Privacy Policy and Protection of Personal Information

1. Scope of this policy

This policy applies to personal information collected through:

• the tap-links.ca website;
• Tap-Links digital profiles;
• contact, registration or order forms;
• purchases, subscriptions and renewals;
• custom links, QR codes and NFC products;
• communications by email, telephone or messaging;
• support or modification requests;
• production, customization and delivery services.

It applies to Tap-Links customers, profile holders, website visitors and people who submit information through a form.

2. Privacy Officer

Tap-Links is responsible for the personal information it collects, holds, uses, discloses and retains.

Questions, requests or complaints concerning the protection of personal information may be addressed to:

3. Personal information collected

The information collected varies according to the services used and the information the person chooses to provide.

3.1 Information intended for a digital profile

To create and maintain a Tap-Links profile, the customer may provide, in particular:

• their first and last name;
• a photograph;
• their professional title or occupation;
• their business name and logo;
• their telephone numbers;
• their email address;
• their business address or service area;
• their website;
• links to their social media accounts;
• a professional or commercial description;
• their products, services, projects, achievements or portfolio items;
• files, images, videos or documents;
• any other information the customer wishes to display in their profile.

The customer chooses the information they wish to make public in their profile.

Tap-Links does not ask the customer to publish information that is unnecessary for the professional, commercial or organizational purpose of their profile.

3.2 Administrative and commercial information

To administer services, orders and payments, Tap-Links may collect:

• the name of the customer or their business;
• their contact details;
• their billing or delivery address;
• the products or services ordered;
• order, payment, subscription and renewal history;
• invoice and transaction status;
• files, logos and designs submitted for production;
• communications related to service, delivery or support.

When payment is processed by Stripe, Tap-Links neither receives nor retains the full payment card number or its security code.

Tap-Links receives only the information required to confirm, administer or reconcile the transaction.

3.3 Technical information and internal logs

When a person visits tap-links.ca or views a Tap-Links profile, certain technical information may be recorded automatically.

Depending on the page or interaction, this information may include:

• the date and time of the visit;
• the page or profile viewed;
• the link, button or function used;
• the IP address;
• the browser type;
• the device type;
• the operating system;
• the referring page or source;
• certain campaign parameters, including UTM parameters;
• technical information required to detect an error, abuse or unusual activity.

Tap-Links uses its own internal logs to operate the service, measure overall profile use, produce internal statistics, diagnose errors, prevent abuse and protect the site.

Tap-Links does not sell these logs or use them to allow third parties to send advertising to visitors.

3.4 Forms and communications

When a person completes a form, sends an email, calls or communicates with Tap-Links through messaging, Tap-Links collects the information they choose to provide.

Some digital profiles may include a form for communicating with the profile holder.

In that case, the information entered is transmitted to the profile holder or the business responsible for that profile so they can respond to the message.

It is recommended that medical, financial, intimate or particularly confidential information not be submitted through a general form unless strictly necessary.

3.5 Information submitted by a business or team manager

A business, organization or team manager may submit professional information about its employees, representatives or collaborators to Tap-Links to create or manage their profiles.

The person or organization submitting this information confirms that they are authorized to do so and have informed the individuals concerned about the creation and publication of their profiles.

4. Collection methods

Tap-Links may collect personal information:

• directly from the individual concerned;
• through web forms;
• during an order, payment or subscription;
• by email, telephone or messaging;
• through files or designs submitted for production;
• automatically through technical server logs;
• through analytics cookies when the visitor consents;
• from a business or authorized manager requesting the creation of profiles for a team.

Tap-Links limits collection to information reasonably necessary for the purposes stated in this policy.

5. Use of personal information

Tap-Links uses personal information to:

• create, publish and update digital profiles;
• produce digital contact files;
• generate custom links and QR codes;
• program cards, keychains and other NFC products;
• customize, print or engrave products;
• process orders, payments, subscriptions and renewals;
• prepare invoices;
• deliver products;
• respond to questions and support requests;
• communicate with customers about their services;
• correct errors and maintain site operation;
• prevent abuse, fraud or unauthorized access;
• produce internal statistics;
• understand overall site use when analytics cookies have been accepted;
• meet applicable tax, accounting and legal obligations.

Tap-Links does not use personal information to sell contact lists, create advertising profiles for third parties or allow advertisers to communicate with its customers.

6. Information published in a Tap-Links profile

The main purpose of a Tap-Links profile is to allow the customer to share the professional or commercial information they have selected.

Published information may be viewed by anyone who:

• visits the custom link;
• scans the QR code;
• brings a compatible device near the NFC product;
• receives the link by email, messaging, social media or any other means.

