Privacy Statement Smardly BV

This is a translation. In case of any difference, the Dutch version prevails.

Version: 28 October 2026 — replaces the version of 29 September 2020.

1. Who we are

Smardly BV makes digital business cards (Smardly Tap), the associated NFC cards and the app Smardly Voice. We are the controller for the processing of your personal data as described in this statement.

Smardly BV
Mgr. Buxckstraat 8
6134 AP Sittard
Chamber of Commerce number 80435602
E-mail: [email protected]

This statement applies to smardly.com, the online management environment, the public profile pages, the order page and the app Smardly Voice. If you are an employee of a company that uses Smardly Team, that company is responsible for your work profile and we process that data on behalf of the company (see chapter 7).

We never sell your data and do not use it to target advertisements at you.

2. Which data we process, for what purpose and for how long

We only process what is necessary for the purpose in the first column. The legal basis states on what legal ground this is done.

Purpose	Which data	Legal basis	Retention period
Your account	Name, e-mail address, password (stored encrypted), language, and when logging in with Apple, Google or Microsoft the identifier that party gives us	Performance of the contract	As long as your account exists
Proof of your consent when signing up	The exact text you agreed to, date, time and IP address	Legal obligation (demonstrating consent)	As long as your account exists
Your profile and business card	What you enter yourself: name, job title, company, phone, e-mail, address, website, social media, photo, logo and colours. We keep earlier versions of your profile so that you can go back	Performance of the contract	As long as the profile exists
Your public profile page, Wallet pass and QR code	The same profile data. These are meant to be shared: anyone with the link, the QR code or your card can see them	Performance of the contract	As long as the profile exists
Statistics of your profile	Per visit: date, time, how the profile was opened (NFC, QR or link) and the referring page. No IP address and no data with which we can recognise the visitor	Legitimate interest (showing you how your card is used)	As long as the profile exists
Orders and delivery	Name, company name, invoice and delivery address, e-mail, phone, VAT number, what you ordered, and for a custom design the logo or image you supply	Performance of the contract	7 years (statutory tax retention obligation)
Payments and subscriptions	Payment status, payment method and the reference of the payment or mandate at Mollie. We do not see or store your full bank or card number	Performance of the contract	7 years (statutory tax retention obligation)
Invoices and accounting	Invoice data and the VAT number, which we check in the European VIES system	Legal obligation	7 years
Waiving the right of withdrawal and accepting the terms	The text you agreed to, the version of the terms, date and time	Legal obligation and legitimate interest (evidence)	7 years, together with the order
Withdrawal from a purchase	Name, e-mail, order number, what you withdraw from, date, time and IP address	Legal obligation	2 years after handling
Service e-mails	E-mail address, subject, whether the e-mail was delivered and whether it was opened	Performance of the contract and legitimate interest (checking that important e-mails arrive)	1 year
Reminder for an unfinished order	E-mail address and the contents of your shopping basket	Legitimate interest. You can unsubscribe in every reminder	Until the order is completed or you unsubscribe, at most 30 days
Waiting lists and newsletter (such as Smardly Voice and Smardly Team)	Name, e-mail, possibly company and what you tell us, your consent text, IP address and via which link you came	Consent	Until you unsubscribe or until launch, then another 1 year
Contact form and customer service	Name, e-mail, your message, language and IP address	Legitimate interest (answering your question)	2 years after the last contact
Security and malfunctions	Login session, IP address, browser and technical error messages	Legitimate interest (a secure and working service)	Sessions until you log out or after 2 hours of inactivity; error messages 90 days

If you give us data of someone else, for example a different delivery address or the contact details of a colleague on a card, make sure that person knows about it.

3. Smardly Voice: your recordings stay yours

Smardly Voice records conversations, converts them into text and makes a summary. This happens on your own device.

Recordings, transcripts and summaries do not reach us. They are stored on your iPhone, iPad or Mac and, if you turn it on, in your own iCloud. That storage is yours and falls under the arrangements between you and Apple. Smardly BV cannot view, recover or delete them.
The microphone. The app asks for access to your device's microphone so it can record. You grant that permission yourself in iOS or macOS, and you can withdraw it there as well. What you record stays on your device.
The first time, you do need an internet connection. To turn speech into text, the app uses Apple's speech model. Your device fetches that model from Apple once; after that, transcription works without a connection. Nothing you recorded is sent along — only a model comes in.
What does reach us: that you log in with your Smardly account, whether you are entitled to unlimited transcription (Pro or a Team Pro licence) and, if you take out a subscription in the App Store, the proof of that purchase, so that we can link it to your account.
The counter for free transcriptions is kept in the app on your device, not with us.
If you connect a recording device, the connection goes directly between the device and your device.
If you record a conversation with others, you are responsible for what you do with that recording. Tell the other participants in advance that you are recording. See also article 8.3 of the terms and conditions.

