TAP ’N | CUSTOMER PRIVACY

Privacy Policy

For website visitors, customers, contacts and business contacts

Document detail

Information

Effective date

10 August 2026

Controller

TAP 'N BUSINESS & NETWORK LTD (trading as Tap ’N)

Company number

17140502 | Registered in England and Wales

Website

https://tapn.cloud

Privacy contact

contactus@tapn.cloud

In short. We collect only the information needed to operate the website, answer enquiries, take appointments, personalise and deliver Products, process payments, publish reviews where appropriate and send marketing chosen by the recipient. Stripe processes full payment-card details; Tap ’N does not store them. We do not sell personal information.

• About this Policy

This Policy explains how TAP 'N BUSINESS & NETWORK LTD, trading as Tap ’N (we, us and our), collects and uses personal information in connection with https://tapn.cloud, customer Orders, enquiries, appointments, reviews, marketing and related business communications.

Our registered office is Suite 1, Boho Business Centre Boho Zero, 21 Gosford Street, Middlesbrough, Cleveland, England, TS2 1BB. We are the controller of the personal information described in this Policy because we decide why and how it is used. Some service providers may also act as separate controllers for their own activities.

This Policy should be read with our Cookie Notice, Terms and Conditions and Returns and Refunds Policy. It applies to both Consumers and Business Customers where the information relates to an identifiable person. It does not apply to information that has been effectively anonymised.

• The personal information we collect

Depending on how you interact with us, we may collect:

• identity and contact information, including name, business name, job role, email address, telephone number and billing or delivery address;

• Order and transaction information, including Products purchased, amounts, dates, Order number, invoices, payment status, refunds, delivery information and communications about the Order;

• customisation information, including destination URLs, names, business names, wording, logos, images, design files, colour choices and approvals;

• enquiry and appointment information, including messages, requested services, booking details and notes needed to prepare a quotation or fulfil a request;

• review information, including the name or display name, rating, review text, date and any response or moderation record;

• marketing information, including newsletter subscription, consent record, preferences, unsubscribe status and campaign interaction information made available by Hostinger;

• limited payment information returned by Stripe, such as payment status, transaction reference, card type or masked card details where provided. Tap ’N does not receive or store full card numbers or card security codes;

• technical and usage information generated by the website or its infrastructure, such as IP address, browser and device type, approximate location derived from IP, timestamps, referring page, pages requested, error logs, security events and cookie identifiers; and

• rights-request, complaint and compliance information, including correspondence and information reasonably required to confirm identity and investigate the matter.

Please do not submit special-category information, criminal-offence information or unnecessary personal information through customisation, review or contact fields. If this information is supplied without a genuine need, we may delete or restrict it.

• Where personal information comes from

We obtain personal information:

• directly from you when you order, customise a Product, contact us, book an appointment, subscribe, submit a review or exercise a legal right;

• automatically from the website and its essential infrastructure, subject to the cookie rules explained below;

• from Stripe, Shippo, delivery carriers and Hostinger where necessary to confirm payment, operate the website, provide communications or fulfil delivery; and

• from public business websites, directories or professional social-media profiles where we identify a relevant business contact for proportionate business-to-business communications permitted by law.

If you give us personal information about another person, for example a recipient, employee, named contact or person shown in customisation content, you must have a lawful reason to do so and should make this Policy available to them where appropriate.

• How and why we use personal information

We use personal information only where we have a lawful basis. Contract means the use is necessary to take requested steps before a contract or perform one. Legal obligation means the law requires the use. Legitimate interests means the use is reasonably necessary for our or another person’s legitimate interests after considering the individual’s rights. Consent means a freely given, specific and informed choice that may be withdrawn.

Activity and information

Purpose

Lawful basis

Website operation and security
Technical logs, IP, device, browser, cookie choices and security events

Deliver pages and checkout functions; remember essential choices; diagnose faults; prevent fraud, abuse and attacks; maintain availability.

Legitimate interests in a secure, reliable service; contract where necessary for checkout; consent for non-essential storage/access technologies.

