Data Processing Agreement
For venues whose customer data we hold on their behalf
Version 1.0, 24 August 2026. This forms part of your subscription and takes effect when you accept it at sign-up.
1. Why this exists
If you switch on the page that appears after someone taps one of your displays, and a customer of yours gives their email address to join your newsletter, that address is your data, not ours. In data protection terms you are the controller and we are your processor. UK GDPR requires that relationship to be written down. This is that document.
It applies only to personal data we hold on your behalf. How we handle our own data — your account, your enquiries — is in our Privacy Policy.
2. What we process, and why
Subject matter: running the tap-to-review service and the dashboard.
Duration: for as long as you have an account with us.
Categories of people: customers and visitors of your venue.
Personal data: email addresses given to join your newsletter, and the date and time each person agreed.
Nothing else is personal data. Taps are recorded as a count with a date, a display and a device type. We do not record IP addresses and we set no cookies, so a tap cannot be traced to a person by us, by you, or by anyone else.
3. We act only on your instructions
We process that data only to provide the service and only as you direct — showing it to you in your dashboard and letting you export it. We will not use it for our own purposes, we will not sell it, and we will never email your list ourselves.
4. Security
Data is held on servers in the EU, reached over encrypted connections. Access is limited to the people who run the service. Dashboard passwords are stored as one-way hashes we cannot read. Anyone with access is bound to keep it confidential.
5. Who else is involved
We use Hostinger for hosting and storage, and Stripe for payments. We will tell you before adding another sub-processor, and you may object.
6. Helping you meet your obligations
If one of your customers asks you for their data, or asks to be deleted, tell us and we will find it, export it or delete it. If we ever become aware of a breach affecting your data we will tell you without undue delay and give you what you need to report it. You can ask us at any time for the information needed to show you are meeting your own obligations.
7. When you leave
Export your list whenever you like — it is a button on your dashboard. If you close your account, tell us whether you want your data returned or deleted and we will do it within 30 days. If you tell us nothing, we delete it.
8. Outside the UK
We keep this data in the UK and the EU. If that ever has to change we will put the required safeguards in place first and tell you.
9. General
This agreement sits alongside our Terms & Payment. If anything here conflicts with those terms, this document wins for anything about personal data. It is governed by the law of England and Wales.
Questions: nfcdisplayco@gmail.com.