Data Processing Agreement

For any personal information submitted by your visitors or customers through your TapIt page (for example, through the Customer Data Collection or Tap Loyalty features), you act as the “Controller” — you determine why that information is collected and how it’s used. TapIt acts as the “Processor” — we process that information only to provide the Services, on your instructions.

As the Controller, you’re responsible for:

• determining the purposes for which personal information is collected through your page;
• providing any privacy notices required by applicable law;
• obtaining and managing any consents required from your customers;
• your own compliance with applicable privacy and marketing laws; and
• responding to requests from individuals about their own information (access, correction, deletion, or withdrawal of consent).

As the Processor, TapIt will:

• process personal information only to provide the Services, and only on your instructions;
• apply reasonable technical and organizational safeguards to protect it;
• restrict access to personal information to those who need it to operate the Services;
• keep personal information confidential;
• notify you of a confirmed security incident affecting your data without undue delay; and
• reasonably assist with lawful requests related to the personal information we process for you.

Depending on which features you use, this may include: names, email addresses, phone numbers, business names and addresses, account credentials, device identifiers, IP addresses, browser information, QR/NFC interaction data, page analytics, WiFi-portal information, content your customers submit through your page (e.g. contact-capture or loyalty sign-ups), and payment information handled by our third-party payment processor.

TapIt processes personal information to operate the platform: hosting your page, powering NFC/QR interactions, providing analytics, delivering customer support, maintaining security, and handling billing.

TapIt applies reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, loss, misuse, or disclosure, appropriate to the sensitivity of the information involved.

TapIt uses third-party service providers to help deliver the Services — for example, hosting, payment processing, email delivery, customer support, analytics, security, infrastructure, communications, and the AI/language-model provider that powers our AI page-building assistant. Each is bound by its own confidentiality and data-protection obligations appropriate to the service it provides.

Personal information may be processed in Canada or in other jurisdictions that provide a comparable level of protection, with appropriate safeguards in place.

TapIt retains personal information for as long as needed to provide the Services, or as required by law. Customer-submitted information (e.g. Customer Data Collection or Tap Loyalty) is automatically deleted after 24 months of inactivity. On termination of your account, TapIt will delete or return personal information it holds on your behalf, consistent with the retention and deletion practices described in our Privacy Policy.

Where TapIt receives a request directly from one of your customers about their own information, we will direct it to you as the Controller, and reasonably assist you in responding to it. You may request reasonable information from TapIt to confirm compliance with this DPA.

Each party’s liability under this DPA is subject to the limitations of liability set out in our Terms of Service. This DPA is governed by the laws of the Province of British Columbia and the federal laws of Canada applicable therein.

Questions about this DPA can be directed to TapIt’s Privacy Officer at tapitsolutionsinc@gmail.com

Related policies: Terms of Service; Privacy Policy.