, and we do not sell your personal data.
If you are a resident of the United States, your state may give you rights over the personal information ("PI") we hold about you. Two points apply to everyone in the US: PASS does not sell your personal information, and PASS does not "share" your personal information for cross-context behavioural (targeted) advertising, as those terms are defined under US state privacy laws. We do not serve targeted advertising and we do not use advertising or cross-site tracking cookies. We also do not discriminate or retaliate against you for exercising any privacy right.
If you are a California resident, you have the right to: know what personal information we collect and how we use and disclose it; access a copy of it; delete it; correct inaccurate information; opt out of any "sale" or "sharing" (we do neither); and limit the use of sensitive personal information. The categories we collect are described in section 2 above; we collect them for the business purposes in section 4 and disclose them only to the service providers in section 16. Right-to-work, immigration and similar documents can be sensitive personal information under the CPRA — we use these only to provide the Service you ask for and never to infer characteristics about you. To exercise a right, email hi@getonpass.com; we will verify your identity before responding, and you may use an authorised agent.
If you live in another US state with a comprehensive privacy law (for example Virginia, Colorado, Connecticut, Texas, Oregon, Montana or others as they take effect), you have comparable rights to confirm, access, correct, delete and obtain a portable copy of your personal data, and to opt out of targeted advertising, the sale of personal data, and certain profiling. Because we do not sell data, serve targeted advertising, or carry out profiling that produces legal or similarly significant effects without human involvement (see section 5), there is generally nothing to opt out of — but you can still exercise your access, correction and deletion rights at hi@getonpass.com, and you may appeal a decision by replying to our response.
Most web browsers offer a "Do Not Track" (DNT) setting. There is no common industry standard for how to respond to DNT, so we do not respond to DNT signals — but our practices already reflect that preference, because we do not track you across sites or sell your data. Where a recognised opt-out preference signal such as the Global Privacy Control (GPC) applies to you, we will treat it as a valid request to opt out of any "sale" or "sharing" of your personal information (again, we do neither).
↑ Back to top of PrivacyThese terms are a legal agreement between you and Oventro Technologies Ltd ("PASS", "we", "us"). They govern your access to and use of the Service. By creating an account or using the Service you accept these terms. If you do not agree, do not use the Service.
PASS is available to users worldwide, including in the United Kingdom, the European Economic Area (EEA) and the United States. You must be at least 18 and legally able to work in, or hire in, the places you use PASS for. One person, one account; venues may hold organisation accounts. You are responsible for the accuracy of your registration details, for keeping your credentials secure, and for all activity under your account. Tell us immediately at hi@getonpass.com if you suspect unauthorised use.
Your handle is a licence to use a unique identifier on PASS; it does not transfer ownership of any trade mark or name to you. Handles that impersonate a person or business, that you are not entitled to use, or that match a brand, venue or well-known name you are not authorised to represent, may be withheld, reclaimed, reassigned or removed by PASS at our discretion — including after a handle's public page is live. We may also reclaim or change a handle that is dormant or abusive.
PASS is a technology platform that helps hospitality workers build verified profiles and helps venues discover and contact them. PASS is not an employer, employment agency, employment business, or staffing agency, and is not a party to any employment, engagement, trial or contract agreed between a chef and a venue. We do not pay wages, set terms of work, or supervise work. Any working relationship, including status, pay, hours and rights, is a matter solely between the chef and the venue, who are each responsible for complying with applicable employment, tax, immigration and health-and-safety law.
Verification records that a named person or venue has confirmed a specific claim at a point in time. We take reasonable steps to operate the verification process in good faith, but we do not guarantee the accuracy, completeness or ongoing truth of any user-supplied information or third-party confirmation, and verification is not a reference, a background check, a right-to-work check, or a recommendation. Venues remain responsible for their own due diligence, including any legally required checks.
You keep ownership of the Content you submit. You grant PASS a worldwide, non-exclusive, royalty-free, sub-licensable licence to host, store, reproduce, adapt (for formatting), publish and display your Content solely to operate, promote and improve the Service, for as long as you keep it on the Service. You represent that you own or have the rights to your Content and that it does not infringe anyone's rights or break the law. This licence ends when you delete the Content or your account, except for copies retained as required by law or in routine backups for a limited period.
