Privacy Policy

Effective Date: January 1, 2026
Last Updated: January 1, 2026
Platform: TicTAP – Simply Connect, Vcards by TicTAP, TapInPack by TicTAP

1. Introduction

This Privacy Policy (“Policy”) explains how Bretenbits S.L. (hereinafter “TicTAP,” “we,” “our,” or “us”), as the creator and operator of the TicTAP platforms (collectively, the “Platform”), handles personal data in connection with the provision of its services.

This Policy is drafted in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, “GDPR”), Law 34/2002 of July 11 on Information Society Services and Electronic Commerce (LSSI), and all other applicable data protection legislation.

1.1 Scope of Application

This Policy applies to all personal data processed by TicTAP in connection with the Platform, including but not limited to:

• Data collected through registration forms and account creation;
• Data collected through contact forms and customer support;
• Data collected through the TicTAP websites (www.tictap.me, etc.);
• Data collected through cookies and similar tracking technologies;
• Data processed by sub-processors on behalf of TicTAP.

1.2 Infrastructure-Only Nature of the Platform

TicTAP operates exclusively as an infrastructure and technology provider. The Platform provides technical infrastructure — including hosting, storage, database management, and software tools — that enables Users to create, manage, and share their own content and data. TicTAP does not create, own, process, or control User Content or User Data stored within the Platform. All data uploaded, stored, and processed through the Platform is created, owned, and controlled by the respective Users. Users are the sole data controllers for their own data.

2. Data Controller

Bretenbits S.L. (NIF: B66647660) is the data controller for the personal data that Users directly provide to TicTAP through the Platform’s registration mechanisms, contact forms, and other explicit data submission interfaces.

• Identity: Bretenbits S.L.
• Address: Calle Calabria 173, 6o 4a, 08015 Barcelona, Spain
• NIF: B66647660
• Email: [email protected]
• Telephone: +34 93 459 98 69

TicTAP has designated a Data Protection Officer (DPO). Questions regarding the processing of personal data may be directed to the DPO at the email address provided above.

3. Categories of Personal Data Collected

3.1 Data Collected Directly from Users

The following personal data may be collected directly from Users through the Platform:

3.2 Data Collected Through Platform Usage

• Technical data: IP addresses, browser type, operating system, referring URLs, pages accessed, dates and times of access;
• Cookies and similar technologies: Session identifiers, preferences, analytics data;
• Log files: Records of platform usage and system operations.

3.3 Data Stored Within the Platform by Users

Users may upload, store, and process their own data through the Platform. This data is created, owned, and controlled by Users. TicTAP does not collect, process, or control this data beyond providing the technical infrastructure necessary to store and retrieve it. Users are solely responsible for the lawfulness and accuracy of such data.

4. Legal Basis for Processing

The legal basis for processing personal data is as follows:

5. Data Controller vs. Infrastructure Provider — Critical Distinction

5.1 TicTAP’s Role as Infrastructure Provider

TicTAP’s role is strictly limited to providing technical infrastructure. TicTAP:

• Hosts and stores User data on secure servers;
• Provides the software tools and interfaces through which Users manage their data;
• Ensures the technical security and availability of the Platform;
• Processes data only as strictly necessary to provide, operate, maintain, and improve the Platform.

TicTAP does not make any decisions regarding the purposes or means of processing User Content or User Data. Users are the sole data controllers for all data they upload, store, or process through the Platform.

5.2 User as Data Controller

Users are solely responsible for:

• Determining the purposes and means of processing their data;
• Obtaining all necessary consents from data subjects before uploading their personal data to the Platform;
• Ensuring compliance with all applicable data protection laws regarding their data;
• Managing data subject rights requests (access, rectification, erasure, etc.) related to their data stored in the Platform.

TicTAP shall not be held responsible or liable for any data processing activities conducted by Users through the Platform, provided that TicTAP has not been expressly notified of the illegality of such activities and has not acted with actual knowledge of such activities.

6. Special Categories of Personal Data (Article 9 GDPR)

6.1 Prohibition on Upload of Special Category Data

Users acknowledge that the Platform may not be used to upload, store, or process special categories of personal data as defined in Article 9 of the GDPR, including but not limited to:

• Data revealing racial or ethnic origin;
• Political opinions;
• Religious or philosophical beliefs;
• Trade union membership;
• Genetic data;
• Biometric data (for identification purposes);
• Health data;
• Data concerning a person’s sex life or sexual orientation.

6.2 TicTAP’s Exemption

TicTAP explicitly disclaims any responsibility for the existence, storage, processing, or transmission of special category personal data within the Platform. TicTAP:

• Does not collect, review, verify, or monitor the nature of data uploaded by Users;
• Has no obligation to detect, flag, or remove special category data;
• Shall not be held liable for the presence of such data in the Platform;
• Is exempt from liability provided it has not been expressly notified of the existence of such data and has not acted with actual knowledge of its existence.

