Privacy Statement Smardly BV — Smardly Cards

This is a translation. In case of any difference, the Dutch version prevails.

Version: 9 November 2026 — replaces the version of 6 November 2026. What has changed: a signup after a campaign link is counted, using a cookie that contains only the campaign number (chapters 4 and 5).

1. Who we are

Smardly BV makes digital business cards (Smardly Tap) and the associated NFC cards. We are the controller for the processing of your personal data as described in this statement.

Smardly BV
Overhoven 5
6136 EA Sittard
Chamber of Commerce number 80435602
E-mail: [email protected]

This statement applies to smardly.com, the online management environment, the public profile pages and the order page. The app Smardly Voice has its own privacy statement. If you are an employee of a company that uses Smardly Team, that company is responsible for your work profile and we process that data on behalf of the company (see chapter 7).

We never sell your data and do not use it to target advertisements at you.

2. Which data we process, for what purpose and for how long

We only process what is necessary for the purpose in the first column. The legal basis states on what legal ground this is done.

Purpose	Which data	Legal basis	Retention period
Your account	Name, e-mail address, password (stored encrypted), language, and when logging in with Apple, Google or Microsoft the identifier that party gives us	Performance of the contract	As long as your account exists
Proof of your consent when signing up	The exact text you agreed to, date, time and IP address	Legal obligation (demonstrating consent)	As long as your account exists
Your profile and business card	What you enter yourself: name, job title, company, phone, e-mail, address, website, social media, photo, logo and colours. We keep earlier versions of your profile so that you can go back	Performance of the contract	As long as the profile exists
Your public profile page, Wallet pass and QR code	The same profile data. These are meant to be shared: anyone with the link, the QR code or your card can see them	Performance of the contract	As long as the profile exists
Statistics of your profile	Per visit: date, time, how the profile was opened (NFC, QR or link) and the referring page. No IP address and no data with which we can recognise the visitor	Legitimate interest (showing you how your card is used)	As long as the profile exists
Contacts you receive	What the other person shared with you: name, e-mail, phone, company, job title, the social links they chose to include, when and via which profile, and whether the data is confirmed	Performance of the contract (you use Smardly to keep your contacts)	As long as you keep the contact and your account exists (see "Contacts" below)
Details you share without an account	What you enter yourself: name, e-mail and/or phone, company and job title, the moment and the profile you shared with	Consent (you enter it yourself and choose to share it)	As long as the card holder keeps the contact and their account exists. You can always have it removed (see "Contacts" below)
Request to have contact details removed	Your e-mail address	Legal obligation (carrying out your request)	Until you confirm the request, at most 7 days. After it is carried out we delete the request immediately
Profile photo studio (AI)	The photo you choose, the results made, and per attempt a line in your log: when, whether it worked, and what it cost. The log contains no image	Performance of the contract	We delete your original photo and the result you do not choose as soon as you choose, and otherwise after 1 day at the latest. The result you choose becomes your profile photo. The log line stays as long as your account exists. What the provider keeps is described below under "Profile photo studio"
Counting campaign visits	Per visit to a campaign link an encrypted code (hash) that changes every day, and the date. No IP address. The visit itself without a cookie. Afterwards, to be able to count a signup, a session cookie with only the campaign number. We do not store which account belongs to which campaign, only how many signups a campaign brings in per day	Legitimate interest (finding out which campaign works)	The codes 90 days; the daily totals without a code remain. The cookie until you close the browser or have signed up
Orders and delivery	Name, company name, invoice and delivery address, e-mail, phone, VAT number, what you ordered, and for a custom design the logo or image you supply	Performance of the contract	7 years (statutory tax retention obligation)
Payments and subscriptions	Payment status, payment method and the reference of the payment or mandate at Mollie. We do not see or store your full bank or card number	Performance of the contract	7 years (statutory tax retention obligation)
Invoices and accounting	Invoice data and the VAT number, which we check in the European VIES system	Legal obligation	7 years
Waiving the right of withdrawal and accepting the terms	The text you agreed to, the version of the terms, date and time	Legal obligation and legitimate interest (evidence)	7 years, together with the order
Withdrawal from a purchase	Name, e-mail, order number, what you withdraw from, date, time and IP address	Legal obligation	2 years after handling
Service e-mails	E-mail address, subject, whether the e-mail was delivered and whether it was opened	Performance of the contract and legitimate interest (checking that important e-mails arrive)	1 year
Reminder for an unfinished order	E-mail address and the contents of your shopping basket	Legitimate interest. You can unsubscribe in every reminder	Until the order is completed or you unsubscribe, at most 30 days
Waiting lists and newsletter (such as Smardly Voice and Smardly Team)	Name, e-mail, possibly company and what you tell us, your consent text, IP address and via which link you came	Consent	Until you unsubscribe or until launch, then another 1 year
Contact form and customer service	Name, e-mail, your message, language and IP address	Legitimate interest (answering your question)	2 years after the last contact
Security and malfunctions	Login session, IP address, browser and technical error messages	Legitimate interest (a secure and working service)	Sessions until you log out or after 2 hours of inactivity; error messages 90 days

