The Service is operated by Cuaresma Veloso Richard, a self-employed sole trader (autónomo) established in Spain, registered address Calle Montenegro 3, 2º Dcha 3, 07012 Palma, Spain, NIF/VAT ES45695668G, contactable at support@eventpassreader.com.

In these Terms:

• "Service" means the Event Pass Reader check-in application (web app and any native apps), including guest-list import, pass scanning, live check-in dashboards and attendance export.
• "Organiser", "you" means the account holder — either a business or a consumer.
• "Consumer" means an Organiser who is a natural person acting for purposes outside their trade, business, craft or profession, as defined by Spanish and EU consumer law.
• "Guest" means a person on an Organiser's guest list.
• "Guest Data" means personal data of Guests that an Organiser uploads to or generates in the Service (for example guest name, email address, ticket type, pass code and check-in records).
• "Privacy Policy" means our privacy policy available in the app and at /privacy.
• "Credit" means a one-time entitlement (a Single Event pass, in its standard or large size; formerly sold as "Event Pass" and "Event Pass Plus") that you buy and that must then be applied to a single event to raise that event's imported-guest limit; a Credit is consumed by the event it is applied to and is not recurring.
• "Sub-processors" means the third-party providers listed in Section 7 (currently Supabase, Vercel, Resend and Stripe).

Event Pass Reader is a tool for event organisers to check guests in at the door. It lets you:

• import a guest list from a CSV or Excel export (for example from Eventbrite, Ticket Tailor or Shopify), or generate a unique QR pass for each guest;
• scan passes with a phone or device camera and get an instant "on the list" / duplicate / not-found verdict;
• keep scanning offline — the scanning device holds a local copy of the guest list so check-in works without a connection, and multiple doors sync automatically when back online;
• see a live dashboard of who is in and export attendance as CSV.

We describe what the Service does honestly, but we do not promise it will meet every need or produce any particular business outcome. The Service is a check-in tool only: we do not sell tickets, take payment from your guests, or email your guests. Features may be added, changed or removed as the Service evolves (see Section 9).

To register you must be at least 18 years old and able to enter into a binding contract. If you register for a business, you confirm you are authorised to act for it.

You must provide accurate, current and complete information when you register (an email address and password), and keep it up to date. You are responsible for keeping your login credentials confidential and for all activity under your account. We store your password only as a salted hash and never in plain text. Tell us promptly at support@eventpassreader.com if you believe your account has been accessed without your authorisation.

You are responsible for the staff you invite to help run a door, and for their use of the Service under your account.

Free plan. You can use the Service for free for one event per calendar month — the first event you create that month without a Credit — with a limit of up to 75 imported guests, with the door run by you as the event owner (door-staff invites are available on paid plans). Further events you create in the same month require a Credit or a subscription before you can import a guest list (check-ins at the door are never blocked; see below). Free is offered indefinitely but we may change or withdraw it on reasonable notice.

Paid plans. You can raise the imported-guest and staff limits by buying:

• Single Event pass, standard — a one-time Credit for a single event, up to 500 imported guests, up to five door-staff invites (currently €20);
• Single Event pass, large — a one-time Credit for a single event, up to 750 imported guests, unlimited door staff (currently €29);
• Pro — a subscription covering all your events, up to 1,000 imported guests per event, up to ten door-staff invites (currently €39 per month, or €390 per year);
• Business — a subscription covering all your events, up to 2,500 imported guests per event, unlimited door staff (currently €79 per month, or €790 per year).

A Single Event pass is a Credit as defined in Section 1: you buy it, then apply it to one event, and it is consumed by that event. It is not a recurring charge.

If we change the limits attached to a plan, a subscription you already hold keeps the limits it was sold with for as long as it runs — we never silently reduce what you bought.

Caps apply only to imported guests — the door is never blocked. Plan limits cap how many guests you can import into an event. They never limit check-ins at the door: walk-ups, additions and scans are never blocked by a plan limit, so an event can never be stopped mid-door because of billing. If an import would exceed your event's cap, we tell you before the import and offer a plan that fits; the import itself is what waits, not your event.

Prices and VAT. All prices shown are in euros. The price you see at checkout is the total you pay and includes any VAT that applies to your purchase; there are no per-ticket or per-scan fees. VAT is applied through Stripe based on the information you provide at checkout, so the VAT treatment (including any reverse charge for eligible EU business buyers) may depend on your location and status; the total shown to you before you pay is always the amount charged. We may change prices from time to time; a change does not affect a Credit already purchased or the current paid period of a subscription already running.

