Data processing terms
Last updated: October 2026. These terms apply automatically when you use Contactzy to collect other people's details, and form part of our Terms of Service.
1. Roles
When visitors send you their details through your card's contact form, or join your loyalty card, you (the account holder) are the controller of that personal data and BEEPFLOW, England, United Kingdom (“Contactzy”) is your processor. These terms meet Article 28 of the EU General Data Protection Regulation and of the UK GDPR, and apply equally under other laws that require a processing agreement.
2. What we process
- Subject matter and purpose: receiving, storing and showing you the details, emailing you about them, producing loyalty wallet passes, and letting you export or delete them.
- People concerned: visitors who contact you through your card and members of your loyalty card.
- Types of data: name, email address, phone number, company, message, consent confirmation, loyalty stamps, rewards and dates, and a hash of a shortened IP address used to stop abuse.
- Duration: for as long as you keep the data in your account, and then until deletion under section 8.
3. Your instructions
We process the data only on your documented instructions, which are your use and settings of the service and these terms, unless the law requires otherwise, in which case we will tell you first where the law allows. We will tell you if we believe an instruction breaks data protection law.
4. Confidentiality and security
Everyone authorised to process the data is bound by confidentiality. We keep technical and organisational measures appropriate to the risk, including encryption in transit, hashed passwords, access limited to staff who need it behind a separate access key, an audit log of staff actions, rate limiting, minimised identifiers and nightly backups kept for 14 days.
5. Sub-processors
You authorise us to use the sub-processors below. We impose data protection terms on each that are no less protective than these, and remain responsible for them. We will update this list at least 30 days before adding or replacing one; if you object on reasonable data protection grounds and we cannot resolve it, you may close your account.
| Sub-processor | Purpose | Location |
|---|---|---|
| Cloudflare | Network delivery and protection | Global |
| Hostinger | Email notifications to you about new contacts and rewards | See provider |
| Google Wallet loyalty passes (member name, stamps and code) | Global | |
| Apple | Update notices for saved Apple Wallet passes (push token only) | United States |
6. International transfers
Where data leaves the European Economic Area, the United Kingdom or Switzerland for a country without an adequacy decision, the European Commission's Standard Contractual Clauses (Module 2 or 3, with the UK addendum where relevant) apply and are incorporated by reference, or the EU-US Data Privacy Framework where the recipient is certified.
7. Helping you
- Requests from people: your dashboard lets you view, export (contacts as CSV, everything as JSON) and delete their details, and loyalty members can delete their own card. We will forward to you any request we receive about your data and help with the rest.
- Breaches: we will notify you without undue delay, and in any case within 48 hours of becoming aware of a personal data breach affecting your data, with the information you need to meet your own obligations.
- Assessments: we will give you reasonable help with data protection impact assessments and consultations with authorities.
8. Deletion at the end
You can export the data at any time. When you delete it, or delete your account, it is removed from the live service immediately and from backups within 14 days, unless the law requires us to keep it.
9. Audits
We will make available the information needed to show compliance with these terms and with Article 28, answer reasonable written questions, and allow audits by you or an auditor you appoint, subject to reasonable notice and confidentiality.
10. Your responsibilities
You are responsible for having a lawful basis to collect and use the data, for telling people how you use it, and for answering their requests. The contact form and loyalty sign-up show a notice saying the details go to you through Contactzy and link to our Privacy Policy.
11. General
Liability under these terms follows our Terms of Service. If these terms conflict with the Terms of Service on data protection, these terms prevail. Questions: [email protected]. BEEPFLOW is a company registered in England and Wales, company number 16438551. Registered office: England.