Data Processing Agreement

Version 1.0 · Effective 14 October 2026

This Data Processing Agreement ("DPA") forms part of the agreement under which Tap provides Tap Teams and related services (the "Services") to the customer named in the order form or account ("Customer"). It applies whenever Tap processes Customer Personal Data while providing the Services, and takes effect when Customer accepts Tap's terms or signs an order form. Customers who need a countersigned copy can email privacy@gettap.co.

"Tap" is the Tap company named in the order form:

Tap - Digital Business Card LLC, a New York limited liability company, 447 Broadway, New York, NY, United States, for customers outside Egypt; or
Tap - Digital Business Card LLC, an Egyptian limited liability company, Maadi, Cairo, Egypt, for customers in Egypt.

If this DPA conflicts with the main agreement on data protection, this DPA prevails. If the Standard Contractual Clauses in section 10 conflict with this DPA, the Clauses prevail.

1. Definitions

Data Protection Laws: the GDPR (Regulation (EU) 2016/679), the UK GDPR, Egypt's Law 151 of 2020 and its Executive Regulations, Saudi Arabia's Personal Data Protection Law, the UAE's Federal Decree-Law 45 of 2021, US state privacy laws, and any other data protection law that applies to the processing.
Customer Personal Data: personal data Tap processes on Customer's behalf: Customer's members (employees and agents), their leads and contacts, meeting recordings, transcripts and notes, and data Customer brings in through integrations.
"Controller", "processor", "data subject", "personal data breach", "processing" and "supervisory authority" have their GDPR meanings, or the closest equivalent under other Data Protection Laws.
Sub-processor: any third party Tap engages to process Customer Personal Data.

2. Roles

Customer is the controller of Customer Personal Data and Tap is its processor. Where US state laws apply, Tap acts as a "service provider" or "processor": it will not sell or share Customer Personal Data, or use it outside the direct business relationship with Customer, except as this DPA allows.

Tap is a separate controller only for:

account, billing and contract data needed to run the commercial relationship;
security, fraud-prevention and service logs;
enrichment results it obtains from its enrichment providers, which it keeps for up to 3 months and may reuse for other customers' lookups of the same person;
aggregated, de-identified statistics that identify neither Customer nor any person.

3. Customer's instructions

Tap processes Customer Personal Data only on Customer's documented instructions: this DPA, the main agreement, and Customer's configuration and use of the Services (for example, turning on CRM sync, enrichment, meeting recording or Ask AI). Tap will tell Customer if it believes an instruction breaks Data Protection Laws. Tap processes Customer Personal Data otherwise only when the law requires it, and tells Customer first unless the law forbids that.

4. Customer's responsibilities

Customer is responsible for:

having a lawful basis for the processing, and giving the notices the law requires to its members and leads;
obtaining any consent the law requires to record a meeting. The Tap app asks the recording member to confirm before recording; Customer must make sure its members actually inform, and where required ask, the other participants;
telling its employees about Team Insights, field coverage and leaderboards, and carrying out any assessment its employment and data protection laws require for monitoring staff activity;
turning on GDPR mode on lead capture where its leads are in the EU, UK or another region that requires consent;
the accuracy and lawfulness of the data it brings in.

Customer will not use the Services to process special-category data (such as health data) unless that is necessary and lawful. Meeting recordings may incidentally contain such data; Customer controls whether to record.

5. Confidentiality and personnel

Tap gives access to Customer Personal Data only to staff and contractors who need it to provide or support the Services. They are bound by confidentiality, trained on data protection, and lose access when they leave.

6. Security

Tap applies the technical and organisational measures in Annex II. Tap may update them, provided the overall level of protection never goes down.

7. Sub-processors

Customer gives Tap general authorisation to use the sub-processors listed at gettap.co/pages/subprocessors (Annex III). Tap gives at least 30 days' notice of a new or replacement sub-processor by email to subscribers of that page. Customer may object on reasonable data protection grounds within that period. The parties will discuss it in good faith; if they cannot resolve it, Customer may terminate the affected Services and receive a pro-rata refund of prepaid fees.

Tap puts a written contract with each sub-processor that protects data at least as much as this DPA, and remains liable for its sub-processors.

Affiliate. Where the New York company is the processor, its Egyptian affiliate, Tap - Digital Business Card LLC (Egypt), is a sub-processor: it develops, operates and supports the Services under an intra-group agreement on the terms of this DPA.

8. Personal data breaches

Tap notifies Customer without undue delay, and within 48 hours, of becoming aware of a personal data breach affecting Customer Personal Data. The notice describes, as far as Tap knows: the nature of the breach; the categories and approximate number of people and records affected; the likely consequences; and the measures taken or proposed. Tap may provide information in phases. Notifying Customer is not an admission of fault.

9. Help with rights and compliance

The Services let Customer's admins export, correct and delete leads, notes, meetings and members themselves, and export one lead's data for that person's request.
If a data subject contacts Tap about Customer Personal Data, Tap forwards the request to Customer and does not answer it unless Customer asks it to.
Tap gives reasonable help with data protection impact assessments, prior consultations and regulator enquiries, using the information it has.

10. International transfers

Tap hosts Customer Personal Data on Amazon Web Services in the United States. Its Egyptian affiliate accesses it from Egypt to operate and support the Services, and some sub-processors process it in the countries listed in Annex III.

