1. Who we are
MezaTap is a sole proprietorship (eenmanszaak) registered with the Netherlands Chamber of Commerce (KVK) under number 42086035, VAT number NL005484324B92. You can reach us about privacy at info@mezatap.com. This policy explains how we handle personal data within the meaning of the General Data Protection Regulation (GDPR).
2. Our two roles
| Whose data | Examples | Role of MezaTap |
|---|---|---|
| Shops, their owners and staff | account, login, billing | Controller |
| Website visitors | technical data, security checks | Controller |
| Card holders (guests of a shop) | name, stamps, rewards | Processor for the shop |
When we act as processor, we process data only on the documented instructions of the shop under our Data Processing Agreement. The shop decides which data it collects and what it uses it for.
3. Shops and their team
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Business name, contact email, phone number (optional), language | Creating and managing the account, service messages | Contract | While the account exists, deleted within 14 days after account deletion |
| Name and email of owners and staff, role, invitations | Access to the dashboard and scan page | Contract | Same as above |
| Password (stored only as a secure hash), sessions with IP address and browser type, login attempts | Securing accounts and preventing abuse | Legitimate interest (security) | Sessions up to 7 days, security logs up to 12 months |
| Plan, payment status, Mollie customer and subscription references, invoices | Billing and accounting | Contract and legal obligation | Invoice data 7 years (Dutch tax law) |
| Support messages | Answering questions | Contract and legitimate interest | Up to 24 months after the last contact |
| Audit log of important actions in the dashboard | Security, accountability, resolving disputes | Legitimate interest | Up to 12 months |
| Delivery status of emails we send | Making sure important emails arrive | Legitimate interest | Up to 12 months |
We never receive or store full payment card or bank details. Those are entered with and processed by Mollie.
If you sign in with Google, we receive your name, email address, and Google account identifier from Google, only to log you in.
4. Card holders
We process this data on behalf of the shop whose card you saved. The shop is the controller.
- Details you enter when joining: first name, email address, and/or phone number, depending on what the shop asks for. These fields are optional unless the shop requires them.
- Loyalty activity: number of stamps, rewards earned and redeemed, the date and time of each stamp and reward, the location and staff account that recorded it.
- Consent record: the time you agreed, the text you agreed to, and the IP address used, so the shop can demonstrate consent.
- Card data: technical identifiers of your card, the wallet type, and for Apple Wallet a device push token so the card can update. We do not see the rest of your wallet or phone.
- Details the shop adds: for example a date of birth for a birthday reward, tags, or notes, if the shop chooses to add them.
- Web card: if you use the web card, a link to your card is stored in your own browser so you can reopen it.
We do not process payment card data of card holders and we do not track your location.
Your data remains stored for as long as the shop keeps its programme and your card. If the shop deletes you as a card holder or closes its account, your data is deleted within 14 days, and from backups within 30 days after that.
For questions or to exercise your rights, contact the shop first. You may also email us and we will forward your request to the shop and help it respond.
5. Website visitors
- Technical data: IP address, browser type, and the pages requested, in server logs, to operate and secure the website. Kept up to 12 months.
- Security checks: sign-up, login, and join forms use Cloudflare Turnstile to block bots. Turnstile processes technical signals from your browser for this purpose only.
- Error reports: if a page crashes, we may receive a technical error report through Sentry. These reports are configured not to include names or email addresses.
- Preferences: your language choice and whether you accepted or rejected optional cookies are stored in your browser. See our Cookie Policy.
- Optional ad measurement: if you accept cookies, Meta and TikTok may receive technical data about the visit, such as the page address and that a shop account was created. If you reject, or you have not chosen, we do not load those pixels.
- Campaign link: if the address you opened contains utm_source or utm_campaign, we store those two values in your browser and, when you create a shop, on that shop account.
The legal basis for technical logs, security checks, and error reports is our legitimate interest in a working and secure website. Optional pixels are used only with your consent. Campaign parameters are stored on the basis of our legitimate interest in knowing which of our own ads led to a new shop, limited to the source and the campaign name.
