Privacy notice

1. The controller

Name: Elatrousse Mohamed Annas, sole trader
Registered seat, postal address: 1171 Budapest, Bögöte utca 5.
E-mail (privacy requests too): support@taptap.hu
Phone: +36 20 228 8829
Websites: taptap.hu (webshop), my.taptap.hu (digital profiles)

We are not required to appoint a data protection officer under Article 37 of the Regulation.

2. Laws and principles

Processing is based on Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR, the Regulation), Act CXII of 2011 on informational self-determination and freedom of information (Infotv.), Act C of 2003 on electronic communications (Eht.) and Act C of 2000 on accounting (Számv. tv.).

We process personal data only for a specific purpose, to the extent and for as long as needed (purpose limitation, data minimisation, storage limitation). We do not use automated decision-making or profiling that would have legal effects on you.

3. Processing activities

Orders and fulfilment

Details: name, e-mail, phone number, delivery address, the products and options ordered, order number, time
Purpose: processing the order, performing the contract, communication about the order
Legal basis: performance of the contract, Article 6(1)(b) of the Regulation
Retention: until claims under the contract expire, 5 years (Ptk. section 6:22)

Designing and producing the card

Details: the details printed on the card (name, title, contact details), the uploaded logo, image or PDF, the mock-up and the approval
Purpose: creating the mock-up, getting it approved, producing the card, later re-orders
Legal basis: performance of the contract, Article 6(1)(b) of the Regulation
Retention: for 2 years after delivery (for re-orders and replacement cards), then deleted; earlier on request

Invoicing

Details: name or company name, billing address, tax number (for companies), e-mail, purchase details
Purpose: issuing and keeping invoices as required by law
Legal basis: legal obligation, Article 6(1)(c) of the Regulation; VAT Act section 159, Accounting Act section 169
Retention: 8 years from the date of the invoice

Shipping

Details: name, delivery address, phone number, e-mail
Purpose: delivering the product, courier contacting you
Legal basis: performance of the contract, Article 6(1)(b) of the Regulation
Retention: until delivery; within the order data for the 5 years above

Account and digital profile (my.taptap.hu)

Details: account data (name, e-mail, encrypted password, username) and the data you upload to the profile (photo, role, contact details, social profiles, links, gallery, video)
Purpose: running the account and the public profile, which anyone can open by tapping the card or scanning the QR code
Legal basis: performance of the contract, Article 6(1)(b) of the Regulation. You decide which data appears on the profile and who can see it.
Retention: until the account is deleted; after deletion the profile becomes unavailable immediately and is removed from backups within 30 days

Profile visitors

Details: We do not collect visitor statistics on profile views and do not identify visitors. Serving the page creates technical log data (IP address, time, browser); see Security logs. The “Save contact” button downloads the contact to the visitor's phone; we do not record this.
Legal basis: legitimate interest, Article 6(1)(f) of the Regulation: running the service and preventing abuse
Retention: 30 days (server logs)

Contact and support

Details: name, e-mail, order number (if any), the content of the message
Purpose: answering questions, helping you
Legal basis: for questions about an order, performance of the contract (Article 6(1)(b)); otherwise legitimate interest (Article 6(1)(f))
Retention: 1 year after the case is closed

Complaints

Details: name, address, e-mail, the content of the complaint, the record and the reply
Purpose: investigating and answering consumer complaints
Legal basis: legal obligation, Article 6(1)(c) of the Regulation; Fgytv. section 17/A
Retention: for the retention period required by the Fgytv.

Team quote requests

Details: company name, contact person's name, work e-mail, phone number, headcount, notes
Purpose: preparing and sending a quote
Legal basis: steps prior to entering a contract, Article 6(1)(b) of the Regulation
Retention: if no contract is concluded, 1 year from the quote request

Details: e-mail address, name (if given)
Purpose: sending a newsletter about news and offers
Legal basis: consent, Article 6(1)(a) of the Regulation. You can withdraw consent at any time with the link at the bottom of the newsletter or by e-mail.
Retention: until consent is withdrawn

Proof of consent

Details: time and subject of consent, IP address
Legal basis: legal obligation, Article 6(1)(c) and Article 7(1) of the Regulation
Retention: 5 years after consent is withdrawn

Security, logging

Details: IP address, time, browser type, the page requested (server logs, firewall)
Purpose: secure operation of the website, filtering out attacks and abuse
Legal basis: legitimate interest, Article 6(1)(f) of the Regulation
Retention: 30 days, unless needed longer to investigate a specific abuse

4. Cookies

A cookie is a small data file the website stores in your browser. On your first visit you choose in the cookie banner which cookies you consent to; you can change your choice any time via “Cookie settings” in the footer.

