Privacy & legal texts

A card needs a name and an email address, nothing more. The birthday is optional and only used for the birthday greeting. There are no fields for address, phone number or interests.

Card updates such as the stamp balance or “reward available” are transactional and need no consent. Marketing (a birthday greeting or offers, for example) requires separate, voluntary opt-in consent.

The terms of participation and marketing consent are two separate checkboxes, and the marketing checkbox starts empty. Every grant and every withdrawal of consent is logged.

tapja runs on servers in the EU. A data processing agreement (DPA), including the list of service providers, is available on request.

If a guest wants to be deleted, you delete them directly in their profile. Figures in analytics remain, but without personal data; log entries are anonymised.

Entries in the activity log are deleted after 18 months. You can export your customer data as CSV on every plan.

For your program, tapja provides fillable templates for the terms of participation and the privacy notice. They are not legal advice. Every card carries the version the guest agreed to.

tapja’s own legal texts (privacy policy, legal notice, terms) are on tapja.de and linked in the footer of the public pages and at sign-in.