The customer must consider the information they choose to display in their profile to be public.

A person viewing the profile may save, copy, photograph or transmit the information displayed there.

Some pages may also be indexed or temporarily retained by search engines, social media platforms, browsers or other external services.

Tap-Links may modify, disable or remove a profile at the customer’s request. However, Tap-Links cannot control copies, screenshots, saved contacts or content already retained by third parties.

In standard Tap-Links NFC products, the chip mainly contains a link to the digital profile. Most information remains hosted on the website and can be changed without replacing or reprogramming the product.

7. Customer consent and control

When a person provides information to create a profile, place an order or obtain a service, they authorize Tap-Links to use that information for the purposes described in this policy.

Information is published in a profile according to the customer’s instructions.

The customer may request, in particular:

• correction of information;
• removal of published information;
• modification of their profile;
• temporary deactivation of the profile;
• permanent removal of the profile;
• withdrawal of consent for certain uses.

Withdrawing information required to provide the service may prevent Tap-Links from continuing to provide part or all of the requested service.

8. Cookies and Google Analytics

8.1 Functional consent cookie

Tap-Links uses a functional cookie named:

taplinks_cookie_consent

This cookie is used only to remember the visitor’s choice regarding Google Analytics.

It may indicate that analytics cookies have been accepted or rejected.

This cookie:

• is necessary to avoid asking for the same choice on every page;
• is not used to measure browsing;
• is not used for advertising purposes;
• is retained for 180 days.

8.2 Google Analytics

Tap-Links uses Google Analytics to obtain general statistics about use of the site, including:

• pages viewed;
• the source of visits;
• the duration and sequence of browsing;
• browser and device type;
• the operating system;
• approximate geographic location;
• certain interactions performed on the site.

Google Analytics uses cookies and similar technologies.

These analytics tools are optional. They remain completely disabled until the visitor accepts them.

Before acceptance:

• the Google Analytics script is not loaded;
• Tap-Links creates no Google analytics cookie;
• the Tap-Links consent mechanism sends no analytics request to Google.

The visitor may reject Google Analytics without losing access to the site’s essential functions, profiles, forms, QR codes or NFC products.

8.3 Changing or withdrawing consent

The visitor may change their choice through the “Manage cookies” link available in the site footer and in this section.

When previously granted consent is withdrawn:

• Tap-Links stops loading Google Analytics on subsequent visits;
• the preference is replaced with a rejection;
• Tap-Links attempts to delete analytics cookies accessible from its own domain;
• the page may be reloaded to stop the already loaded Google Analytics instance.

Tap-Links cannot delete cookies belonging to an external domain or immediately remove information that Google has already processed.

8.4 Advertising services

As of the date this policy was last updated, the Tap-Links consent mechanism activates only Google Analytics when the visitor accepts it.

Google Tag Manager, Google Ads, remarketing and advertising personalization functions are not active.

If Tap-Links later introduces advertising cookies or other non-essential technologies, this policy and the consent mechanism will be updated.

9. Disclosure of personal information

9.1 No sale or rental

Tap-Links does not sell, rent or market personal information.

Tap-Links does not provide customer lists to advertisers or authorize its service providers to use them for their own advertising campaigns.

9.2 Service providers

Tap-Links uses certain service providers to operate its service.

Limited information may be processed by providers related, in particular, to:

• website and database hosting;
• payment processing;
• transactional email delivery;
• traffic analysis, with consent;
• production or printing;
• transportation and delivery;
• technical support, security or backups.

Providers currently used may include, in particular:

• Tap-Links’ host and infrastructure providers;
• Google, for Google Analytics;
• Stripe, for payment processing;
• Postmark, for sending certain emails;
• postal services or carriers used for deliveries.

Tap-Links limits the information transmitted to what is reasonably necessary to perform the service concerned.

For example:

• Stripe receives the information required to process and secure a payment;
• Postmark receives the address and content required to deliver an email;
• a carrier receives the name and address required to deliver a product;
• the host retains data required to operate profiles and the site;
• Google Analytics receives analytics information only after the visitor’s consent.

Some providers may also process information in accordance with their own legal obligations, including security, fraud prevention, taxation or regulatory compliance.

9.3 Profile holders and customer businesses

When a person sends a message through a profile form, the information is transmitted to the holder or business responsible for that profile.

A business that administers its team’s profiles may also have access to the professional information of its own employees or representatives.

9.4 Legal requirements

Tap-Links may disclose information when required by law, a court order or a competent authority.

Information may also be disclosed when reasonably necessary to prevent fraud, protect service security or defend the rights of Tap-Links or an individual concerned.

10. Processing outside Québec

Some information may be retained or processed outside Québec.

