Last updated: 20 August 2026
Controller: C-PASS is a trading name and project operated by Liudmila Levochkina. The data controller for the C-PASS marketing pages and demonstration sites is Liudmila Levochkina, Erlenstraße 16, 96178 Pommersfelden, Germany. E-Mail: hello@getcpass.com
What we collect: When you send a contact form, sign up for guide updates, or interact with forms on guides and comparison pages, we collect your email address, optional name, message content and the page source of the request. When you buy a package, we additionally receive from our payment provider Stripe the data needed to fulfil your order: your name, e-mail address, billing country and the order details. Your full payment details, such as card numbers, are processed by Stripe and never reach us.
Why we collect it:
- Requests and updates (legitimate interest): we use your email to answer your message, confirm your signup and send you the updates you asked for.
- Marketing updates (consent): If you opt in, we will send you news and offers about C‑Pass. You can unsubscribe at any time.
- Contract fulfilment (Article 6(1)(b) GDPR): if you buy a package, we process your order data to provide the service, communicate about your order and issue invoices.
How we use and store data: We store form submissions on our website host and use a third‑party email service to send confirmations and updates. These providers are contractually bound to protect your data and comply with EU data‑protection law. We do not process or store personal data in Russia, and we do not sell or share your data with third parties for their own marketing. We may use service providers (e.g. email services) who process data on our behalf.
Payments: Purchases are processed by Stripe (for customers in Europe: Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland). Checkout takes place on Stripe's own pages. Stripe processes your name, e-mail address, billing address and payment details to complete the payment and for its own fraud prevention; Stripe may transfer data to the United States under EU-approved safeguards. Legal basis: performance of a contract (Article 6(1)(b) GDPR). Details are in Stripe's privacy policy:
https://stripe.com/privacy
Analytics: The C-PASS marketing pages at getcpass.com and C-PASS demonstration sites served under getcpass.com/sites/ use separate Google Analytics 4 properties, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Analytics is enabled only on a demonstration site that displays this consent notice; other coach sites remain outside this C-PASS analytics setup. Google Analytics is disabled by default. The Google tag is loaded only after you select “Allow analytics”; if you reject analytics, no Google Analytics tag, request or cookie is initiated by our site.
After consent, Google Analytics processes a pseudonymous client identifier stored in first-party cookies (_ga and _ga_<container-id>), the visited page and referrer, standard interaction events, browser and device information, and approximate location derived from the IP address. We do not intentionally send form contents, names, email addresses or other directly identifying data to Google Analytics. For users in the EEA, Switzerland and the United Kingdom, Google states that IP addresses are used to derive approximate location and are discarded before the data is logged.
We use this information to understand visits, traffic sources and how the C-PASS marketing and demonstration pages are used, so that we can improve them. The legal basis is your consent under Article 6(1)(a) GDPR. You can reject or withdraw consent at any time through “Privacy settings”. Withdrawal prevents further analytics loading and removes accessible _ga cookies from our domain.
Google Signals, user-provided data collection and advertising personalisation are disabled for these analytics properties. Detailed event and user data is retained in Google Analytics for 14 months. Google documents a default lifetime of up to two years for GA4 first-party cookies, subject to browser limits; our site also removes accessible analytics cookies when consent is withdrawn or no longer valid.
Google processes data on infrastructure that may be located outside the EEA. Google states that it relies, as applicable, on the EU-U.S. Data Privacy Framework and Standard Contractual Clauses for international transfers. More information:
https://policies.google.com/privacy
https://business.safety.google/adsdatatransfers/
Cookies: On the C-PASS marketing pages and demonstration sites described above, analytics cookies are set only after consent. Rejecting analytics does not set an analytics cookie, and the consent choice itself is stored in the browser's local storage for 180 days rather than in a cookie. Advertising cookies are not used by this implementation. Stripe's checkout pages use Stripe's own cookies under Stripe's policies.
Retention: We keep contact and update emails until you unsubscribe or ask us to delete them. Order and invoice data are kept for as long as German commercial and tax law requires (up to ten years) and then deleted.
Your rights: Under the EU/UK GDPR you can request access to, correction or deletion of your data and withdraw your consent at any time. Contact us at the email above to exercise these rights.
Changes: We will update this notice if our data processing practices change and will post the new “Last updated” date.
