Privacy Policy

OneTapGo ("we", "us", "our") operates the website at onetapgo.co.uk and provides NFC-based digital business card products and a customer portal platform.

We are the data controller for personal information collected through this website and platform. For data protection enquiries, contact us at [email protected].

This policy applies to all visitors, customers, and registered users of our website and portal.

We process your personal data for the following purposes and legal bases under UK GDPR:

• Providing and managing your account and digital card profile — Contractual necessity (Art. 6(1)(b))

• Storing and displaying your Card Bank and Paper Cards — Contractual necessity (Art. 6(1)(b))

• Sending account-related emails (welcome, password reset, notifications) — Contractual necessity (Art. 6(1)(b))

• Responding to contact form enquiries — Legitimate interests (Art. 6(1)(f))

• Anonymised analytics to understand how the platform is used and improve it — Legitimate interests (Art. 6(1)(f))

• Complying with legal obligations (e.g. tax records) — Legal obligation (Art. 6(1)(c))

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.

OneTapGo NFC products redirect a tapping device to a URL — no personal data is transmitted from the tapping device to OneTapGo.

We record anonymised tap events (session token, timestamp, referrer) to provide tap-count analytics to card holders. These events cannot be used to identify individual people.

Review link redirects work the same way: a hit is counted and an anonymised event is logged; no personal data about the person clicking the link is stored.

We use the following cookies and browser storage:

• Session cookie (essential): Maintains your login session in the portal. Required for the site to function — cannot be disabled.

• Analytics session token (functional): A randomly generated identifier stored in sessionStorage to group page events within a single visit. It is not linked to your identity and is discarded when you close the browser tab.

We do not currently use third-party advertising or tracking cookies. If this changes, we will update this policy and, where required by law, obtain your consent before setting such cookies.

We take appropriate technical and organisational measures to protect your personal data, including:

• HTTPS encryption for all data in transit

• Passwords stored as bcrypt hashes — we never store plaintext passwords

• Role-based access controls limiting which staff can access which data

• Paper card images stored in private server storage, not publicly accessible by URL guessing

• Regular review of our data handling practices

No method of transmission over the internet is completely secure. While we strive to protect your data, we cannot guarantee absolute security.

We retain personal data only for as long as necessary for the purpose it was collected:

• Active portal accounts: retained for the lifetime of the account

• Deleted accounts: personal data removed within 30 days of deletion request

• Paper card images and contact details: retained until you delete them or your account is closed

• Contact form enquiries: retained for up to 2 years

• Anonymised analytics events: retained indefinitely (no personal data)

• Order and financial records: retained for 7 years in line with UK HMRC requirements

We do not sell, rent, or trade your personal data. We may share data with:

• Hosting and infrastructure providers who process data on our behalf under data processing agreements

• Email delivery services used to send transactional emails (e.g. welcome emails, password resets)

• Law enforcement or regulatory bodies where required by law

All third-party processors are required to handle your data securely and only for the purposes we specify.

As a UK data subject, you have the following rights:

• Right of access: Request a copy of the personal data we hold about you

• Right to rectification: Ask us to correct inaccurate or incomplete data

• Right to erasure: Request deletion of your personal data (subject to legal obligations)

• Right to restrict processing: Ask us to limit how we use your data

• Right to data portability: Receive your data in a structured, machine-readable format

• Right to object: Object to processing based on legitimate interests

• Right to withdraw consent: Where processing is based on consent, withdraw it at any time

To exercise any of these rights, email us at [email protected]. We will respond within one calendar month. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

Our platform is intended for business use by adults aged 18 and over. We do not knowingly collect personal data from children under 13.

If you believe a child has provided us with personal data, please contact us immediately at [email protected] and we will delete it promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will update the "Last updated" date at the top of this page.

For significant changes that affect how we use your personal data, we will notify registered users by email where practicable.

For any questions about this Privacy Policy, to exercise your data rights, or to raise a concern:

Email: [email protected]

Website: onetapgo.co.uk/contact

We aim to respond to all privacy-related enquiries within 30 days.