Enquiries and appointments
Name, contact details, message, booking details and relevant notes

Respond, arrange consultations, prepare quotations and take steps requested before an Order.

Contract where you request pre-contract steps; otherwise legitimate interests in responding and managing business communications.

Orders and customisation
Identity, contact, Order, URL, name, logo, design, approvals and communications

Accept and manufacture the Order, permanently programme the destination URL, confirm specifications, provide support and manage cancellation or returns.

Contract; legitimate interests in maintaining an accurate production and approval record.

Payments and fraud prevention
Order value, payment status, transaction reference and limited masked payment details

Take payment through Stripe, issue refunds, reconcile accounts, prevent fraudulent transactions and manage disputes.

Contract; legal obligations for financial records; legitimate interests in fraud prevention and defending claims.

Delivery
Name, delivery address, contact details and parcel information

Create labels through Shippo, provide information to carriers, deliver and track Products, and resolve delivery problems.

Contract; legitimate interests in delivery evidence and resolving disputes.

Reviews
Display name, rating, review, date and moderation information

Publish genuine feedback, respond to it, prevent abuse and remove unlawful or inappropriate content.

Legitimate interests in transparent customer feedback and service improvement; consent where we specifically request it for optional publication.

Newsletter and chosen marketing
Name, email, consent, preferences, campaign engagement and unsubscribe status

Send Tap ’N news, offers and product information requested by the subscriber; measure and improve campaigns.

Consent. Where a lawful customer soft opt-in is used, legitimate interests under data protection law alongside compliance with PECR.

Relevant business communications
Professional name, role, organisation and business contact details

Develop relationships with businesses that may reasonably be interested in Tap ’N Products and demonstrations.

Legitimate interests where electronic-marketing and data-protection law permit. Consent or a valid soft opt-in is required for individual subscribers when PECR applies.

Accounting, legal and compliance
Order, invoice, payment, tax, complaint and correspondence records

Maintain statutory records, obtain professional advice, enforce or defend rights, respond to authorities and handle data-protection matters.

Legal obligation; legitimate interests in legal claims, governance and protecting the business and customers.

We will not use personal information for a new purpose that is incompatible with the reason it was collected without providing any required information and identifying an appropriate lawful basis.

• Cookies and similar technologies

Hostinger and integrated services may use cookies, local storage, scripts or similar technologies. We distinguish between technologies that are strictly necessary for a service requested by the user and non-essential technologies used for analytics, personalisation or advertising.

• Strictly necessary technologies may operate without consent where the legal exception applies, for example security, checkout, load balancing and remembering a cookie choice. We still provide clear information about them.

• Non-essential analytics, advertising or similar technologies will not be activated until the user has made a valid consent choice where consent is required.

• Rejecting non-essential technologies must be as easy as accepting them. A user may change the choice through the Cookie settings control displayed on the website.

• The Cookie Notice and settings panel must identify the current technologies, providers, purposes and durations. Because website tools change, we review the live cookie scan and update that information before introducing new technology.

At the effective date of this Policy, we do not intend to deploy third-party advertising or behavioural-tracking technology unless the required consent mechanism and updated Cookie Notice are in place. Essential payment, website and security integrations may still exchange technical information needed to provide their services.

• Marketing choices

The Hostinger newsletter function is used to store and manage newsletter contacts. A newsletter subscriber must make an affirmative choice; the box must not be pre-ticked or bundled with accepting other terms. Each marketing email will identify Tap ’N and provide a simple unsubscribe method.

A person may withdraw marketing consent or object to direct marketing at any time by using the unsubscribe link or emailing contactus@tapn.cloud. We will stop the relevant marketing and may retain only the minimum information on a suppression list so that we do not contact the person again by mistake. The right to object to direct marketing is absolute.

The rules differ for limited companies and for individual subscribers such as consumers, sole traders and some partnerships. We will apply the relevant UK GDPR and PECR requirements to each campaign. A privacy notice does not by itself create permission to send marketing.