For personal data protected by the GDPR transferred to a country without an adequacy decision, the parties incorporate the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914):

Module 2 (controller to processor) between Customer as exporter and Tap as importer;
Module 3 (processor to processor) between Tap and its Egyptian affiliate and other sub-processors, which Tap puts in place.

Clause choices: Clause 7 (docking) applies; Clause 9, option 2 (general authorisation) with the notice period in section 7; the optional wording in Clause 11 does not apply; Clause 13 and Annex I.C: the supervisory authority competent for Customer as data exporter under Clause 13(a); Clauses 17 and 18: the law and courts of Ireland. Annexes I, II and III of this DPA complete the Clauses' Annexes.

For personal data protected by the UK GDPR, the UK International Data Transfer Addendum (version B1.0) applies to the Clauses. For Swiss data, the Clauses apply with the FDPIC as the competent authority and references to the GDPR read as the Swiss FADP.

Tap has assessed the laws of the destination countries and applies the measures in Annex II, including encryption in transit, access controls and challenging unlawful requests for access. For personal data from Egypt, Saudi Arabia and the UAE, Tap relies on the transfer licence, standard clauses or data subject consent that those laws require. For Egypt, that is the cross-border transfer licence of the Personal Data Protection Center.

11. Audits

Tap makes available the information needed to show compliance with this DPA, including security documentation and answers to reasonable security questionnaires. At most once a year (or more often if a regulator requires it or after a breach), with 30 days' notice and at its own cost, Customer may audit Tap's compliance, itself or through an independent auditor bound by confidentiality. Tap may meet audit requests with current third-party reports where they cover the scope.

12. Return and deletion

When the Services end, Customer can export its data for 30 days. After that, Tap deletes Customer Personal Data from its live systems within 30 days, and from backups within 35 days of that, unless the law requires Tap to keep it. Tap confirms the deletion in writing on request. Copies Customer sent to its own CRM or connected tools are outside Tap's control.

13. Liability and term

Each party's liability under this DPA follows the limits in the main agreement, except where Data Protection Laws do not allow limitation. This DPA lasts as long as Tap processes Customer Personal Data.

Annex I: Description of processing

A. Parties. Exporter / controller: Customer, as identified in the order form; contact: Customer's account admin. Importer / processor: the Tap company named in the order form; contact: privacy@gettap.co. EU and UK representatives: being appointed; details will be published in Tap's Privacy Policy.

B. Data subjects. (1) Customer's members: employees and agents with Tap accounts. (2) Customer's leads and contacts: people who exchange details with a member, are added, imported or synced from a CRM. (3) Participants in meetings a member records.

C. Categories of personal data. Members: name, title, company, department, work email, phone, photo, social links, card content, sign-in data, device push tokens, app activity, approximate meeting location. Leads: name, title, company, email, phone, address, social links, notes, custom form fields, lead score, tags, enriched work email and phone, consent records, emails sent from Tap. Meetings: audio, transcripts, AI summaries, action items, extracted observations (topics, sentiment, objections, buying signals, competitors), Ask AI conversations.

D. Special categories. None intended. Meeting audio may incidentally contain any category of data, including health data.

E. Frequency. Continuous, while the Services are used.

F. Nature and purpose. Hosting, storing and displaying Customer Personal Data; capturing leads; recording, transcribing and analysing meetings with AI; enriching contact details on request; syncing with Customer's CRM and calendar tools; notifications; analytics for Customer (Team Insights, field coverage); support.

G. Retention. As long as Customer keeps the data in the Services, subject to the retention schedule in Tap's Privacy Policy (including deletion of meeting audio after 30 days) and section 12.

H. Transfers to sub-processors. As listed in Annex III, for the purposes stated there.

Annex II: Technical and organisational measures

Encryption: TLS for all connections to the Services and between Tap and its sub-processors.
Hosting: Amazon Web Services (us-east-1). Production secrets in AWS Secrets Manager, not in code. Access to production limited to named operators.
Tenant isolation and access control: every request is authorised against the user's company, department and role; cross-company access is refused and covered by automated tests. Credential tools cannot target the operator's own account or staff accounts.
Authentication: passwords and one-time codes stored hashed; codes expire after 10 minutes and lock after repeated failures; per-account and per-IP rate limits; sign-in provider tokens verified server-side; sessions expire after 180 days of inactivity.
Media: meeting recordings, voice notes and lead-capture files stored as private objects, served through links that expire within hours after a permission check.
Logging: credentials and secrets are scrubbed from every log record automatically; lead and meeting content are not logged by design; audit trail of account and settings changes kept 12 months.
Minimisation and retention: meeting audio deleted after 30 days; IP addresses of card visitors and consent records stored shortened; meeting coordinates rounded and reduced to an area after 90 days; scheduled deletion of expired data; account erasure 30 days after a deletion request, with a tombstone record of the erasure.
Vendors: written data protection terms with every sub-processor; AI providers may not train on Customer Personal Data.
Resilience: managed database with automated backups; containerised services that restart automatically.
Incidents: documented incident response and breach notification procedure, with customer notification within 48 hours.
People: confidentiality obligations and data protection training for staff with access; access removed on departure.

Annex III: Sub-processors

The current list, with each sub-processor's purpose and location, is published at gettap.co/pages/subprocessors.