tapqora
Legal · 23 October 2026

Privacy policy

This policy explains how Orbix Technologies Ltd, trading as Tapqora, a private company limited by shares registered in England and Wales under company number 16973554, whose registered office is at 437–441 Coventry Road, Small Heath, Birmingham B10 0TH, United Kingdom ("Tapqora", "we", "us") collects and uses personal data when you visit tapqora.com, buy from us, use a Tapqora card, profile or dashboard, or share your details through someone's Tapqora profile. It is provided under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the EU General Data Protection Regulation (EU GDPR), Canada's PIPEDA and Quebec's Act respecting the protection of personal information in the private sector (Law 25), and applicable US state privacy laws.

1. Who we are and how to contact us

Orbix Technologies Ltd is the controller of the personal data described in this policy, except where section 3 says we act as a processor. Contact our privacy team at privacy@tapqora.com or by post to Privacy Team, Orbix Technologies Ltd, 437–441 Coventry Road, Small Heath, Birmingham B10 0TH, United Kingdom. For Quebec, the person in charge of the protection of personal information is our Privacy Officer, reachable at the same addresses.

2. The personal data we collect

  • Account data: your email address, sign-in records and account settings.
  • Profile data you choose to publish: name, job title, company, photo, phone, email, website, address, bio and links.
  • Order data: name, delivery address, phone number (needed by couriers), items ordered, text to print, order history and delivery tracking.
  • Payment data: payment status, amount and the last digits and type of card, received from Stripe. We never receive or store your full card number.
  • Communications: emails and forms you send us, including enquiries, quotes and cancellation notices.
  • Profile visit data: when someone opens a Tapqora profile, we record the date and time, whether it came from a card tap, QR scan or link, the visitor's approximate country (derived from the network connection) and device type (iPhone, Android or other). We do not store visitors' IP addresses in our database.
  • Contacts shared with a Tapqora user: name, LinkedIn profile, email, phone, company and message entered by a visitor who chooses to share their details back.
  • Team data: team membership, role, assigned cards and activity totals.
  • Technical data: IP address and browser information processed by our hosting provider Cloudflare for security, abuse prevention and short-lived logs.

3. When we act as a processor

When a visitor shares their details through a Tapqora user's profile, that user (or their organisation) decides how those details are used and is the controller. We store and deliver those details on the user's behalf under our Data processing terms. If you shared your details with a Tapqora user and want them changed or deleted, contact that user first; we will also help if you email privacy@tapqora.com.

4. Why we use personal data and our legal bases

  • To create and run your account, profile and dashboard — performance of a contract.
  • To take payment, make, ship and support your order, and handle returns — performance of a contract.
  • To keep accounting and tax records — legal obligation.
  • To show you analytics about your own profile — performance of a contract.
  • To deliver contacts shared with you, and to send you follow-up reminders you can switch off — performance of a contract.
  • To prevent fraud, secure the Service and enforce our Terms — legitimate interests (keeping Tapqora safe for users and visitors).
  • To answer enquiries and quote for team orders — legitimate interests, or steps before a contract at your request.
  • To send marketing emails — your consent, which you can withdraw at any time using the unsubscribe link or by emailing privacy@tapqora.com.
  • To comply with legal requests and protect our legal rights — legal obligation and legitimate interests.

Where we rely on legitimate interests, we have balanced them against your rights. You can ask us for details of that assessment.

5. Who we share personal data with

We share personal data only with service providers who process it for us under written contracts, and only as much as each needs:

  • Supabase Inc. — database, sign-in and file storage, hosted in London, United Kingdom.
  • Cloudflare, Inc. — website hosting, content delivery and security.
  • Stripe Payments UK Ltd and Stripe, Inc. — payment processing and fraud prevention.
  • Resend (Plus Five Five, Inc.) — sending transactional emails.
  • Zoho Corporation — our business email.
  • Printags (France and Canada) — printing, NFC encoding and shipping cards; receives the text to print, the delivery name, address, phone and email.
  • Our metal card engraver — for Black metal and Gold edition orders, receives only the text to engrave and delivery details.
  • Couriers chosen for each order — delivery name, address and phone.
  • Professional advisers (accountants, lawyers) and authorities where required by law.

We do not sell personal data and we do not share it for cross-context behavioural advertising. Contacts shared with a Tapqora user are visible to that user and, for team members, to their team owner and admins.

6. International transfers

Our main database is in the United Kingdom. Some providers process data in the European Economic Area, the United States or Canada. Transfers from the UK and EEA rely on adequacy decisions (including the EU's decision for the UK, Canada, and the EU–US Data Privacy Framework and UK Extension for certified US providers) or on the UK International Data Transfer Agreement / Addendum and the EU Standard Contractual Clauses, with additional safeguards where needed. You can request a copy of the relevant safeguards from privacy@tapqora.com.

7. How long we keep personal data

  • Account and profile data: while your account is open; deleted within 30 days after you close it.
  • Order, invoice and payment records: 6 years after the end of the financial year (UK tax law).
  • Contacts shared with you: until you or the person who shared them deletes them, or your account closes.
  • Profile visit analytics: 24 months.
  • Enquiries and cancellation notices: 2 years after the last contact, or longer if needed for a legal claim.
  • Marketing preferences: until you unsubscribe, then a suppression record so we do not email you again.
  • Hosting security logs: as set by Cloudflare, typically no more than 30 days.

8. Your rights

Depending on where you live, you have the right to: access your personal data; correct it; have it deleted; restrict or object to its processing (including objecting at any time to direct marketing); receive it in a portable format; withdraw consent at any time; and not be subject to decisions based solely on automated processing with legal or similarly significant effects (we do not make such decisions). Quebec residents may also ask to be informed about and to have de-indexed personal information. California and other US state residents may request access, correction and deletion and will not be discriminated against for exercising their rights.

To exercise your rights, email privacy@tapqora.com. You can also download your data and delete your account from your dashboard. We respond within one month (UK/EU) or 30 days (Canada), and may ask you to verify your identity.

If you are not satisfied, you can complain to the UK Information Commissioner's Office (ico.org.uk, 0303 123 1113), to the data protection authority in your EU country, to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information. We would appreciate the chance to resolve your concern first.

9. Security

We protect personal data with encryption in transit (HTTPS/TLS), access controls and row-level security in our database, least-privilege access for staff, signed links for suppliers, and payment handling by Stripe (PCI DSS Level 1). NFC chips on our cards contain only a web link, never personal data. If a personal data breach is likely to put you at risk, we will notify you and the relevant authority as the law requires.

10. Cookies

We use only strictly necessary cookies. See our Cookie policy at tapqora.com/legal/cookies.

11. Children

Tapqora is not intended for children under 16 and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact privacy@tapqora.com and we will delete it.

12. Changes to this policy

We will post any changes on this page with a new date and, if the changes are significant, tell account holders by email.