Privacy policy

1. Who is the controller of your data

The controller of your personal data is TagTracks Sp. z o.o., registered in Wrocław, Poland, ul. Dyrekcyjna 1/142, 50-528 Wrocław, entered in the register of entrepreneurs of the Polish National Court Register kept by the District Court for Wrocław-Fabryczna in Wrocław, 6th Commercial Division of the National Court Register under number KRS 0001226710, tax ID (NIP) 8993052175, statistical number (REGON) 544177480, share capital PLN 5,000.00 (hereinafter: “TagTracks” or “we”).

For any matter concerning personal data, write to maciej.janiszek@tagtracks.net or to the registered address above.

We have not appointed a data protection officer - we are not required to. Data matters are handled directly by the management board.

2. What data we collect and where it comes from

We only collect the data you provide to us, plus basic technical data:

• Contact form - your name and e-mail address (required fields), as well as company name, phone number, enquiry subject and message content if you choose to provide them.
• TagTracks business card - the data the card owner enters when activating and editing the business card: full name (required), job title, company, phone number, the e-mail address shown on the card, website and LinkedIn profile addresses, and the sign-in e-mail address (required, not visible to others).
• People the owner shows the business card to - we collect no data about them other than the technical data needed to display the page. Visit statistics are not collected on business card pages.
• Direct contact - the data you share with us by e-mail or over the phone.
• Technical data - IP address, browser and device type and aggregate visit statistics, collected automatically by the server and by our analytics tool.

Providing data is voluntary, but without your name and e-mail address we cannot reply to an enquiry sent through the form, and without a full name and a sign-in e-mail address a business card cannot be activated.

3. Why we process your data and on what basis

• Replying to your enquiry, preparing a quote or samples and conducting business correspondence - Art. 6(1)(b) GDPR (steps taken prior to entering into a contract) and Art. 6(1)(f) GDPR (our legitimate interest in conducting business correspondence) where you write on behalf of a company.
• Fulfilling an order and performing a concluded contract - Art. 6(1)(b) GDPR.
• Providing the TagTracks business card service - storing and publicly displaying the data the owner has put on the business card and sending sign-in links - Art. 6(1)(b) GDPR (the business card service agreement, concluded by accepting the terms when activating the card).
• Protecting business cards against abuse, i.e. limits on activation and sign-in attempts based on IP address and e-mail address - Art. 6(1)(f) GDPR.
• Issuing and storing accounting documents - Art. 6(1)(c) GDPR (tax and accounting obligations).
• Establishing, pursuing or defending against claims - Art. 6(1)(f) GDPR.
• Keeping the website secure and maintaining anonymous visit statistics - Art. 6(1)(f) GDPR.

We do not send a newsletter or bulk marketing messages. Should that ever change, we will ask for your separate consent beforehand.

4. How long we keep your data

• Correspondence from the form and from e-mail - for as long as the matter is being handled, and then for up to 3 years, which is the limitation period for business claims under Polish law.
• Data relating to a concluded contract and accounting documents - 5 years from the end of the calendar year in which the tax obligation arose.
• Business card data and the sign-in e-mail address - until the owner deletes the business card, the card is reset at the owner's request or the service ends. Deleting the business card removes this data from the database immediately.
• Technical security data for business cards - activation and sign-in attempt counters for up to 15 minutes, one-time sign-in links for up to one day, the signed-in owner's session for up to 30 days.
• Visit statistics - in aggregate form only, with no way of linking them to an individual.

5. Who we entrust your data to

Your data is shared only with entities that process it on our behalf under a data processing agreement and, when goods or samples are shipped, with the carrier:

• Vercel Inc. (USA) - hosting of tagtracks.net, including the business card pages, and technical handling of the contact form.
• Plus Five Five, Inc. - Resend (USA) - delivery of form messages to our mailbox and of business card sign-in links.
• Neon, Inc. (USA) - database for the TagTracks business card service. The data is stored on servers in the European Union (Frankfurt).
• Google Ireland Ltd. - company e-mail, where correspondence is stored.
• Our accounting office and IT service providers - to the extent necessary to perform the contract and maintain our systems.
• Courier companies and postal operators, in particular InPost S.A. - the recipient's address details needed to deliver an order or samples. In this respect the carrier is a separate data controller and processes the data under its own privacy policy.

We do not use a CRM system or any other tool that builds a contact database beyond our company e-mail. We use the business card database solely to provide that service - we do not send marketing from it. We do not sell your data and do not share it with third parties for marketing purposes. We may disclose it to public authorities only where required by law.

6. Transfers outside the European Economic Area

Some of our technical providers (Vercel, Resend, Neon) are based in the United States. Data is transferred to them on the basis of standard contractual clauses approved by the European Commission or on the basis of an adequacy decision (Data Privacy Framework). Business card data is stored in the European Union, but we apply the same safeguards to the database provider as well.

We will provide a copy of the safeguards on request - write to maciej.janiszek@tagtracks.net.

7. Your rights

In connection with the processing of your data you have the right to:

• access your data and obtain a copy of it,
• rectify data that is inaccurate or incomplete,
• erase your data (“the right to be forgotten”) where we have no grounds for further processing,
• restrict processing,
• data portability - for data processed on the basis of a contract or consent,
• object to processing based on our legitimate interest (Art. 21 GDPR),
• withdraw consent at any time where processing is based on it; withdrawal does not affect the lawfulness of processing carried out before it.

To exercise any of these rights, write to maciej.janiszek@tagtracks.net. We respond without undue delay and no later than one month from receiving your request. A business card owner can also correct or delete their data at any time themselves - via the “Edit business card” link on the card page.

8. Complaint to the supervisory authority

If you believe we process your data unlawfully, you may lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland (uodo.gov.pl). We would, however, appreciate it if you contacted us first - most issues can be resolved straight away.

9. Cookies and visit statistics

tagtracks.net does not use cookies for tracking or for advertising profiling. We do not use Google Analytics or advertising network pixels.

Visit statistics are collected with Vercel Web Analytics. The tool does not store cookies, does not create a persistent user identifier and does not allow us - or anyone else - to identify an individual. Only aggregate traffic is counted: page views, referral source, country and device type.

The one exception is the TagTracks business card service: when a card owner signs in, we store a single technical session cookie, valid for up to 30 days and used only on business card pages. It is strictly necessary for the owner to edit their business card, so it does not require consent. Signing out or deleting the business card ends the session. No cookies are stored for people viewing a business card.

That is why the site displays no cookie consent banner - there is no consent to ask for. Technical data required to serve the page, such as the IP address in server logs, is processed on the basis of our legitimate interest in keeping the site secure and stable.

10. Profiling and automated decisions

We do not profile users and do not make decisions about them based solely on automated processing that would produce legal effects or similarly significantly affect them.

11. Changes to this policy

We update this policy whenever the way we process data or the list of our providers changes. The current version is always available at this address, and the date of the last change is shown at the top of the page.