Your use of the Service is subject to our Community Guidelines, which form part of these terms. In short, you must not misuse the Service, break the law, infringe rights, impersonate others, falsify history, circumvent fees or security, scrape or bulk-extract data, or interfere with the Service's operation.
PASS is free for hospitality workers. Venues pay for plans as described in our Subscriptions & Refunds policy, which forms part of these terms.
The Service, including its software, design, text, graphics and the PASS name and logo, is owned by us or our licensors and protected by intellectual-property law. We grant you a limited, revocable, non-transferable licence to use the Service for its intended purpose. You may not copy, modify, reverse-engineer, resell or create derivative works from the Service except as the law expressly permits.
The Service may link to or rely on third-party services (for example, app stores and payment providers). We are not responsible for third-party services, and your use of them is governed by their terms.
You may stop using the Service and close your account at any time. We may suspend or terminate your access, with or without notice, if you breach these terms, if we are required to by law, or if we reasonably believe your conduct risks harm to other users or to PASS. Where fair to do so, we will give you notice and an opportunity to respond. Sections that by their nature should survive termination (including 6, 9, 12–17) will survive.
The Service is provided "as is" and "as available". To the fullest extent permitted by law, we exclude all implied warranties. We do not warrant that the Service will be uninterrupted, error-free, or that it will result in any hire, engagement or outcome. Nothing in these terms excludes rights you have as a consumer that cannot be excluded by law.
Nothing in these terms limits liability that cannot be limited by law, including for death or personal injury caused by negligence, or for fraud. Subject to that: we are not liable for loss of profit, revenue, goodwill, data, or for indirect or consequential loss; and our total liability arising out of or in connection with the Service in any 12-month period is limited to the greater of (a) the fees you paid us in that period, or (b) £100. We are not responsible for the acts or omissions of any chef or venue.
If you use PASS in the course of a business (for example, as a venue), you agree to indemnify us against claims, losses and reasonable costs arising from your breach of these terms, your Content, or your dealings with other users. This does not apply to consumers acting outside a business.
We may change the Service and these terms. If a change materially reduces your rights, we will give you reasonable notice (in the app or by email) before it takes effect, and where required we will ask for your agreement. Continuing to use the Service after a change means you accept the updated terms.
These terms and any dispute arising from them are governed by the laws of England and Wales, and the courts of England and Wales have jurisdiction. Nothing in this section removes any protection you have under the mandatory consumer or data-protection law of the country where you live. If you are a consumer resident elsewhere in the UK, in the EEA, or in another country, you keep the protection of the mandatory consumer laws of your country of residence and (where those laws allow) you may bring proceedings in your local courts; if you are a US resident, the mandatory law of your home state also applies. We would rather resolve disputes informally — please contact us first.
If any provision is found unenforceable, the rest remain in force. Our failure to enforce a term is not a waiver of it. You may not transfer your rights under these terms without our consent; we may transfer ours as part of a reorganisation or sale, without reducing your rights. These terms, together with the policies they reference, are the entire agreement between us about the Service.
↑ Back to top of TermsPASS carries content created by its members — cook-offs, clips, comments, messages and profiles. These guidelines set the rules for that content and conduct. They form part of the Terms of Service, and we enforce them.
PASS works because it is real. Every profile is a person, every verified role happened, and every interaction is professional. Anything that undermines that trust — or that puts a person at risk — is not welcome here.
Every clip, comment, profile and message can be reported in-app. Our Trust & Safety team reviews reports, and we use a combination of trained reviewers and automated tools to detect content that breaks these rules. You can also block any user to stop them contacting or seeing you. We may remove content, limit its reach, or restrict features while we investigate. In an emergency, contact your local emergency services first, then report to us at hi@getonpass.com.
Depending on the severity and history, we may: remove content; issue a warning; limit or suspend features; suspend an account; or permanently ban an account and any linked accounts. Serious matters — particularly those involving risk to a person or the safety of minors — may be escalated to law enforcement or relevant authorities, consistent with our legal obligations, including under the UK Online Safety Act.
