Why GDPR applies to digital business cards
When someone taps your card, the system may log the time, device type and, if they fill in a lead form, name, email and phone. All of this is personal data. Your business is the data controller, and the card platform provider is the data processor.
Five questions to ask your provider
- Where is data stored? Inside the EU/EEA is simplest. US storage requires an additional transfer mechanism.
- Is technical data anonymised? IP addresses are personal data. Ask whether they're stored in plain text or hashed.
- Is there a Data Processing Agreement (DPA)? GDPR requires a written agreement between you and the provider.
- Can data be deleted? The right to erasure covers both your employees and leads who left their info.
- Is data shared with third parties? Ad-network tracking on your profile pages is a red flag.
🔒 How TactusWay does it: Data is stored in the EU, IP addresses are hashed (SHA-256) before storage, no third-party tracking cookies on profile pages, and both employees and leads can be permanently deleted from the dashboard.
Lead forms and consent
When a visitor leaves their contact info in a lead form, they're actively handing over their details, a solid legal basis. But remember: use the data for what the visitor expects (following up the conversation), not for newsletters without separate consent.
Employee profiles: what should they contain?
The profile shows name, title, photo and contact info, information the employee chooses to share professionally. Best practice: let employees edit their own profile, and deactivate it when someone leaves. In TactusWay the latter happens automatically when you deactivate the employee, their card stops working the same second.
Checklist for GDPR-safe use
- Choose a provider with EU storage and a DPA
- Update your privacy policy: name the card platform as a processor
- Use lead data only for expected follow-up
- Delete profiles and leads when no longer needed
- Don't attach ad tracking to profile pages