Privacy Policy.

The law we follow

We handle personal information in line with the Data Protection (Privacy of Personal Information) Act (Chapter 324A of the laws of The Bahamas), passed in 2003. Parliament has also passed the Data Protection Act, 2025 (No. 74 of 2025), which replaces the 2003 Act on a date the Government has yet to set. We will follow it from that date and update this page.

When you book with a business on PortPass, that business decides what it needs to know about you, and it is responsible for its own customer records. PortPass stores those records for the business and protects them as this policy describes. For PortPass accounts and for this website, PortPass is responsible.

What we collect, and when

When you register, book or enquire. We collect what you type into the form: your name, email address and phone number, and the details that booking needs, such as dates, guest numbers, the class or package you chose and how you plan to pay. You don’t need an account to enquire or to register a child. Only the free taster needs one.

When you create a PortPass account. Your name, your email address and your phone number. The phone number is optional unless you sign up to run a business. We also record which version of our terms you agreed to and when you last signed in. You sign in with a 6-digit code sent to your email, or with Google where the sign-in page offers it. There are no passwords, so we store none. If you registered a child earlier with the same email address, we link those registrations to your account.

Your member number, your Member Pass and perks. Every PortPass account has a member number, like PP-7K3Q. Your Member Pass shows your first name, that number, the month you joined and a code that changes every 30 seconds. When you show it at a business, the business sees your first name and member number, and which of its perks you can have. It does not see your email address or phone number. When a perk is used we record which perk, at which business, when, whether it was at the counter or online, and the discount if it was money. Each check of a pass by a business is counted (when, and whether it was valid) to stop anyone guessing codes. We also keep the tag on the link you signed up from (for example, that it was a member perk or a poster), to count sign-ups by source. Having an account for perks does not sign you up for marketing.

When you sign in with Google. If you choose “Continue with Google”, Google shares your basic profile with us: your name, your email address and your profile photo, with the ID number Google gives your account. We use your name and email address to create or find your PortPass account. We don’t use or show the photo; it stays with your sign-in record. We ask Google for nothing else. We can’t see your contacts, calendar, files or anything else in your Google account. PortPass never posts anything to Google or on your behalf. You can remove PortPass’s access at any time in your Google account settings.

When you run a business on PortPass. Your business details (name, section, description, location, contact details, website and Instagram, photos, prices and payment methods); the owner’s name, short biography and photo if you add them; the email addresses and roles of the people you add to your team; and the bank-transfer details you give us for your customers. We keep a log of changes to team invitations, listing approvals and payment details: what changed, when, who made the change, and for payment details the values before and after.

When you ask to be listed. Your name, business name, section, WhatsApp number, Instagram handle if you give one, and a short note. We also save the plan you picked, if any, and any tag on the link that brought you to the form (it shows which advert or poster you came from).

When we invite a business. To invite businesses to PortPass, we keep a list of businesses in The Bahamas with the details each one publishes about itself: its name, what it offers, its business phone, WhatsApp, email, website and Instagram page, and its Google rating. These come from Google’s business listings, the business’s own public Instagram page, and what its owner tells us. We never take them from private chats or groups. A founder writes to a business personally, one at a time. If you ask us not to contact your business again, we delete its details and keep only its name, so that we never add it back.

When you work for a business on PortPass. Your name, your role, an account name and a staff sign-in, the hours and notes you log, and your name on the records you enter. We store a scrambled version of your PIN, not the digits themselves; a PIN is short, so don’t reuse one you use anywhere else. For coaches, the business may also record a public profile (name, nickname, title, photo, short biography, coaching licences, where you played, your favourite player and team, an introduction video and the times you are available), the sessions you worked and what you are owed for them. What you are owed is shown only to you, to the owner of the business and to PortPass’s founders. A coach’s profile may also show a short quote from a customer, with the name the business gives.

How you found us. When you register we ask “How did you hear about us?”. We save your answer with your registration. We also save any referral code or name you give, the tag on the link or QR code you used (it shows which advert or poster brought you), the name of the website you came from, and whether your family is new to the business. This tells the business and PortPass which materials work, and whether a new customer came through PortPass. PortPass also uses it to work out the fee it invoices the business for customers PortPass brought; you are never charged for this. It is saved against your registration, so it is linked to you. It is never used to follow you around the web. Enquiry and “tell me when this opens” forms also save the tag on the link that brought you.

Payments. PortPass does not take card payments, and we never collect or store card numbers. You pay the business directly, by cash or bank transfer. The business’s staff then record the amount, the method, the date, any reference and who recorded it.

Children’s information

Some businesses on PortPass run programmes for children. A parent or guardian, or an adult they have authorised, registers the child and signs the consent. We never ask a child for information, and accounts are for adults only.

What we collect about a child. Name, date of birth and gender; the class they join and their attendance; an emergency contact and who may collect the child; your choice about photos and video; and the health details you choose to give: allergies, medical conditions, medications, special needs and anything you add in the notes box. The health details are optional. The business’s staff can add or correct health details you give them directly. For a private session or a party we ask only for the child’s name and age.