If you give us data of someone else, for example a different delivery address or the contact details of a colleague on a card, make sure that person knows about it.

Contacts

When your card is shared, the person who receives it can share their own details with you. These are then kept in your contacts.

For how long. A contact stays as long as you keep it and your account exists, just like your profiles and statistics. There is no fixed end date, because a contact is data you have knowingly received and need to maintain the relationship. You decide what you keep.
If you have your account and data deleted (see chapter 9), your contacts disappear along with your other data.
If the person behind a contact closes their Smardly account, the contact stays with you. It is a snapshot of what that person shared with you, and you received that data lawfully. What remains is the data they shared (name, and whatever else they shared); there is no longer a link to an account.
Did someone without an account share their details (for example at a trade fair)? Then they are kept, marked as unchecked, with the card holder. If they left an e-mail address, they receive a confirmation of what they shared, with whom and when. They can always have it removed at smardly.com/en/forget-contact: they enter their e-mail address, confirm via a link in an e-mail, and we delete what was shared under that address. That screen never shows whether an address is known to us. If they only left a phone number, they can e-mail [email protected].

Who is responsible for what?

If you use Smardly privately or as a self-employed person, the contacts are yours. Smardly keeps them for you, shows them only to you and uses them for nothing else. What you do with a contact, for example approaching someone, you decide and answer for yourself. Smardly is responsible for keeping them securely and in accordance with this statement.
If you use a work profile of Smardly Team, chapter 7 applies to your work profile. Contacts are currently personal and are not visible to your employer.

Profile photo studio

With the profile photo studio you can have a photo of yourself turned into a professional portrait. To do so we send the photo to our AI provider, OpenAI, which processes it in the United States. As soon as you choose a result, we delete your original photo and the result you do not choose. We cannot promise that the provider does the same right away: OpenAI keeps the photo and the result for up to 30 days to check for misuse. How OpenAI handles it is described in its own terms. If you cancel, we also delete the result, but the attempt still counts in your log.

3. Smardly Voice

The app Smardly Voice has its own privacy statement. What you do through smardly.com, such as signing up for the Smardly Voice waiting list, is covered by this statement (see chapter 2).

4. With whom we share data

We work with a number of fixed parties. With every party that processes data on our behalf, we have a data processing agreement. They may only use your data for what we ask of them.

Party	Purpose	Which data
Laravel Cloud (hosting)	Running the website, the management environment and the database	All data from chapter 2
Mailgun	Sending service e-mails and keeping track of whether they arrive	E-mail address, name, the content of the e-mail
Mollie	Payments and the mandate for your subscription	Name, e-mail, amount and payment details. Mollie is also a controller itself for what the law requires of a payment service
Billie (only if you pay on invoice as a business)	Paying afterwards and the credit check that goes with it	Company data, contact person, invoice amount
Sentry	Technical error messages, so that we quickly see malfunctions	Technical data of the error; we deliberately do not send names or e-mail addresses
PDOK (Kadaster)	Completing your street and town when you enter your postcode and house number	Postcode and house number
European Commission (VIES)	Checking whether a VAT number is valid	VAT number
Apple, Google and Microsoft	Only if you choose to log in with their account, and for Apple also for the Wallet pass	What they give us after logging in: name, e-mail and an identifier
Google (Tag Manager and Analytics)	Website statistics, only if you give consent (see chapter 5)	Visit data of the website
Gravatar	Showing your profile photo in the management environment, if you have one at Gravatar	An encrypted form (hash) of your e-mail address
OpenAI	Only if you use the profile photo studio: turning a photo into a professional portrait	The photo you choose
Our accountant and Exact Online	The administration and the tax return	Invoice data
Carrier (such as PostNL)	Delivering your card	Name, delivery address and possibly phone or e-mail for track and trace

Otherwise we only pass on data if the law obliges us to, for example to the tax authorities.