Payments and Stripe. Payments are processed by Stripe (Stripe Payments Europe, Ltd.) as our payment processor. When you pay, you also agree to Stripe's terms. We do not receive or store your full card details. You authorise us (via Stripe) to charge the applicable fees.

Subscription renewal, price changes and how to cancel. A Pro or Business subscription renews automatically at the end of each billing period (monthly, or yearly if chosen) at the then-current price, until you cancel. If we change a recurring subscription price, we will notify you by email a reasonable time before the renewal to which the new price first applies, and you may cancel before that renewal so the new price never takes effect for you. You can cancel at any time through the Stripe customer portal, which you open from your dashboard; cancellation takes effect at the end of the current paid period, and you keep your plan's access until then. Cancelling stops future renewals; it does not, by itself, entitle you to a refund of the current period except where a refund is required by law (see Section 5).

This section applies to Organisers who are Consumers. Businesses do not have a statutory right of withdrawal.

Your 14-day right of withdrawal. Under EU and Spanish consumer law (TRLGDCU Arts. 102–104; Directive 2011/83/EU), a Consumer normally has 14 days to withdraw from a distance contract for digital content or services without giving a reason, counting from the day the contract is concluded. To withdraw, tell us clearly before the deadline at support@eventpassreader.com. You may use the model withdrawal form set out in Section 15, but you do not have to — a clear statement is enough.

The operative rule (please read this). Whether you can still withdraw after buying depends on whether you have started using the paid feature:

• If you have paid but have NOT yet started using the paid feature (you have not applied a Single Event Credit to an event, and, for Pro or Business, have not begun using the subscription's entitlements), you may withdraw within the 14 days and receive a full refund.
• If you have started using the paid feature within the 14 days AND you gave the prior express consent and acknowledgement described below at checkout, you lose the right of withdrawal for that item, because performance has begun (and, for a fully performed service, has completed) at your request.

How the loss of the right is triggered. The loss of the withdrawal right only applies if, at checkout and before payment, you (a) expressly requested that we begin providing the service / supplying the digital content immediately, before the 14-day period ends, and (b) acknowledged that you will lose your right of withdrawal once the service has been fully performed or once supply of the digital content has begun. We capture that request and acknowledgement as a separate, unbundled step in the checkout flow and confirm it to you by email (a durable medium). If that consent and acknowledgement were not captured for your purchase, the loss-of-right rule does not apply and you keep the full 14-day right of withdrawal even after you begin using the feature.

Partial performance. If you validly withdraw from a service that was only partly performed at the time of your withdrawal, you may owe an amount proportionate to what was supplied up to that point; you do not owe anything for a service you had not yet started to use.

Refunds. Where a valid withdrawal or other refund right applies, we refund the amounts due without undue delay and within 14 days, using the same payment method you used, via Stripe. Nothing in these Terms limits your mandatory refund and remedy rights under Spanish and EU consumer law, including remedies where the Service is not as described or does not conform to the contract. If you think you are entitled to a refund, contact us at support@eventpassreader.com.

You are the controller of Guest Data. As between you and us, you decide what Guest Data is collected and why, and you control it. You must:

• have a lawful basis under the GDPR for uploading and processing Guest Data, and give your Guests any privacy notice and information they are legally entitled to;
• only upload data you are entitled to upload, and not infringe anyone's privacy, intellectual-property or other rights;
• not upload unlawful content, or data obtained unlawfully;
• comply with all laws that apply to your event and your handling of Guest Data.

Acceptable use. You must not misuse the Service. In particular you must not: attempt to gain unauthorised access to the Service, other accounts or its systems; disrupt or overload the Service; probe, scan or test its security without our written permission; reverse-engineer or copy it except as the law allows; upload malware; scrape or bulk-extract data other than through the features provided; resell or provide the Service to third parties except by running your own events; or use it to send spam or to harass anyone.

You are responsible for the accuracy and legality of everything you upload and do through your account. We do not monitor Guest Data and are not responsible for its content.

How we handle personal data is described in our Privacy Policy, which forms part of these Terms. Where these Terms and the Privacy Policy differ on how personal data is handled, this Section 7 governs your data-protection relationship with us as processor.

Roles. For account data (your email address and hashed password) we act as controller. For Guest Data, you are the controller and we act as your processor: we store and process Guest Data on your behalf and only on your documented instructions.