Why. To run that programme. The business places the child in the right class, takes attendance, keeps track of what has been paid and writes to you about the booking. The coach on the field also needs to know what to do in an emergency. Health details are sensitive: we hold them only because you chose to give them, and they are used only to keep the child safe.

Who can see a child’s health details. Only that business’s own staff who need them: its coaches, the staff on its registration desk and its owner. A volunteer helper who only ticks names on the class list is not sent them. Health details never appear in a spreadsheet, an export, an email or a public page. They are not on the status page you open with your reference code, and not in your PortPass account. PortPass’s own admin area never shows them. A PortPass founder who also coaches for a business sees them there as one of that business’s coaches. The founders, and the people who maintain the system for them, can reach the database, and do so only to fix a fault or at the business’s request.

Emergency contacts and pickup names are seen by the same staff. If the business sends you a personal link to register again next term, the link fills in what you gave last time. That is your name, email, phone and relationship to the child; your child’s name, date of birth and gender; the emergency contact; and the pickup names. Anyone you forward that link to can see all of it while early registration is open. A link stops working 120 days after it was made. The business’s staff can also download a class list with names, dates of birth, parents’ contact details and pickup names; it never includes health details. A personal link never fills in health details; we ask for them fresh each time you register.

Records the business starts. Sometimes the business begins a child’s record before you do. Its staff may add your child’s name, and your name and contact details if they have them. A business moving to PortPass may bring over what it already holds about your child, which can include emergency contacts and health details. You are then sent a link to complete and sign the registration yourself. Where a school has hired the business, the business keeps only your child’s name and attendance; the school holds the rest.

Photos. You choose yes or no to photos and video when you register. We never ask you to upload a photo of your child. A photo in a sports business’s gallery is only shown on its page after the business confirms it holds consent for every child in it. PortPass does not see the consent forms; the business is responsible for them. Coach profile photos are not checked this way.

Other notes. Anything you write in another free-text box, such as the goal of a private session, is kept with that request and seen by the coaches and the registration desk. Please keep health information to the registration form.

How long. A child’s health details are deleted 90 days after the programme they registered for ends. See “How long we keep it” below.

How we use it

To handle your enquiry, registration or booking; to put you in touch with the business; to send you messages about that booking; to sign you in; to let a business run its listing, its team and its records; to answer questions you send us; and, if you asked us to tell you when something opens, to contact you about that.

Emails we send. Your sign-in code. For a child’s registration: that it was received, that a payment was recorded, and that it was confirmed. For a private session: that a coach accepted it, with the time, place and how to pay. If a business adds you to its team: an invitation. If you own a business on PortPass: a warning whenever its bank details are changed. These emails carry names, the class, amounts and your reference code. They never carry health or emergency details. We also email ourselves when someone asks to be listed, and the business when an enquiry arrives; those notes carry the names on the request.

We do not sell your information. We do not use it for advertising. We do not send marketing emails, other than the message you asked for when you joined a “tell me when this opens” list.

Who we share it with

The business you book with sees the details of your booking. That is the point of the booking.

Companies that run PortPass for us. They receive information only so they can provide their service to us:

• Supabase: our database, sign-in and photo storage.
• Vercel: website hosting. Every page you open and every form you send passes through its servers, and its logs record your internet address and the address of each page.
• Resend: sends our emails, so it handles the address, subject and text of each one.
• Google: only if you choose to sign in with Google.
• Microsoft Outlook: our own inbox, where requests to be listed and emails you send us arrive.
• Anthropic and GitHub: tools we use to build and maintain PortPass. Anthropic’s AI also reads the public details of a business we plan to invite. They are not sent customer records in normal use.

WhatsApp. WhatsApp buttons on PortPass open WhatsApp on your own device with a message you can edit. Nothing is sent unless you send it. The message then goes through WhatsApp, not through PortPass, and WhatsApp’s own terms apply. A business’s staff may also message you on WhatsApp at the number you gave them.

Review badges. One listing, Bahamas Weddings By The Sea, shows its rating, an award and its reviews using WeddingWire’s own badges. On that page your browser loads them from WeddingWire, which can see your internet address and may set its own cookies.

Where it is kept. Our database and photos are stored in the United States, with Supabase and Vercel. Emails pass through Resend and Microsoft, which may store them in the United States or elsewhere, and all of these companies’ networks may pass information through other countries on the way. We also keep encrypted backup copies of the database on a computer we control. When you send us your details, you agree to them being stored outside The Bahamas. Photos a business or coach uploads for its public page are stored at public web addresses.

We may also disclose information when the law requires us to.

Cookies and what is kept on your device

PortPass sets a small number of cookies, all of them its own:

• Sign-in: keeps you signed in to your PortPass account until you sign out, and holds a one-time check while you are signing in with Google.
• Last place: remembers which part of PortPass you opened last, for up to a year. It is removed when you sign out.
• Staff sign-in: keeps a business’s staff signed in to their staff area for up to 12 hours.
• Administrator check: remembers for up to 12 hours that a PortPass administrator passed the second sign-in step.
• How you found a business: on some businesses’ pages (today, Futprep’s), if you arrived from a tagged link, another website or another PortPass page, a cookie remembers the tags on the link, the name of that website and that you came through PortPass. It lasts 30 days, so it can be saved with your registration. It holds no name and nothing that identifies you.

