Privacy notice
Version eu-2026-10-v1 · last updated 24 October 2026
This notice is for customers of cafés that use TapStik in the EU. It says what is kept about you, why, for how long, and what you can do.
Who is responsible
- Your card at a café: the café is responsible. TapStik stores and handles your data for the café, on its instructions.
- Your TapStik account (“My cards”): TapStik is responsible. TapStik is a trade name of Indus Selection (sole proprietorship), Violethof 5, 5044 KM Tilburg, the Netherlands, KVK 42199635. Contact: info@tapstik.eu.
What we keep, and why
| What | Data | Why (legal basis) |
|---|---|---|
| Your card at the café | Name, email, phone number (optional), your stickers and rewards, when you visited, the language you use. | To run your card and give your rewards (contract). |
| Your usual order | What you tell us you had, and a short note the staff may save (for example “oat milk”). | So the café can look after you better (the café’s legitimate interest). Staff are asked not to save health information. |
| Offers | Your choice to receive offers by WhatsApp or email, the exact words you saw, and when you agreed or stopped. | Only if you tick the box (16+). You can stop at any time (consent). |
| Your TapStik account (“My cards”) | Name, email, phone number (optional), Google account ID if you use Google, and the list of your cards. | So all your cards show in one place and joining another café takes one tap (contract). TapStik is responsible for this part. |
| Keeping the service safe | Technical logs, sign-in attempts and the sign-in links we email. | To protect the service and your cards (our legitimate interest). |
We do not sell your data and we do not use it for advertising.
Offers
The box for offers is separate from joining and is never ticked for you. You must be 16 or older to tick it. Every email has an unsubscribe link, and you can switch offers off for each café in My cards. Switching offers off never changes your card or stickers.
Who else sees it
The café's owner and the staff signed in at its counter can see your name, your card and your usual order (staff see only part of your phone number). Other cafés cannot see your cards. TapStik uses a few service providers, listed on the sub-processors page. Some are in the United States and rely on the EU–US Data Privacy Framework. TapStik's team works from Indonesia and can reach the data for support and backups; for that we rely on the EU Standard Contractual Clauses.
How long we keep it
We keep your card while you use it, and delete it 24 months after your last visit. If a café stops using TapStik, it can export its list, and we delete its data 30 days after. Backups are removed after 30 days.
Your rights
You can ask to see your data, correct it, delete it, limit how it is used, receive a copy, object to it, and withdraw consent at any time. In My cards you can download your data and delete a card or your account yourself. Or ask your café, or email info@tapstik.eu with “Privacy request” in the subject; we reply within one month. You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to the authority in your own country.
Cookies
Only essential cookies, to keep you signed in and remember your language. See the cookie list. No advertising or tracking cookies.
Changes
If this notice changes in a way that matters, the version and date above change too.