Users are solely and exclusively responsible for ensuring that no special category personal data is uploaded to, stored in, or processed through the Platform. Users acknowledge that any violation of this prohibition is entirely their responsibility and shall indemnify TicTAP against any resulting claims, liabilities, or damages.

6.3 Data of Minors

The Platform may not be used to collect or process personal data of minors (individuals under 16 years of age, or such other age as specified by applicable national law).

Users are solely responsible for ensuring that:

• No personal data of minors is uploaded to the Platform without the verifiable parental consent or authorization of a parent, guardian, or legal representative;
• Appropriate consent mechanisms are in place for any minors whose data may be processed;
• All applicable laws regarding the protection of minors’ personal data are complied with.

TicTAP shall not be held liable for the existence or processing of personal data of minors in the Platform, provided that TicTAP has not been expressly notified of such data and has not acted with actual knowledge of its existence. Users acknowledge full responsibility for any breach of this provision and shall indemnify TicTAP against any resulting claims, liabilities, or damages.

7. Data Recipients and International Transfers

7.1 Data Recipients

TicTAP does not provide User data to third parties, except:

• Sub-processors: Third-party service providers (cloud hosting, infrastructure services, payment processors) who process data on TicTAP’s behalf and under TicTAP’s instructions;
• Legal requirements: Where disclosure is required by law, regulation, court order, or government authority;
• Protection of rights: To protect TicTAP’s rights, property, or safety, or that of its users and the public.

7.2 Sub-processors

TicTAP engages sub-processors to provide essential infrastructure services. All sub-processors are bound by Data Processing Agreements (DPAs) that ensure they process data only as instructed by TicTAP and maintain appropriate technical and organizational security measures.

A current list of sub-processors may be requested by emailing: [email protected]

7.3 International Data Transfers

Personal data may be transferred to countries outside the European Economic Area (EEA). TicTAP ensures an adequate level of protection through:

• Standard Contractual Clauses (SCCs) as approved by the European Commission;
• Binding Corporate Rules (BCRs) where applicable;
• Adequacy decisions where applicable;
• Other appropriate safeguards as required by applicable law.

7.4 Infrastructure Provider Exemption

As an infrastructure provider, TicTAP’s sub-processors process data strictly as instructed by TicTAP for technical purposes (hosting, storage, transmission). TicTAP’s sub-processors do not process, analyze, or make decisions about User Content or User Data beyond the technical provision of infrastructure services.

8. Data Retention

8.1 Data Collected by TicTAP

Personal data collected directly by TicTAP (through registration forms, contact forms, etc.) is retained for:

• As long as necessary to fulfill the purposes for which it was collected;
• For the duration of the service provided to the User;
• For legal or regulatory obligations, to manage TicTAP’s rights (e.g., to file lawsuits), or for statistical or historical purposes.

8.2 User Data Stored in the Platform

Data stored by Users within the Platform remains under Users’ control. Users may delete their data at any time.

5-year retention guarantee. TicTAP guarantees the retention of User data stored in the Platform — including form submission history — for 5 years from its collection or last update. After this period, TicTAP may delete or anonymize such data, without prejudice to applicable legal obligations.

Extended retention. If a User needs to preserve data for a longer period, this must be expressly agreed with TicTAP (for example, through an extended retention plan or specific agreement). Without such an agreement, TicTAP does not guarantee the availability of data beyond the 5-year period.

TicTAP retains the right to delete data from the Platform upon request or upon termination of the User’s account, subject to this section and applicable legal obligations.

8.3 Data Deletion

Once the statutory retention periods and the 5-year period set out in section 8.2 have expired (except where an extended retention agreement applies), TicTAP will delete or anonymize personal data from its systems. Users may request deletion of their personal data by contacting [email protected].

9. Data Security

9.1 Technical Measures

TicTAP has implemented appropriate technical and organizational security measures to protect personal data against unauthorized access, loss, misuse, alteration, or destruction, including:

• TLS/HTTPS encryption for all data transmitted between Users and the Platform;
• Encrypted storage of personal data on secure servers;
• Access controls restricting internal access to personal data;
• Regular security assessments and vulnerability testing;
• Backup and disaster recovery procedures.

9.2 Limitations of Security

Users acknowledge that:

• No method of transmission over the Internet or electronic storage is 100% secure;
• TicTAP cannot guarantee absolute security against all threats;
• Security measures are implemented to the extent required by applicable law and industry standards;
• TicTAP is not liable for breaches caused by factors beyond its reasonable control.

9.3 Infrastructure Security

TicTAP ensures that its infrastructure (servers, databases, network) is secured through industry-standard measures. However, TicTAP does not control the security of data once it has been uploaded by Users or downloaded by Users from the Platform. Users are responsible for implementing appropriate security measures on their end.