Retention period: as long as you keep them. If you delete a recording or the app, it is gone; it has never been with us.

4. With whom we share data

We work with a number of fixed parties. With every party that processes data on our behalf, we have a data processing agreement. They may only use your data for what we ask of them.

Party	Purpose	Which data
Laravel Cloud (hosting)	Running the website, the management environment and the database	All data from chapter 2, except Voice recordings
Mailgun	Sending service e-mails and keeping track of whether they arrive	E-mail address, name, the content of the e-mail
Mollie	Payments and the mandate for your subscription	Name, e-mail, amount and payment details. Mollie is also a controller itself for what the law requires of a payment service
Billie (only if you pay on invoice as a business)	Paying afterwards and the credit check that goes with it	Company data, contact person, invoice amount
Sentry	Technical error messages, so that we quickly see malfunctions	Technical data of the error; we deliberately do not send names or e-mail addresses
PDOK (Kadaster)	Completing your street and town when you enter your postcode and house number	Postcode and house number
European Commission (VIES)	Checking whether a VAT number is valid	VAT number
Apple, Google and Microsoft	Only if you choose to log in with their account, and for Apple also for the Wallet pass and purchases in the App Store	What they give us after logging in: name, e-mail and an identifier
Google (Tag Manager and Analytics)	Website statistics, only if you give consent (see chapter 5)	Visit data of the website
Gravatar	Showing your profile photo in the management environment, if you have one at Gravatar	An encrypted form (hash) of your e-mail address
Our accountant and Exact Online	The administration and the tax return	Invoice data
Carrier (such as PostNL)	Delivering your card	Name, delivery address and possibly phone or e-mail for track and trace

Otherwise we only pass on data if the law obliges us to, for example to the tax authorities.

5. Cookies and statistics

We use cookies that are necessary for the site to work, and only with your consent cookies for statistics.

Cookie	Purpose	Consent needed	How long
Session and security cookies	Staying logged in, remembering your shopping basket and securing forms	No, without these the site does not work	Until you close the browser or after 2 hours of inactivity
`smardly_consent`	Remembering whether you allowed or refused statistics	No	1 year
Google Tag Manager and Google Analytics	Tracking how the website is used, so that we can improve it	Yes. They are only loaded when you click "accept". If you refuse, the page makes no request whatsoever to Google	According to Google's settings, at most 14 months

You can always change your choice via the link "Cookies" at the bottom of every page.

The statistics of your own profile (how often your card was scanned or your profile opened) use no cookies and no Google. We count them ourselves, without storing the visitor's IP address or other data.

6. Data outside the European Union

We keep your data within the European Union as much as possible. A number of the parties from chapter 4 are established in the United States or work with services there, such as Google, Apple, Microsoft, Sentry and Gravatar. If data goes to such a country, this only happens if the party is certified under the EU-US Data Privacy Framework or if we have agreed the standard contractual clauses of the European Commission with it.

7. Smardly Team: data of employees

If your employer uses Smardly Team, your employer is responsible for your work profile. Smardly BV is then the processor: we process that data only on behalf of your employer and in accordance with the data processing agreement we have with your employer.

Your employer can create, change and delete your work profile, and sees the statistics of the company's profiles.
Your employer does not see the private profiles you have in your own account, not even if you link your private account to your work account.
If you leave the company, your work profile stays with your employer and we break the link with your private account.
You direct questions about your work profile to your employer first. If they reach us, we pass them on.

8. Security

We take appropriate measures to protect your data. All connections are encrypted (https), we only store passwords in encrypted form, and only employees who need it for their work can access customer data. If you notice anything that points to abuse, e-mail [email protected] immediately. In the event of a data breach that entails risks for you, we inform you and the Dutch Data Protection Authority as the law requires.

9. Your rights

You have the right to:

access your data;
have incorrect data corrected;
have your data deleted, except what we are required by law to keep, such as invoices;
have the processing restricted;
object to processing based on our legitimate interest;
receive your data in a common file format (data portability);
withdraw consent you have given, without affecting what was lawfully done before.

You can do a lot yourself in your account: change or delete your profile, and unsubscribe from e-mails via the link at the bottom of every e-mail. For the rest, e-mail [email protected]. We respond within one month. To prevent someone else from requesting your data, we may ask you to confirm that the request comes from you.

We do not take decisions about you that are taken solely by a computer and that have legal effects for you.

10. Complaints

If you are not satisfied with how we handle your data, please let us know first via [email protected]. You also always have the right to lodge a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl).

11. Changes

We amend this statement if our services or the law change. The date at the top states which version applies. For a change that is important to you, we send you a message in advance. You will find earlier versions at the bottom of this page.

Contact

Smardly BV
Mgr. Buxckstraat 8
6134 AP Sittard
E-mail: [email protected]
Telephone: +31 85 743 00 23

Previous version (29 September 2020, pdf)
Terms and conditions
Data processing agreement Smardly Team