Type	What it's for	Legal basis	Provider
Necessary	bag, login, language, security, storing your cookie choice	Eht. section 155(4), legitimate interest	taptap, WooCommerce, Cloudflare
Statistics	anonymous visitor statistics (Google Analytics 4)	consent	Google Ireland Ltd.
Marketing	ad measurement and targeting (Google Ads), measuring where orders come from	consent	Google Ireland Ltd., WooCommerce

Without consent, Google services receive only cookieless, aggregated signals under Google Consent Mode. The full list of cookies and their expiry is in the cookie banner (“Details”).

5. Recipients and processors

We share data only with the partners below, and only for the stated purpose. We have contracts with our processors under Article 28 of the Regulation.

Hosting: Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus · www.hostinger.hu, hosting the website and data (processor)
Cloudflare, Inc.: content delivery and security (processor)
SimplePay Zrt. (formerly OTP Mobil Kft.): processing online card payments; it handles payment data as an independent controller. Data shared: name, e-mail, billing address, order number, amount. 1138 Budapest, Váci út 135–139. B. ép. 5. em., tax number: 32835155-2-44, ugyfelszolgalat@simple.hu. Its privacy notice: simplepay.hu/vasarlo-aff
KBOSS.hu Kft. (Számlázz.hu): 1031 Budapest, Záhony utca 7., issuing and keeping invoices (processor)
Courier: GLS General Logistics Systems Hungary Csomag-Logisztikai Kft., 2351 Alsónémedi, GLS Európa u. 2., info@gls-hungary.com; the Customer's name, address, phone number and e-mail, for delivering the parcel
E-mail delivery: Brevo (Sendinblue SAS), 106 boulevard Haussmann, 75008 Paris, France; sending system e-mails (confirmations, mock-ups)
Newsletter: Brevo (Sendinblue SAS), 106 boulevard Haussmann, 75008 Paris, France; sending the newsletter
Google Ireland Ltd.: Gordon House, Barrow Street, Dublin 4, Ireland; statistics and ad measurement, only with consent

6. Transfers outside the EU

Some processing by Google and Cloudflare may involve the United States. These companies participate in the EU–US Data Privacy Framework, for which the European Commission has adopted an adequacy decision; where it does not apply, transfers rely on the European Commission's standard contractual clauses.

7. Your rights

Information and access (Article 15): you can ask what data we hold about you and request a copy.
Rectification (Article 16): you can ask us to correct inaccurate data. You can also correct your profile details yourself in your Account.
Erasure (Article 17): you can ask us to erase your data, unless the law requires us to keep it (e.g. invoices).
Restriction (Article 18): you can ask us to only store the data for the time being.
Portability (Article 20): you can request the data you provided in a machine-readable format (e.g. JSON, CSV).
Objection (Article 21): you can object to processing based on legitimate interest, and to direct marketing at any time.
Withdrawing consent: at any time; this does not affect the lawfulness of processing before withdrawal.

Send your request to support@taptap.hu. Once we have identified you, we reply without undue delay and within one month at the latest; where justified this can be extended by two further months, and we will tell you. Information is free of charge.

8. Data security and breaches

Data is transmitted over an encrypted connection (HTTPS), passwords are stored encrypted, access is limited to the people who need it, and we make regular backups. If a personal data breach poses a risk, we report it to the Hungarian National Authority for Data Protection and Freedom of Information within 72 hours; if the risk is high, we also notify you without delay.

9. Remedies

If you feel your data is not handled lawfully, please contact us first so we can put it right. You can lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH):

Address: 1055 Budapest, Falk Miksa utca 9–11.
Postal address: 1363 Budapest, Pf. 9.
Phone: +36 1 391 1400
E-mail, web: ugyfelszolgalat@naih.hu, naih.hu

If your rights are infringed you can also go to court; you can bring the case before the regional court of your place of residence or stay.

10. Other provisions

People under 16 may use the profile and the webshop only with the consent of their legal guardian. We update this notice as things change, and we notify account holders of material changes by e-mail.

Previous version: privacy notice in force from 26 June 2023 (archive).