Privacy Policy
Last updated: 16 April 2026
1. Who we are
Second Pass (“we”, “us”, “our”) operates the website secondpass.co and related services that help individuals identify and pursue second citizenship opportunities through descent, naturalization, marriage, or investment pathways.
Our contact email is ben@secondpass.co.
2. What data we collect
We collect the following categories of personal data:
- Contact information — your email address, collected when you create an account or submit inquiries.
- Identity and ancestry information — names, dates and places of birth, nationalities, and family history you provide through the eligibility quiz and case intake forms.
- Identity documents — scans or photographs of passports, birth certificates, marriage certificates, and other documents you upload in connection with your case.
- Quiz answers — your responses to citizenship eligibility questions.
- Account activity — case status, task progress, document review history, and timestamps.
- Technical data — IP address, browser type, and server logs generated automatically when you use our services.
We do not collect payment card details directly; any future payment processing will be handled by a PCI-compliant third-party processor.
3. Why we process your data
We process your personal data for the following purposes:
- To assess your eligibility for citizenship pathways and present results to you.
- To create and manage your case, assign tasks, and communicate progress updates.
- To send transactional emails (case updates, document status, monthly digests) related to your active case.
- To comply with legal obligations and defend against legal claims.
4. Legal basis for processing
We rely on the following legal bases under GDPR and equivalent laws:
- Consent — for processing your eligibility quiz data and identity documents. You provide consent when you check the consent checkbox during sign-up or intake.
- Contract performance — to fulfill our service obligations once you engage us to manage a citizenship case.
- Legitimate interests — for fraud prevention, security, and improving our services, where these interests are not overridden by your rights.
- Legal obligation — where required by applicable law.
5. Data processors
We engage the following third-party processors who handle your data on our behalf. Each is bound by data processing agreements and appropriate safeguards:
| Processor | Purpose | Location |
|---|---|---|
| Supabase | Database hosting and file storage | United States |
| Vercel | Application hosting and edge network | United States / Global CDN |
| Resend | Transactional email delivery | United States |
6. Data retention
The table below summarises our retention periods by data category:
| Data category | Retention period | Reason |
|---|---|---|
| Quiz session data | 30 days | Sessions not linked to a case are purged automatically |
| Case data | Active case + 7 years after closure | Legal compliance and potential appeals |
| Analytics data | Anonymised after 14 months | Aggregated trend analysis only; no personal data retained |
| Account data | Until account deletion + 90-day grace period | Allows recovery from accidental deletion |
6b. Automated decision-making
Our eligibility quiz uses an automated rule-based algorithm to assess whether you may qualify for citizenship through descent, naturalisation, marriage, or other pathways. The result is an algorithmic verdict based solely on the answers you provide.
Under GDPR Article 22, you have the right to request human review of any automated eligibility result. To request a manual review, contact us at ben@secondpass.co with the subject line “Human Review Request”.
7. Your rights
Depending on your jurisdiction (including EEA and UK residents under GDPR, and California residents under CCPA), you may have the following rights:
- Access — request a copy of the personal data we hold about you.
- Rectification — ask us to correct inaccurate data.
- Erasure — request deletion of your data (“right to be forgotten”).
- Portability — receive your data in a structured, machine-readable format.
- Restrict processing — ask us to limit how we use your data in certain circumstances.
- Object — object to processing based on legitimate interests.
- Withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
- Lodge a complaint — you have the right to lodge a complaint with your national Data Protection Authority (e.g., the ICO in the UK, or the relevant supervisory authority in your EEA member state).
8. How to exercise your rights
You can exercise your rights in two ways:
- Self-service — log in and visit Account Settings to export a copy of your data or permanently delete your account and all associated data.
- Data Subject Access Request (DSAR) — to submit a formal DSAR or exercise any right listed above (access, correction, export, deletion, or restriction), email ben@secondpass.co. We verify your identity by replying to the same email address the data was submitted from, and we respond within 30 days.
- No account? — if you completed our eligibility quiz without creating an account, email is the only way to reach your data. Send your request to the address above from the email you used, or include enough detail (the email address entered and the approximate date) for us to locate your quiz responses. Quiz sessions that are never linked to a case are automatically deleted after 30 days.
9. Cookies
We use the following cookies:
- Authentication session cookies — set by Supabase to maintain your logged-in session. These are strictly necessary and cannot be disabled without preventing login.
We do not use tracking cookies, advertising cookies, or analytics cookies. No data is sold to advertisers or data brokers.
10. International data transfers
Our processors (Supabase, Vercel, Resend) are based in the United States. When we transfer personal data from the EEA, UK, or other jurisdictions with data transfer restrictions, we rely on:
- EU Standard Contractual Clauses (SCCs) — incorporated into our data processing agreements with each processor.
11. Security
We implement appropriate technical and organisational measures to protect your data, including encrypted connections (TLS), row-level security on our database, and restricted access to production systems. No method of transmission over the internet is 100% secure; if you have security concerns, please contact us immediately.
12. Children
Our services are not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided data to us, please contact us and we will delete it promptly.
13. Changes to this policy
We may update this policy from time to time. We will notify you of material changes by posting a notice on our website or emailing you. Continued use of our services after the effective date constitutes acceptance of the updated policy.
14. Contact
For any privacy-related questions, requests, or complaints, contact us at:
If you are in the EEA or UK and are not satisfied with our response, you have the right to lodge a complaint with your local supervisory authority (e.g., the ICO in the UK or your national data protection authority).