• Reviews and other public content

A review submitted for publication may be visible publicly with the chosen name or display name, rating and date. Reviews should not contain private contact details, confidential information or another person’s personal information. We may moderate content to prevent fraud, abuse, defamation, unlawful material or infringement, but will not manipulate a review merely because it is critical.

A reviewer may ask us to correct or remove personal information in a review. We will consider the request under applicable rights and our legitimate interests. Removing a public review does not necessarily require deletion of a limited internal record needed to handle a dispute, comply with law or prevent repeated abuse.

• Who receives personal information

We may provide the minimum necessary information to:

• Hostinger, which provides website hosting, site tools, forms, appointment functions, newsletter campaigns and review functionality. Hostinger generally processes website information on our instructions but may act independently for its own account, security or legal purposes;

• Stripe, which securely processes payment-card information and may act as a processor or separate controller depending on the activity. Tap ’N receives transaction confirmation and limited payment information but not full card details;

• Shippo and the selected delivery carrier, which receive the information needed to create labels, deliver, track and resolve problems with parcels;

• professional advisers, accountants, insurers, IT or security providers where reasonably necessary and subject to appropriate confidentiality or data-processing terms;

• courts, regulators, law-enforcement bodies, HMRC or other authorities where disclosure is required or permitted by law; and

• a genuine purchaser, investor or successor in a proposed sale, reorganisation or transfer of the business, subject to proportionate confidentiality and due-diligence controls.

We do not sell personal information. We require processors to use personal information only on documented instructions, keep it secure, assist with rights and deletion, and impose equivalent protections on authorised sub-processors.

Provider information is available at https://www.hostinger.com/legal/privacy-policy, https://stripe.com/privacy and https://privacy.goshippo.com/policies?name=privacy-notice. These providers control their own notices and may update them.

• International transfers

Some providers and their authorised sub-processors operate outside the United Kingdom or permit support access from other countries. This may result in a restricted transfer of personal information. We do not rely on a generic statement that information may be sent to Canada or the United States; the actual destination and mechanism depend on the provider and service in use.

Where a restricted transfer occurs, we require a lawful transfer mechanism. Depending on the destination and recipient, this may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved contractual clauses or another mechanism permitted by UK law. We carry out any transfer assessment required and apply supplementary protections where appropriate.

You may contact us for further information about the safeguards relevant to your personal information. We may redact commercially confidential or security-sensitive material while still providing the information required by law.

• How long we keep personal information

We do not keep personal information indefinitely merely because storage is available. Retention depends on the purpose, legal requirements, the sensitivity of the information, the risk of harm and whether a dispute or investigation is active. Our normal schedule is:

Record

Normal retention

Enquiries and appointments that do not become an Order

Up to 12 months after the last meaningful contact, unless a longer period is needed for a complaint, safeguarding concern or legal claim.

Uncompleted customisation submissions

Up to 12 months after the submission or last contact, then deleted unless incorporated into an Order or retained at the customer’s request for an active quotation.

Orders, invoices, payment summaries, delivery records and approved customisation

Normally six years from the end of the company financial year to which the record relates, or longer where law, an HMRC check, an unresolved dispute or a legal claim requires it.

Newsletter subscriber and campaign information

Until consent is withdrawn, the person unsubscribes or there has been 24 months without meaningful engagement and no continuing reason to retain the active profile.

Marketing suppression information

The minimum identifier is kept for as long as we continue the relevant marketing activity and need to honour the objection or unsubscribe request.

Relevant business-prospect information

Up to 24 months after the last meaningful interaction, unless the person objects sooner, becomes a customer or an ongoing business relationship justifies continued retention.

Published reviews

While published and normally up to 12 months after removal. A connected Order, fraud or dispute record may be retained under its separate period.

Website logs and cookie identifiers

For the duration stated in the Cookie Notice or configured for the relevant Hostinger service, using the shortest period reasonably necessary. Security-incident evidence may be retained longer while investigated.

Rights requests and data-protection complaints

The request, decision and core correspondence are normally retained for six years after closure to demonstrate compliance. Extra identity documents are deleted as soon as verification and any necessary review are complete.

