Privacy Policy

1. Who we are

A2Linx is a digital business card service operated by A2 Technology Group BV/SRL, Brussels, Belgium ("A2Linx", "we", "us"). We are the data controller for personal data processed through this service.

Contact: [email protected]

2. What data we collect

Data	Why we collect it	Legal basis
Name, email, password hash	Account creation and authentication	Contract performance (Art. 6(1)(b) GDPR)
Card content (name, title, photo, contact info)	To create and display your digital business card	Contract performance
Contact submissions from card visitors	Provided to card owner; you are the controller for these	Legitimate interest of card owner
Hashed IP, device type, referrer	Anonymous analytics (views per card)	Legitimate interest (Art. 6(1)(f))
Stripe customer ID	Payment processing (Pro plan)	Contract performance
GDPR consent timestamp	Evidence of lawful processing	Legal obligation (Art. 6(1)(c))

3. What we do NOT collect

• We never store raw IP addresses — only a one-way hash
• We do not use tracking pixels, third-party analytics, or advertising cookies
• We do not sell or share your data with third parties except Stripe (payments)
• We do not use your data for profiling or automated decision-making

4. Data retention

• Account data: Retained until you delete your account
• Card view analytics: Automatically deleted after 90 days
• Contact submissions: Retained until card owner deletes them
• Billing records: Retained for 7 years (Belgian tax law obligation)

5. Your rights under GDPR

As a data subject under EU GDPR, you have the right to:

• Access — download all data we hold about you (Settings → Export my data)
• Rectification — correct inaccurate data (edit directly in your account)
• Erasure — delete your account and all associated data (Settings → Delete account)
• Portability — receive your data in a machine-readable format (Settings → Export my data)
• Restriction — request we restrict processing of your data
• Object — object to processing based on legitimate interest

To exercise any right not covered by the self-service options above, email [email protected]. We will respond within 30 days.

6. Card visitors (contact capture)

When a visitor submits their contact details through a card's "Save Contact" form, those details are stored and provided to the card owner. The card owner becomes the data controller for that visitor's data. Before submitting, visitors are informed that their data will be shared with the card owner.

Visitors may request deletion of their submitted data by contacting [email protected] with the URL of the card they submitted to.

7. Cookies

We use one cookie: an authentication session cookie (token) set when you log in. This cookie is:

• HttpOnly (not accessible to JavaScript)
• Secure (only sent over HTTPS)
• SameSite=Lax (CSRF protection)
• Expires after 30 days

This is a strictly necessary cookie required for the service to function. No consent is required under ePrivacy Directive Art. 5(3) for strictly necessary cookies.

8. Third-party processors

Processor	Purpose	Location	Safeguard
Stripe	Payment processing	USA / EU	Standard Contractual Clauses
DigitalOcean	Server hosting	Amsterdam, NL	EU-based, GDPR compliant
Google Fonts	Typography (loaded from Google CDN)	USA	No personal data transferred

9. Data transfers outside the EU

Your data is hosted on DigitalOcean's Amsterdam (AMS3) data centre within the EU/EEA. Stripe processes payment data and may transfer data to the USA under Standard Contractual Clauses. No other transfers outside the EEA occur.

10. Security

We implement appropriate technical measures including: bcrypt password hashing (cost factor 12), HTTPS-only access, httpOnly cookies, helmet.js security headers, rate limiting on authentication endpoints, input sanitisation, and parameterised SQL queries (no SQL injection risk).

11. Supervisory authority

You have the right to lodge a complaint with the Belgian Data Protection Authority (APD/GBA): dataprotectionauthority.be · +32 2 274 48 00

12. Legitimate interest balancing test (Art. 6(1)(f))

We process hashed IP addresses, device type, and referrer data for analytics under legitimate interest. Our balancing assessment:

• Purpose: Providing card owners with aggregated view statistics so they can understand their card's reach. This is a core product feature.
• Necessity: We use the minimum data needed (hashed, not raw IP; no user tracking across sessions).
• Balancing: The data subject impact is minimal — IPs are one-way hashed with a server-side salt, making re-identification practically impossible. No individual profiling occurs. We auto-delete after 90 days. We assessed that this processing does not override data subjects' interests, rights or freedoms.

13. Age and children's data (Art. 8)

A2Linx is a professional networking tool intended for use by individuals aged 16 and over. We do not knowingly collect personal data from children under 16. If you believe a child under 16 has created an account, please contact [email protected] and we will delete the account promptly.

14. Data Processing Agreement for business users (Art. 28)

When business users ("card owners") use A2Linx to collect contact information from their clients and prospects, A2Linx acts as a data processor on behalf of the card owner (who is the data controller for those contacts).

By accepting these terms, business users agree to our Data Processing Agreement (DPA), which includes:

• A2Linx processes contact data only on the documented instructions of the card owner
• A2Linx implements appropriate technical and organisational security measures (Art. 32)
• A2Linx does not engage sub-processors beyond those listed in section 8 without notification
• A2Linx deletes or returns contact data upon account termination
• A2Linx assists card owners in responding to data subject rights requests relating to contacts
• A2Linx notifies card owners of any personal data breach within 48 hours of becoming aware

Card owners are responsible for ensuring they have a lawful basis to collect and process their contacts' personal data through A2Linx, and for providing their contacts with appropriate privacy information. For a full DPA document, email [email protected].

15. Changes to this policy

We will notify registered users by email of any material changes to this policy at least 30 days before they take effect.