Your browser also keeps a few things that never leave your device: whether you closed the “get the app” banner, whether you have seen the opening animation, and copies of public pages you opened so they still open offline. Pages that show your personal information are not saved offline, and nothing you type into a form is saved offline. The one exception is your Member Pass: your device keeps your first name, your member number and the next few minutes of codes, so the pass opens with no signal. That copy is removed when you sign out. On a coach’s phone, attendance marks wait on the device until they are saved; they hold no names.

PortPass sets no advertising cookies and does nothing of its own to follow you to other websites. The WeddingWire badges described above are the one thing on PortPass that another company controls. To count visits and measure page speed we use Vercel’s Web Analytics and Speed Insights, which Vercel builds to work without cookies and without identifying you. They record which public pages are opened and a few button taps, such as starting a registration or tapping a WhatsApp button, with no names or contact details. We leave out the staff, admin and account areas, and we remove reference codes and personal details from page addresses before they are sent.

For a business’s own growth report, we also count on our own servers how many times its public pages are opened, how often its WhatsApp and Register buttons are tapped and its registration form is started, and how the visitor arrived (for example from a PortPass QR code). These counts hold no name, no account and no internet address.

We use your internet (IP) address only to slow down repeated attempts on our forms and sign-ins, and repeated counting of page visits. It is held in memory for a short time and is never saved in our own records. The companies that host PortPass and handle sign-in also see it, and may keep it in their own security logs.

How long we keep it

• Children’s health details (allergies, medical conditions, medications, special needs and the notes box): deleted automatically 90 days after the programme ends, together with any earlier versions kept in the record’s edit history. “The programme” is the term or camp the child was registered for; a free taster or a waiting-list place counts from the end of that term.
• Payment records: 7 years.
• Enquiries that don’t become a booking (wedding enquiries, private-session and party requests, “tell me when this opens”, and requests to be listed): 2 years.
• Registrations and bookings (names, contact details, class, attendance): kept as the business’s record while you are its customer, and for up to 7 years where a payment was recorded.
• PortPass accounts: until you ask us to delete the account.
• A record of emails we send you (your email address, what kind of email it was and whether it was delivered; never the email’s text): 12 months.
• Sign-in codes: each one works once and stops working soon after it is sent.
• Perks you have used: kept as your record and the business’s while you have an account. If your account is deleted, the record stays with the business without you on it.
• Checks of a Member Pass by a business: 30 days.
• The log of changes to team invitations, approvals and payment details: for as long as the business is on PortPass.

At the end of these periods we delete the information, or remove the names from it so it can no longer be linked to you. The 90-day deletion of health details runs automatically every day. When a business’s registration desk corrects a child’s registration, the earlier value is kept in an edit history, with who changed it and when. Our encrypted backups are kept for about a year, so deleted information leaves the backups within about 13 months. When a business leaves PortPass, we give it a copy of its records (without children’s health details) and take its page down; the periods above still apply to what we hold.

Your rights

You can ask us, in writing, what information we hold about you and for a copy of it. You can ask us to correct it, to delete it, or to stop using it in a particular way. Email us at the address below. We may ask you to confirm who you are first. For a booking or a registration, you can write to the business or to us; we pass your request on to the business and help it answer. We answer as soon as we can, and always within 40 days (the Act allows 40 working days). If we can’t do what you ask, for example because the business must keep a payment record, we will tell you why.

For a child’s registration, the business’s registration desk can correct the record for you, and each correction is logged.

You can also complain to the Data Protection Commissioner at any time: Office of the Data Protection Commissioner, P.O. Box N-3017, Nassau, The Bahamas; telephone (242) 604-1001; dataprotection@bahamas.gov.bs; dataprotection.gov.bs.

Deleting your account

Email us and we will close your PortPass account within 40 days. That removes your sign-in and your profile. Registrations and payments already made stay with the business you made them with, as its own records, for the periods above. If you were part of a business’s team, your membership ends. The business’s own information stays with the business. The log of changes still shows what was changed, and the email address an invitation was sent to.

How we protect it

Your browser never connects to our database. Every request for information goes through our own servers, and they decide what each signed-in person may see. Public photos load straight from our photo storage. A business’s staff area has its own sign-in, and five wrong PINs lock that sign-in for 15 minutes. PortPass’s own administrators need a second step, a code from an authenticator app, before they can open the admin area or a business’s records. Team invitations, approvals, changes to payment details and corrections to children’s registrations are logged with who made them. Connections to PortPass are encrypted.

No system is perfectly secure. If something goes wrong that affects your information, we will tell you and the business concerned.

Changes to this policy

When we change this policy we update the version and the date at the top and list what changed at the bottom. If a change affects how we use information you have already given us, we will email you where we have your address.

Contact us

PortPass Bahamas Technologies
Nassau, The Bahamas
Email: portpassbahamas@outlook.com
Phone: +1 (242) 423-8161

See also our Terms of Service.