View Demo

Privacy Policy

Privacy Policy (TapScan.me)

Last updated: 31 December 2025

Quick summary (for guests)

When you opt in via TapScan.me, you’re choosing to share your details with the venue you’re visiting so they can send you guest-only offers, updates, or perks. TapScan.me hosts the opt-in page and securely delivers your details to that venue. You can opt out at any time.

1. Who We Are

TapScan.me is a service operated by The Halcyon Collective (“we”, “us”, “our”). TapScan.me and The Halcyon Collective are trading names of ItsSortd Ltd, a company registered in England and Wales.

Contact: hi@tapscan.me
Website: tapscan.me

For the purposes of UK GDPR, we act as:

  • Data Processor for customer data collected on behalf of venues

  • Data Controller for data relating to our own clients, service operations, and platform administration

2. What Data We Collect

a) Customer Data (on behalf of venues)

When customers scan a QR code or tap an NFC tag, we may collect:

  • Name

  • Email address

  • Mobile number (if requested by the venue)

  • Marketing preferences / consent

  • Venue visited

  • Date and time of interaction

This data is collected only where the individual has actively opted in.

b) Client (Business) Data

We may collect:

  • Business name

  • Contact name

  • Business email address

  • Billing details

  • Service usage information

  • Support communications

3. Who Owns the Data

Venues retain full ownership of their Customer Data at all times.

We do not sell identifiable customer data.

4. How We Use Data

a) Customer Data (guest opt-ins)

We use Customer Data to:

  • Deliver customer opt-ins to the relevant venue

  • Provide weekly exports (or another delivery method agreed with the venue)

  • Maintain platform functionality and reliability

  • Provide customer support

  • Prevent fraud and protect platform security

b) Client Data (business customers)

We use Client Data to:

  • Provide and administer the Service

  • Manage billing and account access

  • Provide support and service communications

  • Improve our product and operations

Aggregated & anonymised data

We may use anonymised, aggregated, or permission-based data to:

  • Improve the platform

  • Develop new services

  • Understand trends and performance

This process does not involve sharing personally identifiable customer data.

5. Future Discovery & Recommendations (optional)

If TapScan.me introduces consumer-facing discovery or recommendations in the future (e.g. suggesting venues or experiences), this will only apply where customers:

  • separately and explicitly opt in, and

  • are clearly told what they are opting into, and

  • can opt out easily at any time.

6. Legal Basis for Processing

We process personal data under the following legal bases:

  • Consent (guest opt-ins)

  • Contractual necessity (providing the Service to venues)

  • Legitimate interests (service improvement, platform security, fraud prevention)

7. Data Retention

  • Client data: retained while an account is active and for legal/accounting purposes thereafter

  • Customer data: retained to provide the Service and in line with venue instructions, or deleted/anonymised after a reasonable period, unless we are legally required to retain it

Retention periods may also be described in service documentation or agreed with the venue.

8. Data Sharing

We may share data with trusted third parties only where necessary to provide the Service, such as:

  • Secure hosting providers

  • Infrastructure partners needed to operate the platform

  • Analytics providers (where used, under strict contractual controls)

We do not sell personal data to third parties.

9. International Transfers

Data may be stored or processed in the UK or EEA.

Where data is processed outside the UK/EEA, appropriate safeguards are put in place (such as standard contractual clauses or equivalent protections).

10. Your Rights

Individuals have the right to:

  • Access their data

  • Correct inaccurate data

  • Withdraw consent

  • Request deletion

  • Object to processing

  • Lodge a complaint with the ICO

How to make a request

Requests can be made by emailing: hi@tapscan.me

To help us action your request quickly, please include:

  • the venue name, and

  • the email address and/or mobile number you used to opt in.

In many cases, the venue is the data controller (and responsible for marketing communications). Where appropriate, we will action your request directly and/or route it to the venue.

11. Security

We use appropriate technical and organisational measures to protect personal data from loss, misuse, unauthorised access, alteration, or disclosure.

12. Changes to This Policy

We may update this policy from time to time. The latest version will always be available on our website at: tapscan.me/privacy-policy

13. Contact

Questions about privacy or data protection can be sent to: hi@tapscan.me