Privacy policy

We handle personal data in two different capacities, and the rest of this policy only covers one of them.

We are the controller — we decide how and why data is used — for people who hold a TAPPI account and their staff, visitors to this website, people who contact us or ask for a demo, applicants to and members of the TAPPI Partners programme, businesses we approach about TAPPI, people whose details we need to ship hardware, and anyone whose actions appear in our security logs. This policy covers all of them.

We are a processor for the customers of the businesses that use TAPPI. If you joined a café's loyalty card, topped up a prepaid balance, bought or redeemed a gift card, or left feedback after tapping a TAPPI chip, that business is the controller of your data, not us. We process it only on that business's instructions, under a data processing agreement. Its own privacy notice applies — you will find a link to it on the page where you signed up, along with the business's name and contact details.

Send requests about that data to the business. If you write to us instead, we will pass your request on without undue delay and help the business answer it.

Two things we never do: TAPPI does not market to a business's customers on its own behalf, and we never combine one business's customer data with another's. We do produce anonymised aggregate statistics — average scans per location, that kind of thing — which identify nobody.

We have weighed our interests against yours in each case:

• Security, fraud prevention and audit logs. We and our clients need a platform that resists abuse and lets us reconstruct what happened. You would expect this. Access is limited to authorised personnel and every access is logged.
• Error monitoring and bot protection. Needed to keep the site working. We use the settings that collect the least.
• Replying to enquiries and crediting partners. You asked us to get in touch, or arrived through a partner and accepted the referral cookie; a referral code is a short identifier, and the partner sees your business’s name and status, never your contact details.
• Business-to-business outreach. We use business contact details and public business information, contact people in their professional role, say who we are in every message, and stop when asked. The use of AI to draft is the part you might not expect, which is why it is in section 2.5 rather than buried.
• Product improvement. We look at how accounts use features. We do not look at our clients' customers' personal data to do it.

In each case we concluded our interest is not overridden by your rights. You can object to any of it — see section 6.

We do not sell personal data. We share it with service providers who run parts of TAPPI for us, under contracts that require them to protect it and use it only on our instructions. The full list, what each one does and where it processes, is published at /legal/subprocessors and kept current.

Otherwise, only where it is needed:

• professional advisers — lawyers, accountants, auditors — under a duty of confidentiality;
• the police, regulators, courts or tax authorities where the law requires it;
• a buyer or investor, if we sell or restructure the business, under confidentiality terms;
• the business you work for or represent, for data held in its account;
• the TAPPI Partner who referred your business: its name, when it signed up and whether it became a paying customer.

Our own people. Only authorised personnel who need access, bound by confidentiality. When we support a business, that access is read-only, protected by multi-factor authentication with a step-up check on every page that shows data, and every view is written to an append-only log.

Your account data lives in the EU. Our database is hosted in Ireland and our application functions run in Dublin. Some providers in the list at /legal/subprocessors process outside the UK and EEA; each entry names where, and the safeguard we rely on — UK or EU adequacy (including the Data Privacy Framework where a provider is certified), or the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

Ask us at hello@thetappi.com for the specific mechanism covering any provider on the list.

Our measures are set out in full on our security page. In summary:

• encryption in transit (HTTPS/TLS) across the website, apps and APIs, and encryption at rest by our database host;
• database-level isolation between businesses, enforced by row-level security and checked by automated cross-tenant tests;
• hashed API keys and passwords;
• rate limiting on public endpoints, and protection against server-side request forgery on outbound requests;
• multi-factor authentication, read-only access and an append-only audit log on our internal support tools;
• access limited to authorised personnel who need it.

No system is completely secure. If a breach is likely to put your rights at risk we will tell the ICO within 72 hours where required, and tell you without undue delay where the law requires it. To report a security issue, see our security page or write to hello@thetappi.com.

You have the right to:

• access a copy of your personal data;
• correct data that is wrong or incomplete;
• erase your data, in some circumstances;
• restrict how we use it, in some circumstances;
• object to processing based on legitimate interests, and to direct marketing at any time;
• portability, for data you gave us under a contract or by consent;
• withdraw consent at any time, without affecting what we did before;
• not be subject to a decision based solely on automated processing with legal or similarly significant effects. We do not make such decisions.

Write to hello@thetappi.com. We may need to check your identity. We reply within one month, extendable by up to two more for complex requests — we will tell you if that happens.

Account holders can also delete their own user profile from account settings, and an owner can close the whole business account from the dashboard, with a 30-day window to change their mind.

If you are a customer of a business that uses TAPPI, contact that business — see section 1. Businesses on TAPPI have built-in tools to export, correct, restrict and erase your record, so they can answer you without waiting on us.

Give us the chance to fix it first: hello@thetappi.com. We will acknowledge your complaint and respond.

You can also complain to the UK Information Commissioner's Office at ico.org.uk. If you live in the EEA you can complain to the data protection authority where you live or work — in Spain, the Agencia Española de Protección de Datos at aepd.es.

Our website and business services are for adults acting for a business. We do not knowingly collect data from children through them. The consumer features businesses run on TAPPI — loyalty cards, prepaid balance, gift cards — are intended for people aged 14 and over, and it is for the business running the programme to decide whether and how to verify that.

We will post any new version here with a new date. If a change is significant we will tell account holders by email before it takes effect.