5. Cookies and statistics

We use cookies that are necessary for the site to work, and only with your consent cookies for statistics.

Cookie	Purpose	Consent needed	How long
Session and security cookies	Staying logged in, remembering your shopping basket and securing forms	No, without these the site does not work	Until you close the browser or after 2 hours of inactivity
`smardly_consent`	Remembering whether you allowed or refused statistics	No	1 year
`smardly_campaign`	Remembering which campaign you came from, only so that a signup can be counted for that campaign. Contains only the campaign number	No, it only serves to count and contains nothing about you	Until you close the browser, or until you have signed up
Google Tag Manager and Google Analytics	Tracking how the website is used, so that we can improve it	Yes. They are only loaded when you click "accept". If you refuse, the page makes no request whatsoever to Google	According to Google's settings, at most 14 months

You can always change your choice via the link "Cookies" at the bottom of every page.

The statistics of your own profile (how often your card was scanned or your profile opened) use no cookies and no Google. We count them ourselves, without storing the visitor's IP address or other data.

Campaign links. If you follow a campaign link (for example on a flyer or a card), we count that visit itself without a cookie. From your IP address and browser we calculate an encrypted code that changes every day, and we keep only that code and the date, never your IP address. Within one day this lets us recognise that the same visitor returns, across several days it does not. We delete the codes after 90 days; the daily totals contain nothing personal.

If you arrive on our site through such a link and then create an account, we count that signup for the campaign. For that we set a cookie with only the number of the campaign. The cookie disappears when you close the browser and right after you have signed up. We do not store which account belongs to which campaign, only how many signups a campaign brings in per day.

6. Data outside the European Union

We keep your data within the European Union as much as possible. A number of the parties from chapter 4 are established in the United States or work with services there, such as Google, Apple, Microsoft, Sentry, Gravatar and OpenAI. If data goes to such a country, this only happens if the party is certified under the EU-US Data Privacy Framework or if we have agreed the standard contractual clauses of the European Commission with it.

7. Smardly Team: data of employees

If your employer uses Smardly Team, your employer is responsible for your work profile. Smardly BV is then the processor: we process that data only on behalf of your employer and in accordance with the data processing agreement we have with your employer.

Your employer can create, change and delete your work profile, and sees the statistics of the company's profiles.
Your employer does not see the private profiles you have in your own account, not even if you link your private account to your work account.
If you leave the company, your work profile stays with your employer and we break the link with your private account.
You direct questions about your work profile to your employer first. If they reach us, we pass them on.

8. Security

We take appropriate measures to protect your data. All connections are encrypted (https), we only store passwords in encrypted form, and only employees who need it for their work can access customer data. If you notice anything that points to abuse, e-mail [email protected] immediately. In the event of a data breach that entails risks for you, we inform you and the Dutch Data Protection Authority as the law requires.

9. Your rights

You have the right to:

access your data;
have incorrect data corrected;
have your data deleted, except what we are required by law to keep, such as invoices;
have the processing restricted;
object to processing based on our legitimate interest;
receive your data in a common file format (data portability);
withdraw consent you have given, without affecting what was lawfully done before.

You can do a lot yourself in your account: change or delete your profile, and unsubscribe from e-mails via the link at the bottom of every e-mail. For the rest, e-mail [email protected]. We respond within one month. To prevent someone else from requesting your data, we may ask you to confirm that the request comes from you.

We do not take decisions about you that are taken solely by a computer and that have legal effects for you.

10. Complaints

If you are not satisfied with how we handle your data, please let us know first via [email protected]. You also always have the right to lodge a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl).

11. Changes

We amend this statement if our services or the law change. The date at the top states which version applies. For a change that is important to you, we send you a message in advance. You will find earlier versions at the bottom of this page.

Contact

Smardly BV
Overhoven 5
6136 EA Sittard
E-mail: [email protected]
Telephone: +31 85 743 00 23

Previous version (29 September 2020, pdf)
Terms and conditions
Privacy statement Smardly Voice
Data processing agreement Smardly Team
Security of Smardly Voice