Privacy Policy

TSBC is the data controller for personal information you provide directly to us as an individual user. Where you use TapCard as part of an organisation, your organisation may also act as a controller of your profile information.

• General: [email protected]
• Privacy: [email protected]
• Data Protection Officer: [email protected]
• Address: TSES Abuja, Nigeria

If you are in the EU or UK and prefer to contact a local representative, email [email protected] and we will route your request appropriately.

This Privacy Policy covers:

• Visitors to gettsbc.com and our marketing pages.
• Users who create an account or use a TapCard profile.
• People who receive or interact with a profile shared by a TapCard user, including link visitors, tap recipients, QR scans, and wallet pass recipients.
• Customers who buy physical NFC cards or accessories from us.
• People whose contact details are captured by a TapCard user through lead-capture forms, badge scans, or paper-card scans.

This policy does not cover the practices of third-party services we integrate with, such as Google, Apple, Salesforce, HubSpot, and payment processors. Those services have their own privacy policies.

3.1 Information you give us

• Account information such as your email address, password (hashed), authentication tokens from Google or Apple sign-in, and verification codes.
• Profile information such as your name, title, company, profile photo, cover photo, bio, phone numbers, email addresses, physical address, social handles, links, videos, brand colours, and other details you choose to add to your card.
• Billing information such as your name, billing address, and tax ID. Card payment details are collected and stored by our payment processors, not by TSBC.
• Communications such as support requests, survey responses, and messages you send.
• Lead-capture and Captured Contacts data you save about people you meet, including names, emails, phone numbers, photos of paper cards, voice notes, tags, and follow-up notes.

3.2 Information we collect automatically

• Device and log data such as IP address, approximate geolocation based on IP, device type, operating system, browser type and version, language, referrer URL, and timestamps.
• Usage data such as pages visited, features used, buttons clicked, errors encountered, session duration, and similar telemetry.
• Profile analytics when someone taps your card, scans your QR code, or opens your share link. We may capture coarse location and device type, but not identity unless the recipient chooses to share it with you.
• Cookies and similar technologies as described in Section 8.

3.3 Information from third parties

• Sign-in providers such as Google and Apple, which may provide your email, name, and profile photo.
• Payment processors such as Stripe and Paystack, which may provide transaction confirmation, partial card details, and fraud signals.
• Integration partners such as Salesforce, HubSpot, Pipedrive, Outlook, and Gmail, but only where you authorise the integration.
• Public sources or enrichment providers, where we may enrich Captured Contacts with publicly available business information.

We use personal information to:

1. Provide the Services, including creating and hosting your TapCard profile, delivering shares, generating QR codes and wallet passes, processing taps, and showing analytics.
2. Authenticate you, verify your identity at sign-in, and protect your account.
3. Process payments for paid plans and physical products, including refunds.
4. Communicate with you through service messages, support replies, and, where permitted, product updates and marketing.
5. Improve the Services by analysing usage, fixing bugs, and prioritising features.
6. Personalise your experience by remembering preferences and suggesting integrations.
7. Protect the platform against fraud, abuse, spam, and security incidents.
8. Comply with legal, regulatory, and tax obligations.
9. Produce de-identified, aggregated analytics and statistics about the Services.

Legal bases under GDPR and NDPA

We do not sell your personal information. We share information only as described below.

5.1 With people you share your card with

Anyone who receives a tap, scans your QR code, opens your share link, or downloads your wallet pass will see whatever you chose to include on your profile. Once that information leaves our platform, we cannot control how the recipient uses or stores it.

5.2 With your organisation

If you use TapCard under an organisation account, the organisation's administrators can access, edit, lock, export, or delete your profile and Captured Contacts. They can also see analytics about how you use the platform.

5.3 With service providers

The current provider list is available on request at [email protected].

5.4 With authorities

• To comply with laws, regulations, court orders, subpoenas, or other legal process.
• To enforce our Terms and Conditions.
• To protect the safety, rights, or property of TSBC, our users, or the public.
• To detect, prevent, or address fraud, security, or technical issues.

Where the law allows, we will notify you before disclosing your information.

5.5 In a business transaction

If TSBC is involved in a merger, acquisition, financing, reorganisation, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.

