Privacy Policy

1. Who we are

TapRev ("the controller") operates TapRev. Registered address: St. Julians - Portomaso - Malta. VAT status: Registration in progress. Business status: Business registration in progress. We are the data controller responsible for the personal data you provide when using this website.

2. What personal data we collect

We only collect the personal data necessary to provide our products and services:

• Order data — name, email, shipping address, billing country, phone number (if provided), and order history.
• Customization data — the business name, website/review link, logo, and design choice you provide for customized NFC cards.
• Account data — email and authentication details when you create an account or log in.
• Payment data — payment is processed by Stripe; we do not receive or store your full card details (see Section 5).
• Technical & usage data — IP address, browser type, device information, pages visited, and approximate location derived from your IP, collected via cookies and similar technologies (see Section 4).
• Communication data — the content of messages you send us (e.g. support emails and contact form submissions).

3. How and why we use your data

We process your personal data on the following lawful bases under the GDPR:

• To perform our contract with you (Art. 6(1)(b)) — processing your order, producing and shipping your customized product, and sending order confirmations and delivery updates.
• To comply with legal obligations (Art. 6(1)(c)) — keeping accounting and tax records, and responding to lawful requests.
• For our legitimate interests (Art. 6(1)(f)) — improving our website and products, analytics, fraud prevention, and customer support, provided these do not override your rights.
• With your consent (Art. 6(1)(a)) — for marketing emails and non-essential cookies. You may withdraw consent at any time without affecting prior processing.

4. Cookies

We use cookies and similar technologies to operate the site, remember your shopping cart, measure traffic, and (where you consent) deliver analytics and marketing.

• Essential cookies — required for the site and checkout to function; cannot be disabled.
• Analytics cookies — help us understand how visitors use the site; set only with your consent.
• Marketing cookies — used to measure the effectiveness of campaigns; set only with your consent.

You can manage or withdraw cookie consent via the banner on first visit or through your browser settings. Disabling non-essential cookies may limit some features.

5. Payment data

Payments are processed securely by Stripe. Your card details are encrypted and handled directly by Stripe; they never pass through or are stored on our servers. We receive only a payment status, a payment identifier, and (where necessary for accounting) the last digits of the card and the transaction reference. Stripe is a data controller in its own right for payment data — see Stripe's privacy policy for details.

6. Sharing & recipients

We share your personal data only with the following categories of recipients, to the extent necessary:

• Payment processor — Stripe, to process your payment.
• Shipping carriers — the carrier you select at checkout, to deliver your order (we share the name and shipping address provided).
• Email & hosting providers — to send transactional and marketing emails and to host this website.
• Analytics providers — to measure site usage, where you have consented.
• Authorities — where required by law, regulation, or legal process.

We do not sell your personal data to third parties.

7. International transfers

Some recipients (e.g. Stripe, analytics providers) may process data outside the EU/EEA. Where this occurs, we rely on appropriate safeguards such as Standard Contractual Clauses approved by the European Commission, or another lawful transfer mechanism, and only transfer data necessary for the service.

8. Data retention

We keep your personal data only for as long as necessary: order and accounting data is retained for the period required by applicable tax and accounting law; customization data is kept for the purpose of fulfilling and supporting your order; marketing data is kept until you opt out or object. When data is no longer needed, we delete it or anonymize it.

9. Your rights

Under the GDPR you have the following rights, subject to certain conditions:

• Access — to know what data we hold about you.
• Rectification — to correct inaccurate or incomplete data.
• Erasure — to request deletion of your data ("right to be forgotten").
• Restriction — to limit how we use your data in certain circumstances.
• Portability — to receive your data in a structured, machine-readable format and to transfer it to another provider.
• Objection — to object to processing based on legitimate interests or for direct marketing.
• Withdraw consent — where processing relies on your consent, you may withdraw it at any time.
• Lodge a complaint — with your national data protection authority, or the authority where the alleged infringement occurred.

To exercise any right, contact us at taprevshop@gmail.com. We will respond within one month, extendable by two months where requests are complex.

10. Children's data

Our products and website are intended for businesses and individuals aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

11. Security

We use appropriate technical and organizational measures (encryption in transit, access controls, and secure payment processing) to protect your data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. Changes to this policy

We may update this policy to reflect changes in our practices or the law. The "last updated" date above indicates when it was last revised. Material changes will be highlighted on the site.

13. Contact

For any privacy enquiry or to exercise your rights, contact us at taprevshop@gmail.com, or by post at St. Julians - Portomaso - Malta. If you are not satisfied with our response, you may complain to your data protection authority.