WHO DECIDES WHAT
You stay in charge. We do the work.
Under the GDPR, your customer list is your responsibility (you are the “controller”), and TapStik handles it for you (we are the “processor”). In short:
You, the café
- It is your customer list: you decide what it is used for
- You choose who on your team can see it
- You accept the Data Processing Agreement (DPA) when you sign up
- Customers can download or delete their own data in My cards. For any other request, we help you answer it on time
TapStik
- We store the list for you and run the card
- We only use it on your instructions, never for ads, never sold
- We help with deletion and download requests
- We tell you about a data breach without delay, aiming within 48 hours
IN PLAIN WORDS
What we do, and what it means for you.
- Consent
Offers only with a clear yes
WhatsApp and email offers go only to customers who tick a separate box. It is never ticked for them, and they must be 16 or older. We keep the exact words they saw and when they agreed.
For you: You can show proof of consent if anyone asks.
- Withdraw
Stop offers in one tap
Every email has an unsubscribe link, and customers can switch offers off for your café in My cards. Their card and stickers stay.
For you: Someone who says stop is not messaged by mistake.
- Rights
Customers hold the keys
In My cards a customer can download their data and delete a card or their whole account themselves.
For you: Most privacy requests never reach you.
- Retention
Old data goes by itself
A card that hasn’t been used for 24 months is deleted automatically. Our nightly backups are kept for 30 days.
For you: You don’t keep customer data longer than needed.
- Notes
No health notes in staff notes
Staff can save a usual order like “oat milk”. The staff screen warns them, and won’t save a note that looks like health information.
For you: Health details are sensitive under the GDPR. This keeps them out of your list.
- Cookies
Essential cookies only
Just what keeps people signed in and remembers their language. No ads, no tracking, no third-party analytics.
For you: There is no tracking to explain to your customers.
- Language
Dutch for your customers
The join page, the card, My cards, our emails and the privacy notice are in Dutch for customers in the Netherlands. English everywhere else for now.
For you: Your Dutch customers read everything in their own language.
- Breach
A plan for when it goes wrong
A written breach procedure and a log. If something happens to your customers’ data, we tell you quickly.
For you: You can meet your own 72-hour duty to tell the authority.
WHAT WE DON’T COLLECT
We count visits, not spending.
- What each customer spends. TapStik counts visits and stickers only.
- Your customers’ payment details. No payments go through TapStik.
- Advertising or tracking data.
The “Is it paying off?” box uses an average bill that you type in yourself. It is optional, and only you see it.
SERVICES WE USE
No hiding where it goes.
Honest part: the servers are in the United States, not in the EU. That is allowed for these providers under the EU–US Data Privacy Framework, and EU hosting is something we can add later. Until then we don’t say “EU-hosted”. The full list is on the services page (sub-processors).
DOCUMENTS
Everything in writing.
Read them before you sign up. You accept the Terms and the Data Processing Agreement (DPA) with one tick when you create your account.
- Terms for cafésThe agreement between you and TapStik: pilot, your account, what we do and don’t promise. Dutch law.Current
- Data Processing Agreement (DPA)The GDPR Article 28 contract for your customer list, with the Standard Contractual Clauses.Current
- Privacy noticeWhat your customers are told: what we keep, why, for how long, and their rights.Dutch + English
- Services we useEvery service that touches your data (the legal word is “sub-processors”), what it does and where it is.Current
- Cookie listEvery cookie we set, what it does and how long it lasts.Current
The Terms and the DPA are in English. We also keep a register of our processing and a breach procedure; ask us if you want to see them.
QUESTIONS
Quick answers
Do I have to sign a Data Processing Agreement?
Yes, and it’s built in. When you sign up as a café in the EU you accept the Terms and the Data Processing Agreement (DPA) with one tick. We store which version you accepted and when.
Who is responsible for my customers’ data?
You are the controller, TapStik is your processor. The customer’s own “My cards” account is the one exception: there TapStik is responsible, and the privacy notice says so.
Where is the data stored?
On Vercel’s servers in the United States, under the EU–US Data Privacy Framework, and our engineers in Indonesia can reach it for support. It’s all listed above. We don’t claim EU hosting, because we don’t have it yet.
What if a customer asks to delete their data?
They can do it themselves in My cards, or ask you. You can also delete a customer from your dashboard.
Is this legal advice?
No. These pages describe what TapStik does and give you the documents. Check with your own adviser what your café needs to do under the GDPR.
Questions about your data?
Write to us and we’ll answer in plain words.