5.6 With your consent

For any sharing not listed above, we will ask for your consent first.

TSBC is based in Nigeria, but our service providers operate globally. Your information may be transferred to and processed in countries that have different data protection laws than your own, including the United States, the European Union, the United Kingdom, and Canada.

When we transfer personal information internationally, we use safeguards such as:

• Standard Contractual Clauses approved by the European Commission.
• UK International Data Transfer Addendum.
• Adequacy decisions where available.
• Equivalent safeguards required under the Nigeria Data Protection Act 2023 and overseen by the Nigeria Data Protection Commission.

We keep personal information only as long as we need it for the purposes described in this Privacy Policy, then we delete or anonymise it.

We may retain information longer where required by law, to resolve disputes, or to enforce our agreements.

We use cookies and similar technologies to:

• Keep you signed in.
• Remember your preferences.
• Measure and improve the Services.
• Detect abuse and protect the platform.

You can control cookies through your browser settings, and you can manage non-essential cookies through our cookie banner. Disabling cookies may break parts of the Services.

We do not respond to Do Not Track browser signals because there is no industry consensus on how to interpret them. We do, however, respect the Global Privacy Control signal where required by law.

Subject to applicable law, you have the right to:

• Access a copy of the personal information we hold about you.
• Rectify inaccurate or incomplete information.
• Erase your personal information.
• Restrict or object to certain processing, including direct marketing.
• Receive your information in a structured, commonly used, machine-readable format and transmit it to another controller.
• Withdraw consent where we rely on consent.
• Lodge a complaint with the Nigeria Data Protection Commission, your local EU or UK supervisory authority, the California Privacy Protection Agency, or another competent regulator.

You can exercise most of these rights directly from your account settings. For anything not available in-app, email [email protected]. We may need to verify your identity before acting.

9.1 If you are a Captured Contact

1. Contact the user who saved your information first, because they control that record.
2. If they do not respond, email [email protected] with details of who saved your contact and we will help facilitate your request.

9.2 California residents

• Right to know the categories and specific pieces of personal information we collect, use, disclose, and sell or share.
• Right to delete personal information, subject to certain exceptions.
• Right to correct inaccurate personal information.
• Right to opt out of sale or sharing for cross-context behavioural advertising. TSBC does not sell personal information and does not share it for that purpose.
• Right to limit the use of sensitive personal information.
• Right to non-discrimination for exercising your rights.

California residents can submit a request by emailing [email protected] with the subject line "California Rights Request".

The Services are not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16.

If you believe a child has provided us with personal information without parental consent, contact [email protected] and we will delete it.

We protect personal information with appropriate technical and organisational measures, including:

• Encryption in transit and encryption at rest for sensitive data.
• Hashed passwords using bcrypt or stronger.
• Role-based access controls and least-privilege access for staff.
• Multi-factor authentication for administrators.
• Regular vulnerability scanning, dependency updates, and security reviews.
• Incident-response and breach-notification procedures.
• Vendor security assessments.

No system is perfectly secure. If you believe your account has been compromised, contact [email protected] immediately.

If we suffer a personal data breach that creates a risk to you, we will notify you and the relevant regulator within the timeframes required by law.

We do not use your personal information to make decisions that produce legal or similarly significant effects on you through automated means without human involvement.

We may send you marketing emails about TapCard products, features, and tips. You can opt out at any time by clicking unsubscribe in a marketing email or by emailing [email protected].

You will continue to receive transactional messages such as receipts, security alerts, and service updates because they are necessary to operate your account.

The Services may contain links to third-party sites, including social-media profiles you add to your card. We are not responsible for the privacy practices of those sites, and we encourage you to read their privacy policies.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or by posting a prominent notice on gettsbc.com before the changes take effect.

The Last Updated date at the top reflects the most recent revision. Your continued use of the Services after changes take effect means you accept the updated Privacy Policy.

For any privacy questions, complaints, or requests, contact:

• TSBC - TapCard
• Email: [email protected]
• DPO: [email protected]
• Website: https://gettsbc.com
• Address: Lagos, Nigeria

This Privacy Policy is provided in English. If we provide a translation, the English version controls in case of conflict.