Privacy notice

Last updated 10 August 2026.

This page is new, and the Board welcomes corrections: if anything here looks wrong or unclear, please tell us through the contact page and we will put it right.

The short version

• We hold what an association needs to run: who you are, which member organization you work for, what has been paid, and the survey answers your organization has given.
• There is no tracking on this website. If you are reading the public pages we put nothing on your device and we do not count your visit.
• Your card number never reaches us. Stripe handles payment on its own pages.
• Wherever in the world you are, you can ask to see what we hold about you, ask us to correct it, and ask us to delete it.

Who is responsible

The Pass Bureau Association is a membership association incorporated in Arizona and run by a volunteer Board of Directors. The Board decides what the Association holds and why. This website is built and looked after for the Association by Velozation Airline Technology Services.

What we hold

Your sign-in account

If you have a login, we hold your name, your email address, the member organization your account belongs to, and your role (member, Survey Committee, Board or administrator). Your password is stored scrambled, so nobody can read it back, including us. If you switch on two-step sign-in we also hold the code secret for it in encrypted form and a set of scrambled recovery codes. We count failed sign-in attempts so that an account locks itself for a few minutes after too many.

Logins are granted rather than self-service. Nobody can create an account on this site: the Board adds them, or your organization’s primary contact invites a colleague. An account has to have its email address confirmed and be approved before it can see anything members-only.

We are not recording when or from where you sign in. There are fields on the account for it, and the part of the site that filled them was switched off in July 2026 and has not been turned back on, so some accounts still carry a value from before then. If we ever start recording it again, this page will say so.

If an email to you bounces, or is reported as spam, our mail provider tells us and we mark the address so we stop sending to it until it is sorted out.

Your organization’s entry in the member directory

Anyone on the internet can see, for a current member organization:

• its name, its logo and tail-fin logo, its website, its short description, its member type and its IATA code.

Only a signed-in, approved member can see:

• the named contacts at that organization (name, email address, phone number, job title, and which one is the primary contact), the organization’s general email address, phone number and postal address, its dues status, its membership status and its record of dues paid by year.

That split is enforced where the page is built, not hidden with styling. For somebody who is not signed in, those details are simply not part of what the website sends to their browser. An organization that is no longer a member drops out of the public directory altogether.

If you serve on the Board or a committee

The Board page and the Committees page are public, and they name the volunteers who run the Association. For a Board member that is their name, their role, the organization they work for, a photograph if they have given us one, and a short biography if they have written one. For a committee it is each member’s name, their role on the committee and their organization. If you serve and would rather something about you was not shown there, just say so and we will take it off.

If your organization applies to join

The application form is open to anyone, and it asks for details about the organization (name, IATA code, member type, website, description, general email address, phone number, postal address and logo images) and about a named person to be the primary contact: their name, email address, phone number and job title. An application can be read only by the Association’s staff accounts, which means the Board, the Survey Committee and administrators. We keep it, together with the Board’s decision, a note about that decision, and who made it.

If you are filling that form in for a colleague, please tell them first. You are giving us their details, not your own.

Conference registrations, including guests

When somebody registers their organization for the conference they enter a first name, last name and email address for each place, and those places include guests, who are often a partner or spouse and are not members of the Association. We also hold which organization and event the place is for, whether it is the free first delegate place, whether it has been paid for, the payment that covered it, a private code used by the QR badge, which member added the place, and whether, when, and by which Board member the person was checked in at the venue. Badges are emailed automatically once a payment succeeds.

Worth saying plainly to whoever does the typing: when you add a colleague or a guest you are giving us their name and email address, we will email them their badge, and we will record when they arrive at the conference.

Payments

Payment happens on Stripe’s own pages. Your card number is never typed into a Pass Bureau Association page, never passes through our servers, and is never stored by us. There is no Stripe code running on this website at all.

What we do keep about a payment: who paid and for which organization, what it was for, which event if any, the method, the status, the amount, the processing fee, the currency, the dues period it covers, when it was paid, Stripe’s own reference numbers, a link to Stripe’s receipt, our own receipt number, and the lines that made up the receipt.

Survey answers

A survey response is recorded against both the account that gave it and the organization it was sent on behalf of. What other members see is always combined totals, never individual names. When the Survey Committee reviews or exports answers it can see who answered, unless the survey is set to group answers by airline instead, which is a choice made when the survey is set up.

Each survey carries its own settings for who may see its results (everyone invited, or only members who completed it) and whether a member sees the results for a question they did not answer. Those settings are frozen the moment the survey goes live, so they cannot be loosened afterwards.

In Survey Insights, the Association’s benchmarking library, a figure is withheld entirely when fewer than three answers are behind it. A withheld figure is shown as unavailable rather than as a number, so a handful of answers is never put on display as if it spoke for the industry.

The Association also holds an archive of its own historical survey results from 2014 to 2025. It is results only. It carries no member accounts and no personal contact details.