Backups may preserve information temporarily until the provider’s secure overwrite cycle completes. We do not use backup copies for ordinary business activity and, where restored after an incident, apply the current retention and deletion rules. Information may instead be anonymised so that it no longer identifies anyone.

• Security

We use measures appropriate to the nature and risk of the information. These include access restriction, strong unique passwords, multi-factor authentication where available, encryption in transit, secure payment processing through Stripe, data minimisation, device security, provider due diligence, controlled deletion and an incident-response process.

No internet service is completely secure, so we do not promise absolute security or guarantee that an incident can never occur. If a personal-data breach occurs, we will contain and assess it, keep an internal record and notify the ICO and affected individuals where the legal thresholds are met.

• Your data-protection rights

Depending on the circumstances and lawful basis, an individual may have the right to:

• receive clear information about how personal information is used;

• request access to personal information and receive a copy;

• have inaccurate or incomplete information corrected;

• request erasure where the legal conditions apply;

• request restriction of processing in specified circumstances;

• receive information supplied to us in a portable format where the portability right applies;

• object to processing based on legitimate interests and object absolutely to direct marketing;

• withdraw consent at any time, without affecting processing carried out lawfully before withdrawal; and

• request safeguards relating to a solely automated decision that has legal or similarly significant effects, if such processing is introduced.

Rights are not absolute and exemptions may apply. To exercise a right, email contactus@tapn.cloud and describe the request. We may ask for information reasonably necessary to confirm identity, but will not request disproportionate evidence. We normally respond within one calendar month and may extend the period where the law permits for a complex or numerous request.

There is normally no fee. We may charge a reasonable fee or refuse a manifestly unfounded or excessive request only where the law permits, and we will explain the decision and available complaint rights.

• Data-protection complaints

A data-protection complaint may be made to contactus@tapn.cloud or by post to our registered office. Please state that it is a data-protection complaint and include enough information to understand the concern and desired outcome.

We will acknowledge receipt within 30 days, take appropriate steps to investigate without undue delay, keep the complainant appropriately informed and communicate the outcome without undue delay. A rights request and a complaint are legally distinct even if submitted together, and we will handle each under the relevant procedure.

You may also complain to the Information Commissioner’s Office (ICO): Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF; telephone 0303 123 1113; website https://ico.org.uk/make-a-complaint/. We would welcome the opportunity to address the issue first, but contacting us does not remove the right to complain to the ICO.

• Children’s information

Our website and Products are not designed to collect personal information from children. We do not knowingly use a child’s information for marketing. If we learn that unnecessary child information has been submitted without an appropriate lawful basis, we will delete or restrict it. A parent or guardian may contact us with a concern.

• Automated decision-making

Tap ’N does not currently make decisions based solely on automated processing that produce legal or similarly significant effects. We may use ordinary automation for confirmations, fraud alerts, website security, label creation or marketing scheduling, but a person can contact us where an automated process appears to have produced an incorrect or unfair result. We will update this Policy before introducing significant automated decision-making.

• Third-party websites

The website may link to customer destination URLs, social-media services or other websites that we do not control. Their operators are responsible for their own privacy practices. A link does not mean that Tap ’N controls or endorses the way the external service uses personal information. Review the external privacy notice before providing information.

• Changes to this Policy

We may update this Policy when our services, providers or legal obligations change. The revised version will show a new effective date and will be published before it applies. Where a change materially affects existing processing or requires a new consent choice, we will provide additional notice or obtain consent as required. Earlier versions may be retained to demonstrate what information was given at the relevant time.

• Contact us

For privacy questions, rights requests or complaints, contact:

Email: contactus@tapn.cloud

Post: TAP 'N BUSINESS & NETWORK LTD, Suite 1, Boho Business Centre Boho Zero, 21 Gosford Street, Middlesbrough, Cleveland, England, TS2 1BB

Company: Registered in England and Wales, company number 17140502

Please do not send full payment-card information or unnecessary identity documents by ordinary email.