If we take action against your account or content, we will tell you what rule was involved. You may appeal by emailing hi@getonpass.com within 30 days, and a different member of our team will review it.
↑ Back to top of CommunityChefs and hospitality staff use PASS free, forever. Hiring venues pay for a plan. This policy sets out the plans, how billing works, and your cancellation and refund rights. It forms part of the Terms of Service.
A contact is consumed when a chef accepts your request to connect; browsing and viewing profiles never consumes a contact. Annual Café plans still meter at two contacts per calendar month — they are never pooled into an annual allowance.
Prices are stated exclusive of VAT and other applicable taxes, which are added at checkout where required. We may change prices, and will give you at least 30 days' notice before a change affects a renewal.
Paid plans are billed in advance and renew automatically at the end of each billing period (monthly or annual) at the then-current price, using your saved payment method, until cancelled. Annual plans include the equivalent of two months free and are billed as a single up-front payment.
You can cancel at any time in Settings → Billing. Cancellation stops the next renewal; your plan and its features remain active until the end of the period you have already paid for, and are not pro-rated on cancellation, except where the law requires or where cancellation falls within the cooling-off period below.
If you are a consumer in the UK or the EEA, you normally have a 14-day right to cancel a new subscription for a full refund under the Consumer Contracts Regulations (or the equivalent consumer law where you live). Because a subscription is digital content and access begins immediately, you expressly ask us to start providing it at once and acknowledge that you lose the 14-day cancellation right once you have consumed a paid contact within that period. If you cancel within 14 days without having consumed a contact, we refund you in full. Most PASS customers are businesses, to whom this statutory right does not apply.
Outside the cooling-off right above, fees are non-refundable, including annual plans and unused contacts, except: (a) where required by law; (b) where we withdraw a paid feature you were relying on and cannot offer a reasonable equivalent; or (c) at our discretion for service failures. Consumed contacts are never refundable. Approved refunds are made to your original payment method.
Upgrades take effect immediately and are pro-rated for the remainder of your billing period. Downgrades take effect at your next renewal; you keep your current plan's features until then.
If a payment fails, we may retry it and will contact you. If it remains unpaid, we may suspend paid features until the balance is settled.
If you purchase a subscription through the Apple App Store or Google Play, that store processes the payment and manages billing under its own terms. Cancellations, renewals and refunds for those purchases are handled through your app-store account, subject to the store's refund policy, which may differ from this one.
If you dispute a charge with your bank rather than contacting us, we may suspend your account while the dispute is resolved. Please contact hi@getonpass.com first — we can usually sort things out faster.
↑ Back to top of SubscriptionsYou own your data and can remove it at any time. This policy explains how to delete your account and data, what happens when you do, and the limited records we may keep because the law requires it.
Open Settings → Account → Delete account and confirm. This begins permanent deletion of your profile, handle, photo, clips, votes, comments, messages, your AI embeddings (used for matching), and the verification records associated with your account. Verified employment facts are kept only in anonymised form (with no personal identifiers) so the trust firewall that other chefs' records rely on stays intact.
Prefer not to use the app, or no longer have it installed? Email hi@getonpass.com from your registered address, or use the request form on the website, and we will delete your account and personal data. We may ask you to verify your identity to protect your account.
Deletion completes within 30 days of your confirmed request. Data may persist in encrypted backups for a short additional period before those backups cycle out, after which it is permanently removed.
We retain only what the law requires or permits, and no more:
Deleting your account removes your profile and content from PASS. Where a venue independently exported or recorded information about you before deletion (as a separate controller), that record sits with the venue; you can ask the venue to erase it, and we will assist where we are able.
You can request a copy of your personal data in a portable format before you delete your account — useful if you want to keep a record of your verified history. Request it from Settings → Privacy → Export my data or by emailing hi@getonpass.com.
Once deletion is complete it cannot be undone. If you return to PASS later you will need to create a new account, and your previous handle and verified history may not be available.
↑ Back to top of Data & deletion
PASS