10. Data Subject Rights

Users may exercise the following rights regarding their personal data collected directly by TicTAP, by sending a request to [email protected]:

10.1 Rights Under the GDPR

• Right to access: Obtain confirmation that data is being processed and access to such data;
• Right to rectification: Correct inaccurate or incomplete data;
• Right to erasure (“right to be forgotten”): Request deletion of personal data;
• Right to restriction of processing: Limit the processing of personal data;
• Right to data portability: Receive personal data in a structured, commonly used, and machine-readable format;
• Right to object: Object to the processing of personal data;
• Right to withdraw consent: Withdraw consent at any time (where processing is based on consent);
• Right to lodge a complaint: File a complaint with the competent supervisory authority (e.g., the Spanish Agency for Data Protection — AEPD).

10.2 Exercise of Rights

Requests to exercise data subject rights will be processed within one (1) month of receipt. TicTAP may request additional information to verify the identity of the requester before processing such requests.

10.3 Limitations

Rights may be limited where:

• The data is necessary for legal claims or defense;
• The data is subject to legal professional privilege;
• The data is necessary for compliance with a legal obligation;
• The request is manifestly unfounded or excessive.

10.4 User Data Stored in the Platform

Data subject rights requests regarding data stored within the Platform by Users must be directed by the data subject to the respective User (the data controller). TicTAP does not process, review, or respond to data subject rights requests regarding User Content, as TicTAP is not the data controller for such data.

11. Cookies and Tracking Technologies

11.1 Use of Cookies

The Platform uses cookies and similar tracking technologies to:

• Maintain user sessions;
• Improve platform performance;
• Analyze website traffic;
• Personalize user experience.

11.2 Types of Cookies

• Essential/Technical cookies: Required for the Platform to function (session management, security);
• Analytics cookies: Used to analyze website traffic and user behavior (e.g., Google Analytics);
• Third-party cookies: Placed by third-party services integrated into the Platform.

11.3 Cookie Consent

Users are informed about the use of cookies upon their first visit and may manage their cookie preferences through their browser settings or through the Platform’s cookie consent mechanism.

11.4 Third-Party Cookies

The Platform may include third-party services that place cookies on Users’ devices. TicTAP is not responsible for the privacy practices or data processing activities of third-party services. Users are encouraged to review the privacy policies of any third-party services they interact with.

12. Marketing Communications

12.1 Newsletter and Commercial Communications

With Users’ consent, TicTAP may send commercial communications, newsletters, and promotional materials. Users may opt out of such communications at any time by clicking the unsubscribe link in any email or by contacting [email protected].

12.2 No Marketing of User Data

TicTAP does not sell, rent, share, or otherwise market User data to third parties. Users’ personal data collected directly by TicTAP is never used for purposes beyond those described in this Policy.

13. Children’s Privacy

TicTAP does not knowingly collect personal information from children under the age of 16 (or such other age as specified by applicable law). If TicTAP becomes aware that it has collected personal information from a child without verifiable parental consent, it will take steps to delete such information.

Users are solely responsible for ensuring that children under the applicable age do not use the Platform or submit personal information.

14. International Transfers — Summary

TicTAP may transfer personal data outside the EEA only pursuant to appropriate safeguards as required by the GDPR, including Standard Contractual Clauses, Binding Corporate Rules, or adequacy decisions. A list of recipient countries and the corresponding transfer mechanism is available upon request at [email protected].

15. Changes to This Privacy Policy

TicTAP reserves the right to modify this Privacy Policy at any time. Changes will be effective upon being posted on the Platform’s website. Users will be notified of significant changes via email or through notifications on the Platform.

Users are encouraged to review this Privacy Policy periodically. Continued use of the Platform after changes are posted constitutes acceptance of the modified Privacy Policy.

16. Contact

For any questions, concerns, or requests regarding this Privacy Policy or the processing of personal data:

• Email: [email protected]
• Telephone: +34 93 459 98 69
• Address: Calle Calabria 173, 6o 4a, 08015 Barcelona, Spain
• DPO: Available upon request at the above email address

To file a complaint with a supervisory authority, contact the Spanish Agency for Data Protection (AEPD) at https://www.aepd.es/

17. Final Provisions

17.1 Governing Law

This Privacy Policy shall be governed by and construed in accordance with the laws of Spain.

17.2 Severability

If any provision of this Privacy Policy is found to be invalid or unenforceable, the remaining provisions shall continue in full force and effect.

17.3 Entire Agreement

This Privacy Policy constitutes the complete and final agreement between the parties regarding the processing of personal data in connection with the Platform and supersedes all prior agreements, representations, or undertakings.

17.4 Acknowledgment

BY USING THE PLATFORM, YOU ACKNOWLEDGE THAT YOU HAVE READ, UNDERSTOOD, AND AGREE TO THIS PRIVACY POLICY IN ITS ENTIRETY. YOU FURTHER ACKNOWLEDGE THAT TICTAP ACTS SOLELY AS AN INFRASTRUCTURE PROVIDER AND THAT YOU ARE THE SOLE DATA CONTROLLER FOR ALL DATA YOU UPLOAD, STORE, OR PROCESS THROUGH THE PLATFORM.

Date of Last Revision: January 1, 2026
Version: 20261

© 2026 Bretenbits S.L. All rights reserved.