Privacy notice
This explains what personal data Cardzee collects, why, how long we keep it, who else handles it, and your rights. We've kept it in plain English. If anything is unclear, ask us.
Who we are
Cardzee is a trading name of Whinco Group Limited, a company registered in England and Wales (company number 16534674), registered office 41 Truro Close, Hull, HU7 4XQ, United Kingdom. We are the data controller for the personal data described here.
Contact us about anything in this notice:
- Email: cardzeesupport@gmail.com
- WhatsApp: 07546 287704
We are registered with the Information Commissioner's Office (ICO). Registration number: ZC289230.
The short version
- We collect only what's needed to make your card work, let you manage it, and make your printed card.
- When someone taps a card, we record that a tap happened, the type of phone and a rough location. We don't record IP addresses or anything that identifies the person tapping.
- We don't sell data, don't use advertising or tracking tools, and don't send marketing emails.
- You can download or delete everything from your dashboard at any time.
If you own a card
| What we collect | Why | Lawful basis |
|---|---|---|
| Email address | Your login, the setup and password codes, and messages about your card and printed card. | Contract |
| Password (stored only as a scrambled, one-way hash) | So you can log in from any device. | Contract |
| Name (optional) | Shown on your account and, if you choose, your contact card. | Contract |
| What your card does: your chosen destination and the phone number, WhatsApp number or web link it needs | To make your card work. Whatever you choose here is shown to anyone who taps your card. | Contract |
| Printed card brief: name, title or company, logo, card colour, and your postal address if we post it | To design, print and deliver your printed card. | Contract |
| Tap history for your card (see below) | To show you how your card is being used. | Legitimate interests |
| Login records: when you logged in, your browser type, and failed login attempts | To keep accounts secure and stop people guessing passwords. | Legitimate interests |
| Messages you send us | To help you and handle any complaint. | Legitimate interests |
"Contract" means we need it to provide what you bought. If you don't give it, we can't set up your card. "Legitimate interests" means it's needed to run the service well, and we've checked it doesn't override your interests or rights.
We don't use your data for automated decisions about you, and we don't build profiles.
If you pre-order on our website
We collect your email, your card design (name, title or company, logos and choices), the number of cards, and the delivery name and address you give at checkout. We use them to make and post your card, send your receipt and updates, and handle refunds. Lawful basis: contract. Payment is handled by Stripe: your card details go straight to Stripe and we never see or store them. Unpaid checkouts are deleted after 7 days.
If you ask about a bulk order
When you fill in our bulk order form we collect your name, business name, email, phone number (if you give it), how many cards you need and your message. We use them only to reply to you and give you a price. Lawful basis: legitimate interests (answering a request you sent us), or steps before a contract if you go on to order. We delete enquiries after 2 years.
If you tap someone's card
A Cardzee card contains a web link. When you hold it to your phone, your phone opens that link on our server, and we send you on to wherever the card owner has chosen: their contact card, their WhatsApp, or a website.
When that happens we record:
- the date and time of the tap,
- the type of phone (iPhone, Android or other), worked out from the information your browser sends, and
- an approximate country and city, estimated by our hosting provider from your network connection.
We don't record your IP address, name, phone number, or anything else that identifies you, and we don't put cookies on your phone. The card owner sees the tap in their dashboard, for example "iPhone near Hull, 14:02". We do this on the basis of legitimate interests: the card owner wants to know their card is being used, and the information can't reasonably identify you.
What happens after you're sent on (for example, in WhatsApp or on a website) is covered by that service's own privacy notice. If you save a contact card, it goes into your phone's contacts, not to us.
How long we keep it
| Data | Kept for |
|---|---|
| Your account, card settings and printed card brief | Until you delete your account. Deleting it removes them straight away. |
| Tap history | 24 months, then deleted automatically. Deleted straight away if you delete your account. |
| Setup and password codes | 10 minutes to use, then deleted within a day. |
| Login sessions | 90 days, or until you log out. |
| Failed login records | 24 hours. |
| Messages and complaints | Up to 2 years after they're resolved. |
| Unpaid pre-order checkouts | 7 days. |
| Bulk order enquiries | 2 years. |
| Sales records (what you bought and paid) | 6 years, because UK tax law requires it. |
When an account is deleted, its card is switched off so nobody else can take it over.
Who else handles your data
We use a small number of trusted providers to run Cardzee. They process data only on our instructions, under contracts that require them to keep it secure.
- Cloudflare, Inc. hosts the website and database. Our database is stored in the European Union.
- Google LLC (Gmail) delivers our emails: setup codes, password reset codes and updates about your card.
- Our card printer receives the name, title, company and logo for your printed card. If we post it, the delivery company receives your name and address.
We don't sell or rent personal data and we don't share it for advertising. We'd share it with others only if the law required us to.
Data outside the UK
Our database is stored in the EU, which the UK recognises as giving adequate protection. Cloudflare and Google are US companies and may process some data in the US. Both are certified under the UK Extension to the EU–US Data Privacy Framework, and also use the UK International Data Transfer Addendum, so your data stays protected to UK standards.
Cookies
We use one cookie, and only after you log in: it keeps you logged in to your dashboard. It's strictly necessary, so it doesn't need your consent. We don't use analytics, advertising or tracking cookies, and people who tap a card get no cookies at all. Our fonts are stored on our own server, so loading a page doesn't contact Google or anyone else.
When you go to pay for a pre-order, the payment form is loaded from Stripe inside our page. Stripe may set its own cookies there to keep the payment secure and prevent fraud. These are strictly necessary for paying, and only load at that step.
How we keep it safe
- Everything is sent over an encrypted (HTTPS) connection.
- Passwords are stored only as a one-way hash, so even we can't read them.
- Card links are long and random, so they can't be guessed.
- Login codes expire after 10 minutes and are locked after 5 wrong tries. Repeated wrong passwords are blocked.
- Only we can access the admin tools.
If something ever goes wrong and your data is put at risk, we'll tell the ICO within 72 hours where the law requires it, and we'll tell you if there's a high risk to you.
Your rights
Under UK data protection law you have the right to:
- See your data. Download it any time from Settings → Export my data, or ask us.
- Correct it. Most of it you can change yourself in the dashboard.
- Delete it. Settings → Delete my account removes it straight away.
- Object to anything we do on the basis of legitimate interests, such as tap history.
- Restrict how we use it while a concern is looked into.
- Take it with you. The export is a standard machine-readable file.
Anyone, including people who have tapped a card, can use these rights by contacting us. It's free, and we'll reply within one month.
Complaints
If you're unhappy with how we've handled your personal data, please tell us first. Email cardzeesupport@gmail.com or WhatsApp 07546 287704 with "Data complaint" and what happened.
We'll acknowledge your complaint within 30 days (usually within 2 working days), look into it properly, keep you updated, and tell you the outcome without undue delay.
You can also complain to the Information Commissioner's Office at any time: ico.org.uk/make-a-complaint, or call 0303 123 1113.
Children
Cardzee is a business product for adults. You must be 18 or over to buy and set up a card.
Changes to this notice
If we change this notice, we'll update the date at the top. If a change affects how we use your data in a way that matters, we'll email card owners before it takes effect.