Our commitments as your processor (Article 28 GDPR). Because we process Guest Data on your behalf, we commit — for as long as we do so — to the following, which together form the data-processing terms between us:

• Instructions: we process Guest Data only on your documented instructions (including these Terms and your use of the Service's features), unless EU or Spanish law requires otherwise, in which case we will tell you unless the law forbids it;
• Confidentiality: we ensure that people authorised to process Guest Data are bound by an appropriate duty of confidentiality;
• Security: we take appropriate technical and organisational measures to protect Guest Data (for example EU hosting, encrypted transport, hashed account passwords, and access controls);
• Sub-processors: you authorise us to use the Sub-processors listed below to provide the Service; we impose data-protection obligations on them comparable to those in this Section, and we will inform you of any intended change to our Sub-processors (through the Privacy Policy and/or by email) so you can object;
• Assistance: taking into account the nature of the processing, we assist you with responding to Guest requests to exercise their rights, and with your security, breach-notification, and data-protection-impact-assessment obligations, so far as we are able;
• Breach: we notify you without undue delay after becoming aware of a personal-data breach affecting Guest Data;
• Deletion or return: on termination, and subject to the export window in Section 11, we delete or return Guest Data at your choice, unless EU or Spanish law requires us to keep it; and
• Audit information: we make available the information reasonably necessary to demonstrate compliance with this Section.

If we and you later sign a separate, more detailed data processing agreement, that agreement will govern Guest Data to the extent it conflicts with this Section; until then, this Section is the operative processor agreement and no separate document is incorporated by reference.

Where it lives and Sub-processors. Guest Data is stored in a Supabase (PostgreSQL) database hosted in the EU (Ireland, eu-west-1). The Service is served by Vercel; account emails (confirmations, password resets) are sent through Resend; payments are handled by Stripe. Some of these providers, or their group companies, infrastructure or support functions, are based in or accessed from the United States, so some processing or support may involve international transfers of personal data outside the EEA. Where that happens, we rely on appropriate safeguards, principally the European Commission's Standard Contractual Clauses (SCCs), together with the transfer terms of the provider concerned. We do not sell personal data, do not use tracking or advertising cookies, and never email your Guests.

The current list of Sub-processors is Supabase, Vercel, Resend and Stripe. This list must be kept identical in the Privacy Policy. If we change Sub-processors, we will update the Privacy Policy accordingly and give you the opportunity to object as described above.

The Service, including its software, design, text, logos and brand, is owned by us or our licensors and is protected by intellectual-property laws. We grant you a limited, non-exclusive, non-transferable, revocable right to use the Service for running your events during the term of these Terms. You may not copy, modify, distribute, sell or create derivative works of the Service except as these Terms or the law allow.

You keep all rights in your data. You own and retain all rights to the guest lists, Guest Data and other content you upload or generate through the Service. You grant us only the limited licence needed to host, process and display that data so we can provide the Service to you and to comply with law. We claim no ownership of your data. If you give us feedback or suggestions, you allow us to use them to improve the Service without obligation to you.

We work to keep the Service available and reliable, and the offline-first design is intended to keep check-in working even without a connection — but this is best-effort. The Service is provided "as is" and "as available".

We do not warrant that the Service will be uninterrupted, error-free or always available, and we give no uptime or service-level guarantee. We may perform maintenance, updates and changes, and may occasionally have downtime. Offline scanning depends on your device having synced the guest list beforehand and on your own hardware, camera and connectivity, which are outside our control. We do not offer or guarantee any backup or data-restoration service beyond keeping data available as described in these Terms and the Privacy Policy; you remain responsible for keeping your own copies of anything you need (for example by exporting attendance as CSV).

To the extent permitted by law, we exclude implied warranties. This Section does not exclude or limit any warranty or guarantee that cannot be excluded under Spanish or EU law, including a Consumer's mandatory rights that the Service conform to the contract.

Nothing in these Terms limits or excludes liability that cannot be limited or excluded under Spanish or EU law. In particular, we do not exclude or limit liability for: death or personal injury caused by our negligence; fraud or fraudulent misrepresentation; wilful misconduct or gross negligence; or any liability under a Consumer's mandatory statutory rights.

For Consumers. If you are a Consumer, we are liable to you for foreseeable loss and damage caused by our breach of these Terms or our failure to use reasonable care and skill, in accordance with Spanish and EU consumer law. We do NOT apply the monetary cap or the indirect/consequential-loss and data-loss exclusions set out below to Consumers for our own breach or non-performance or for damage we cause; your statutory damages and remedy rights are unaffected. The limitations below that could otherwise apply to a Consumer apply only to the extent Spanish and EU consumer law permits, and any term that would inappropriately restrict your legal rights on our non-performance does not apply to you.

For business Organisers. If you are not a Consumer, then to the extent permitted by law:

• we are not liable for indirect, incidental, special or consequential loss, or for loss of profit, revenue, goodwill, business, or data, or for losses that were not reasonably foreseeable; and
• our total aggregate liability arising out of or in connection with these Terms and the Service is limited to the greater of (a) the total fees you paid to us for the Service in the 12 months before the event giving rise to the claim, or (b) €100.