6. Messages and notifications
6.1 We send service emails to shops, such as account verification, password reset, security alerts, and billing notices. These are part of the service and cannot be turned off while the account exists.
6.2 Card holders may receive card updates and messages from the shop, for example when a stamp is added, a reward is ready, or through a campaign or automation set up by the shop. These are sent by or on behalf of the shop. You can stop them at any time through the unsubscribe link in an email, by turning off notifications for the card in your wallet, or by removing the card.
6.3 Whether a wallet notification is shown depends on Apple, Google, your device, and your settings.
7. Location data
- We use the addresses of the shop's locations to show them on the join page and on the card. Addresses may be converted into map coordinates using OpenStreetMap's geocoding service.
- When staff stamp a card, the scan page may ask the browser for the location of the staff member's device. If allowed, the approximate coordinates are stored with the stamp so the shop can detect fraudulent stamps. Staff can refuse; stamping still works.
- We never track the location of card holders.
8. Who receives data
We share data only with suppliers that need it to provide the Service, under agreements that oblige them to protect it. We never sell personal data.
| Supplier | Purpose | Location |
|---|---|---|
| Hosting provider | Servers and database | European Economic Area |
| Mollie B.V. | Payments of paid plans | Netherlands |
| Resend, Inc. | Delivery of emails | United States |
| Cloudflare, Inc. | Bot protection (Turnstile) | Global network |
| Functional Software, Inc. (Sentry) | Error monitoring | United States |
| Apple Inc. | Apple Wallet card delivery and updates | United States |
| Google LLC | Google Wallet cards, and Google sign-in if you use it | United States |
| OpenStreetMap Foundation (Nominatim) | Converting shop addresses to coordinates | United Kingdom |
| Meta Platforms, Inc. | Optional advertising pixel, only after you accept cookies | United States |
| TikTok | Optional advertising pixel, only after you accept cookies | Singapore |
| Telegram | Internal alerts to our team, limited to business names | Outside the EEA |
We may also share data if we are required to by law or a court order, or to protect our rights in legal proceedings.
9. Transfers outside the EEA
Some suppliers are based outside the European Economic Area. We transfer personal data to them only if the European Commission has decided the country offers adequate protection (such as the United Kingdom, or the United States for companies certified under the EU-US Data Privacy Framework), or on the basis of the European Commission's Standard Contractual Clauses with additional measures where needed. You can request a copy of the relevant safeguards at info@mezatap.com.
10. Security
We protect data with measures appropriate to the risk, including encrypted connections (TLS), secure password hashing, two-factor authentication for our administrator accounts, role-based access for staff, rate limiting and bot protection on forms, signed wallet cards, logging of important actions, and restricted access to production systems. No system is perfectly secure. If a data breach occurs that poses a risk to you, we will act in accordance with the GDPR, including notifying the Dutch Data Protection Authority and, where required, the people affected.
11. Your rights
You have the right to access your data, to have it corrected or deleted, to restrict or object to its processing, and to receive it in a portable format. Where processing is based on consent, you may withdraw consent at any time without affecting earlier processing.
- Shops and staff: email info@mezatap.com, or use the settings in the dashboard.
- Card holders: contact the shop first, or email us and we will pass your request on and support the shop.
We respond within one month. We may ask you to verify your identity before we act on a request.
12. Children
The Service is intended for businesses. Shops that want to enrol card holders younger than 16 are responsible for obtaining any consent required from a parent or guardian.
13. Automated decision-making
We do not make decisions about you that are based solely on automated processing and that have legal or similarly significant effects.
14. Complaints
If you are unhappy with how we handle your data, please contact us first. You also have the right to lodge a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl) or the authority in your country.
15. Changes
We may update this policy when our Service or the law changes. We will inform shops of material changes by email or in the dashboard. The date at the top of this page shows when this version took effect.