Records of what was done on the site

Running a members’ site means keeping a few plain records of who did what, so that a mistake can be traced and put right rather than argued about. We keep a record of the survey work: who opened, published, reopened or closed a survey, and who removed a response, along with the member it was about. The answers themselves are not stored in that record. If you are on the Survey Committee, your comments, votes and suggested answer choices on draft questions are kept against your name, because that is how the committee works together and sees who suggested what. We record who changed an organization’s primary contact. And if you send us feedback about the website, we keep what you wrote, your name, and which page you were on when you wrote it.

What we do not do

• No tracking, and no other company’s code on our pages. There is no analytics, no advertising, no tag manager, no social buttons, no embedded map or video, and no chat widget anywhere on this site. We do not know how many people looked at a page or where they came from.
• No fonts fetched from anybody. The typefaces are downloaded when the site is built and served from this site, so your browser never contacts a font company.
• We do not track our emails. Our mail service is set up to report only whether a message was delivered, bounced, was reported as spam, was rejected, or failed to render. It is not set up for open or click reporting, so there is no invisible tracking image in our email and no rewritten links. We do not know whether you opened one.
• We do not sell, rent or trade anything about you, and we do not send anything about you to an advertiser.
• Do Not Track. Some browsers can send a “do not track” signal. This site does not track anyone, so there is nothing here for that signal to switch off.

Who else sees it

• Amazon Web Services hosts the website, the database and the uploaded files, and sends our email.
• Stripe takes the payment and tells us the result. Stripe sees what you type on its own payment page; we see the outcome.
• Apple and Google, but only if you choose to add a conference badge to a phone wallet. Simply looking at the page contacts neither of them: the buttons are stored on this site.
• Have I Been Pwned. When you choose a password we check it against a public list of passwords that have appeared in known data breaches. We send only the first five characters of a scrambled version of it, which hundreds of unrelated passwords share, so the check tells them nothing about your password. The password itself, and the full scrambled value, never leave our server, and if the service is slow or unavailable you are never blocked.
• Anthropic. When a Survey Committee member uses the “Polish wording” button while drafting a survey question, the wording they typed is sent to Anthropic’s Claude service and a suggested rewrite comes back for them to accept or ignore. Nothing is read from our database and nothing is changed automatically. This happens only on that one button, and only for the people who build surveys: the Survey Committee, the Board and administrators.

An oversight copy of payment and registration email

While the payment side of the site is new, a blind copy of a short list of messages also goes to one person at Velozation Airline Technology Services, so a problem is spotted quickly rather than reported later. The list is: payment receipts, the “your bank transfer is on its way” notice, failed payments, refunds, card disputes, and the notice sent when an organization registers for the conference.

Nothing that carries a link or a code is ever copied. Password resets, email confirmations, two-step-sign-in resets and conference badges are not copied, and neither are the bulk emails sent to the whole membership. The copies go nowhere else, and the Board can switch this off with a single setting.

A Board administrator can view the site as your account

So that somebody can help you with a problem you are seeing, an administrator can start a session that shows them the site as your account sees it. Only a full administrator can do this, never a Board or Survey Committee account. It can only be pointed at an ordinary member account, never at staff, and never at their own. Only one can run at a time, it ends by itself after 30 minutes, and it does not touch your own sign-in in any way.

Each time one starts and ends we write a record of it: which administrator, which account, when, and the internet address the action came from. Those records cannot be edited or deleted through the website by anybody, and only administrators can read them.

Cookies

If you are reading the public pages, this site puts nothing at all on your device. Signing in sets a small number of cookies that exist to keep you signed in and keep your account safe, and coming back from a payment leaves one short note in the tab you are using. The full list, and what each one is for, is on the cookies page.

How long we keep things

We keep an organization’s records for as long as it is a member of the Association, and for a period afterwards, so that its history, its dues record and its survey contributions are not lost the moment a membership lapses.

We have not set a fixed period yet. The Board is working on a written schedule, and we would rather say that here than print a number that nothing actually enforces. When the schedule is agreed, this page will carry it.

One thing that does have a fixed period: the website’s own technical logs are kept for 30 days and then deleted automatically.

Your rights, and they are the same for everybody

The Association has members in the United States, Canada, the United Kingdom, the European Union and further afield. Rather than work out which country’s rules reach which member, we offer everyone the same thing. Wherever you are, you can:

• ask to see what we hold about you;
• ask us to correct anything that is wrong;
• ask us to delete what we hold about you;
• ask us to stop emailing you, apart from the few messages needed to run your membership, such as a receipt for a payment you have made.

Some of it you can do yourself: your own details are on your account page, and anybody signed in at your organization can update its contact details in the directory, including the named contacts. For anything else, ask through the contact page and a member of the Board will deal with it.

Two honest limits. We have to keep payment and receipt records for the Association’s accounts. And a survey answer that has already been counted into results the membership is using cannot be unpicked without changing figures other members rely on. If we keep something after you have asked us not to, we will tell you what it is and why.

Children

This site is for people who work at member organizations. It is not aimed at children and we do not set out to collect anything about them.

When this page changes

Every change to this page changes the date at the top of it, and the wording is kept with the rest of the website’s source, so there is a dated record of what it said and when.

Questions

If anything on this page is unclear, or you would like to talk to somebody about it, please get in touch through the contact page. A member of the Board will answer.