For all Organisers. We are not responsible for the accuracy or legality of the data you upload, for your compliance with data-protection law as controller, or for acts of your Guests or staff. Because check-in at the door is never blocked by billing, and offline copies depend on your own devices and connectivity, you remain responsible for verifying entry at your event.

By you. You may stop using the Service and close your account at any time. You can cancel a Pro or Business subscription as described in Section 4. A Single Event Credit is consumed by the event it was applied to and is not returned on account closure, subject to your withdrawal and refund rights in Section 5.

By us. We may suspend or terminate your access if you materially breach these Terms (including the acceptable-use and lawful-basis obligations), if required by law, or if your use poses a security or legal risk. Where practicable and lawful, we will give you notice and a chance to fix the problem first. We may also discontinue the Service on reasonable prior notice.

Effect on your data and export window. You can export your attendance data (CSV) and delete guest data yourself from the dashboard at any time, including before you leave. On termination, we will keep your server-stored data available for a reasonable export window of at least 30 days (except where earlier deletion is required by law or where termination is for serious abuse), after which we may permanently delete it. This 30-day export window applies to data stored on our servers; the local copy held on a scanning device is separate and is erased when the organiser signs out of that device. Deletions are permanent and include the related check-in records. This Section is consistent with, and to be reflected in, the retention and deletion terms of the Privacy Policy and the processor commitments in Section 7.

We may update these Terms from time to time, for example to reflect changes to the Service, our Sub-processors, or the law. If we make a material change, we will give you reasonable advance notice by email or in the app before it takes effect.

If you do not agree to a change, you may stop using the Service and close your account before the change takes effect; for a paid plan, the change will not apply to a Credit already purchased or to the current paid period of a running subscription. Continuing to use the Service after a change takes effect means you accept the updated Terms. We will always show the effective date of the current version. This Section does not reduce the separate advance notice you receive before any subscription price increase under Section 4, or your consumer rights under Section 5.

These Terms and any dispute arising from them or the Service are governed by the laws of Spain, without prejudice to any mandatory consumer-protection rules that would otherwise apply.

For businesses, the courts of Spain have exclusive jurisdiction.

For Consumers, this choice of law does not deprive you of the protection of mandatory provisions of the law of your country of residence, and you may bring proceedings in the courts of your place of residence. You also have these options to resolve a dispute out of court:

• the Spanish consumer arbitration boards (Juntas Arbitrales de Consumo), where applicable; and
• if you are in Spain, the general consumer-complaint and mediation channels available under Spanish consumer law.

(Note: the European Commission's Online Dispute Resolution platform previously available at ec.europa.eu/consumers/odr was shut down in 2025, so we do not refer you to it.)

We are not obliged to, and do not commit in advance to, use a particular arbitration body, but we will try in good faith to resolve any complaint you raise with us first at support@eventpassreader.com.

For any question about these Terms, your account, billing, a refund, or data protection, contact us at:

• Cuaresma Veloso Richard (autónomo)
• Registered address: Calle Montenegro 3, 2º Dcha 3, 07012 Palma, Spain
• NIF/VAT: ES45695668G
• Email: support@eventpassreader.com

Guests who attended an event should contact the event's Organiser about their data in the first instance, as the Organiser controls the guest list and has the tools to act on it, as explained in the Privacy Policy.

If you are a Consumer and you wish to withdraw from a contract with us within the 14-day period (see Section 5), you may — but are not required to — complete and send us this form. Any other clear statement of your decision to withdraw is equally valid.

— — — — — — — — — — — — — — — — — — — — — —

To: Cuaresma Veloso Richard, Calle Montenegro 3, 2º Dcha 3, 07012 Palma, Spain, email support@eventpassreader.com

I/We (*) hereby give notice that I/We (*) withdraw from my/our (*) contract for the supply of the following service / digital content (*):

• Description of the purchase (e.g. Single Event pass, or a Pro or Business subscription): ____________________
• Ordered on (*) / received on (*): ____________________
• Name of consumer(s): ____________________
• Address of consumer(s): ____________________
• Email or account used: ____________________
• Signature of consumer(s) (only if this form is sent on paper): ____________________
• Date: ____________________

(*) Delete as appropriate.

— — — — — — — — — — — — — — — — — — — — — —

This is the statutory model withdrawal form required for distance contracts under Spanish and EU consumer law (TRLGDCU Annex B; Directive 2011/83/EU, Annex I(B)). It cannot be finalised for publication until the Provider's legal name and registered address are completed above.