Providers used by Tap-Links may operate infrastructure located, in particular:

• in Canada;
• in the United States;
• in other territories where their providers or subcontractors operate.

The hosting infrastructure currently used by Tap-Links is located in the United States.

Google, Stripe, Postmark and their providers may also process certain information in the United States, Canada or other territories.

When information is processed outside Québec, it may be subject to the laws of the jurisdiction concerned and accessible to authorities in accordance with those laws.

Tap-Links considers the nature of the information, its use and the measures offered by providers when selecting services required for its activities.

11. Retention and destruction

Tap-Links retains personal information for the period reasonably necessary to:

• provide and administer its services;
• maintain an active profile;
• respond to modification or support requests;
• administer payments, invoices and renewals;
• produce or reprint products;
• resolve a complaint or dispute;
• protect site security;
• meet its tax, accounting and legal obligations.

Tap-Links currently applies retention criteria based on necessity and is progressively formalizing an internal retention schedule by information category.

In practice:

• profile information is retained while the service remains active and for a limited period after deactivation when still required for support or service administration;
• billing and transaction information is retained for periods required by tax, accounting and legal obligations;
• messages and requests are retained for the time required to respond and follow up;
• internal technical logs are retained for the time required to produce statistics, diagnose errors, prevent abuse and protect the service;
• production files may be retained when still useful for a correction, reprint or support request;
• backups are progressively deleted according to normal rotation cycles.

When information is no longer required and no legal obligation justifies retaining it, Tap-Links destroys or anonymizes it when appropriate and technically feasible.

Deleting information from active systems does not necessarily mean it immediately disappears from all backups. These copies are replaced or deleted according to their rotation cycles.

12. Security measures

Tap-Links applies reasonable administrative and technical measures suited to the nature of its activities and the information it retains.

These measures may include:

• use of secure connections;
• access controls and restrictions;
• protection of administrative accounts;
• updates and maintenance operations;
• technical logs;
• backups;
• measures to detect errors, unauthorized access or unusual activities;
• limiting access to individuals who require it to perform their duties.

No computer system or Internet-accessible service can guarantee absolute security.

If Tap-Links identifies a privacy incident, it analyzes the situation and takes the measures required according to the nature of the information and the risk of harm.

13. Lost card or NFC product

If a card, keychain or other NFC product is lost or stolen, the customer may ask Tap-Links to modify, disable or remove the associated profile.

Losing a standard NFC product does not provide access to Tap-Links administrative systems or database.

The product normally directs to the same public profile as the custom link or QR code.

14. Your rights

Subject to the conditions and exceptions provided by applicable laws, a person may request:

• to know what personal information Tap-Links holds about them;
• access to that information;
• correction of inaccurate, incomplete or ambiguous information;
• withdrawal of consent where applicable;
• deletion of information that is no longer required, subject to legal retention obligations;
• cessation of dissemination or de-indexing of information when the conditions provided by law are met;
• receipt of certain computerized personal information in a structured, commonly used technological format when the right to portability applies;
• to submit a question or complaint about the protection of their personal information.

Tap-Links may request reasonable information to verify the person’s identity before responding to a request.

A formal request must be submitted in writing to the Privacy Officer.

Tap-Links responds to an access or correction request within 30 days of receipt, subject to the conditions provided by law.

When a request cannot be accepted in whole or in part, Tap-Links informs the person of the applicable reasons and available recourses.

A person dissatisfied with the response may contact the Commission d’accès à l’information du Québec.

15. Information concerning minors

Tap-Links services are primarily intended for professional, commercial and organizational uses.

When a profile contains information about a minor, the request must be made or authorized by their parent, guardian or another legally authorized person.

Tap-Links does not intentionally seek to collect personal information about a minor without appropriate authorization.

16. External links and services

Tap-Links profiles may contain links to:

• websites;
• social media platforms;
• booking platforms;
• payment systems;
• menus;
• maps;
• other external services.

Tap-Links does not control the privacy practices of these external services.

A person accessing these services should review their own privacy policies and settings.

17. Policy changes

Tap-Links may amend this policy to reflect:

• a change to its services;
• the addition or removal of a provider;
• a new technology;
• a change to the consent mechanism;
• an evolution in internal practices;
• a legal or regulatory requirement.

The date of the latest update is shown at the beginning of the policy.

When a change materially alters how Tap-Links collects, uses or discloses personal information, an appropriate notice is published on the site or provided by another reasonable means.

18. Questions, requests and complaints

To request access, correction or deletion of information, request modification or deactivation of a profile, withdraw consent or submit a complaint, please contact:

Tap-Links handles requests confidentially and in accordance with the laws applicable in Québec and Canada.