Privacy statement

Last updated: 3 November 2026

Who we are

TapCo (Pty) Ltd (to be registered) ("TapCo", "we" or "us") supplies NFC business cards and the contact pages and company portal that go with them. This statement explains how we handle personal information under South Africa's Protection of Personal Information Act, 2013 (POPIA).

You can contact us about privacy at hello@tapbusiness.org, 082 880 5549 or 062 594 7584.

Information we collect

• Enquiries: the name, company, contact details, team size and message you share when you email or phone us.
• Cardholder details: the name, photo, job title, phone number, email address, website and social media links on a person's contact page. These usually come from the person's employer or from the person directly.
• Customer accounts: the names, email addresses and sign-in details of people who use the company portal, along with a record of changes they make.
• Card use: which card or contact page was opened, and the date and time.
• Billing records: the business contact and payment details we need to invoice a customer and keep financial records.
• Technical information: our service providers may briefly record basic information, such as IP addresses and browser types, to deliver and secure the website.

We do not ask for special personal information, such as health or biometric information. Please do not include it in a message to us.

How we use it

• To reply to enquiries and prepare quotes.
• To print and program cards, and to publish and update contact pages.
• To run the company portal and show customers how often their cards are used.
• To invoice customers, provide support and keep the service secure.
• To meet our legal and accounting obligations.

We process personal information where it is needed to take steps towards or perform a contract, where the law requires it, where it serves a legitimate interest and is fair to you, or where you have given consent.

We only send direct marketing as POPIA allows, and you can opt out at any time. We do not sell personal information.

Contact pages are public by design

A contact page can be opened by anyone who taps the card, scans its QR code or has its link. Anyone who saves the details controls that copy on their own device. Only put information on a contact page that you are comfortable sharing in this way.

When an employer supplies a person's details, the employer is responsible for having a lawful basis to share them with us and for telling the person. We then handle those details on the employer's behalf, under our agreement with them.

Who we share it with

We share personal information only with service providers that help us run TapCo, and only as far as they need it. These include:

• Vercel (website and contact page hosting).
• Supabase (database, sign-in and photo storage).
• Google Workspace (business email).
• Our card printer, and our accounting and professional advisers.

We may also share information where the law requires it, or to protect our legal rights.

Information sent outside South Africa

Some of our service providers store or process information in other countries, including Ireland and the United States. Where this happens, we rely on the grounds POPIA allows, such as agreements that provide adequate protection, or transfers needed to perform a contract.

Cookies and fonts

Our marketing website does not use advertising or analytics cookies. Its fonts load from Google Fonts, so your browser shares your IP address with Google when you open a page. The company portal may use cookies that are needed to keep you signed in.

How long we keep it

• Enquiries that don't become customers: up to 24 months.
• Contact pages and customer accounts: for as long as the service is active, then deleted within 90 days after it ends, unless the customer asks us to do so sooner.
• Billing records: for as long as tax and company law require.

How we protect it

We use reasonable technical and organisational safeguards, including encrypted connections, access controls and limited staff access. No system is completely secure. If we have reasonable grounds to believe that personal information has been accessed by someone without authority, we will notify the Information Regulator and the people affected, as POPIA requires.

Your rights

You may ask us whether we hold your personal information and for access to it. You may also ask us to correct or delete it, and you may object to certain processing or withdraw consent. To do so, contact us using the details above. We may need to confirm your identity first. If your details were supplied by your employer, we may refer your request to them.

You may also complain to the Information Regulator at inforegulator.org.za or enquiries@inforegulator.org.za.

Children

TapCo is a service for businesses and is not aimed at anyone under 18.

Changes to this statement

We may update this statement from time to time. The latest version will always be on this page, with the date it was last updated.