Privacy Policy

1. Introduction

TaggIQ Limited ("TaggIQ", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard personal data when you use our software-as-a-service platform ("Platform"), our marketing website, or our customer-facing WebStores.

TaggIQ Limited is a company registered in Ireland (CRO number 812921) with its registered address at Unit A20, Kingswood Business Park, Dublin, Ireland, D22 PC78. We comply with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the Irish Data Protection Act 2018, and other applicable data protection laws.

By using our Platform, you agree to the collection and use of information in accordance with this policy.

2. Our Role: Data Controller and Data Processor

TaggIQ acts in different data protection roles depending on the type of data involved:

2.1 When TaggIQ Is the Data Controller

We are the data controller for personal data we collect and process for our own purposes, including:

• Account registration and user profile data (name, email, phone, company name)
• Subscription billing and payment data (processed via Stripe; we do not store full card numbers)
• Marketing website visitor data (usage analytics, cookies)
• Support communications and correspondence. Where a support message includes personal data from your Platform account, that data stays subject to our role as your processor under the Data Processing Agreement. Section 8 lists the sub-processors involved in handling support requests.
• Aggregated, anonymised analytics derived from Platform usage

2.2 When TaggIQ Is the Data Processor

We act as a data processor on behalf of our customers (the data controllers) for business data they enter into the Platform, including:

• Customer contact records, quotes, orders, invoices, and payment records managed by our customers within the Platform
• End-customer data processed through customer-operated WebStores
• Supplier catalog data fetched on our customers' behalf from supplier systems the customer is authorised to access
• Data synchronised with third-party integrations enabled by the customer (e.g., Xero, QuickBooks)

Our processing of this data is governed by our Data Processing Agreement and conducted solely on the documented instructions of the customer.

2.3 WebStore Data Flows

When end-customers purchase through a TaggIQ-powered WebStore, the distributor operating that WebStore is the data controller and the merchant of record. TaggIQ processes end-customer data (name, email, shipping address, order details) as a data processor on the distributor's behalf. Payment card data is processed directly by Stripe as a sub-processor; TaggIQ does not receive or store card details for WebStore transactions.

2.4 Customer-Initiated AI Connections

The Platform supports the Model Context Protocol (MCP) and similar mechanisms that allow customers to connect third-party AI assistants (for example, Claude Desktop, claude.ai, or other LLM-based clients) to their TaggIQ account using a Personal Access Token. When a customer chooses to connect such a tool:

• the AI provider the customer selects (for example, Anthropic, OpenAI) acts as the customer's own processor or service provider under the customer's separate arrangement with that provider;
• data returned by the Platform in response to authenticated tool calls is transmitted to that AI provider in the customer's own session with the provider;
• TaggIQ is not a controller, processor, or sub-processor of the AI interaction occurring between the customer and the provider they connected; and
• the customer is responsible for ensuring their use of connected AI tools complies with applicable data protection laws, including providing any required disclosures to end-customers and other data subjects whose data may flow to the AI provider.

TaggIQ's own internal use of AI services (for example, AI-assisted error log analysis hosted within our infrastructure) is described in Section 8 (Sub-Processors) below.

3. Data Controller Contact

For matters where TaggIQ is the data controller, you can contact us at:

TaggIQ has assessed its processing activities and determined that the appointment of a Data Protection Officer is not currently required under GDPR Article 37. We reassess this position as our processing scale and product surface grow, and will appoint a Data Protection Officer if and when required. All data protection enquiries should be directed to the email address above.

4. Information We Collect

4.1 Information You Provide

• Account Information: Name, email address, phone number, company name, and billing address when you register for an account.
• Business Data: Customer records, product details, quotes, orders, invoices, and other business data you enter into the Platform (processed by us as data processor).
• Payment Information: Billing details for your subscription, processed securely by Stripe. We store only the information necessary to display your billing history and manage your subscription.
• Communications: Information you provide when contacting our support team.
• Demo and assessment requests: Name, work email address, company name, an optional phone number, and how you currently run jobs, when you ask for a demo or an assessment through a form on our website. We use it to reply, arrange the session and follow up about it, on the basis of steps taken at your request before a contract (Art. 6(1)(b)) and our legitimate interest in responding to business enquiries (Art. 6(1)(f)). We keep these requests for the period set out for support correspondence in Section 10.
• Recipients of group-order workflows: If you receive a link to submit your details to a TaggIQ Customer's Size Collection (for example, from your sports club coach, school PTA, or office manager), you may provide your name and, depending on what the organisation has chosen to collect, your email, phone, department/team/class, jersey number, initials, name-on-garment, garment size selections, and any free-text notes. The organisation that sent you the link is the Data Controller; TaggIQ is the Data Processor. See the Recipient Privacy Notice for a layered notice specific to this pathway.

4.2 Information Collected Automatically

• Usage Data: Features accessed, pages viewed, and actions taken within the Platform.
• Device Information: Browser type, operating system, device type, and IP address.
• Cookies: We use essential and analytics cookies. See Section 12 below.

4.3 Supplier Catalog Data

When customers connect their supplier accounts through our Platform, we fetch product catalog, pricing, and inventory data from those suppliers on the customer's behalf, using the customer's own supplier credentials or authorised access. This data is not publicly available. We process it solely to provide the Platform's supplier integration features and store it within the customer's isolated tenant environment.

5. Legal Basis for Processing (GDPR Article 6)

We process personal data on the following legal grounds:

• Contract Performance (Art. 6(1)(b)): Processing necessary to provide the Platform and fulfil our contractual obligations, including account management, billing, and service delivery.
• Legitimate Interests (Art. 6(1)(f)): Processing necessary for our legitimate business interests, including improving the Platform, ensuring security, preventing fraud, and generating aggregated analytics. We balance these interests against your rights and freedoms.
• Legal Obligations (Art. 6(1)(c)): Processing necessary to comply with applicable laws, including Irish tax and accounting requirements (Taxes Consolidation Act 1997) and anti-money laundering obligations.
• Consent (Art. 6(1)(a)): Where required, we obtain your explicit consent for specific processing activities, such as marketing communications. You may withdraw consent at any time.

6. How We Use Your Information

• Provide, maintain, and improve the Platform
• Process subscription billing and send related transaction confirmations
• Send administrative messages, service updates, and security alerts
• Respond to support requests
• Generate aggregated, anonymised analytics to improve the Platform (no individual is identifiable from this data)
• Detect, investigate, and prevent fraudulent or unauthorised activities
• Comply with legal obligations
• Enable Customers to collect garment sizes, personalisation preferences, and (where enabled) per-Recipient payment contributions from Recipients of their group-order workflows

We do not use customer business data (data you enter about your own customers) for any purpose other than providing the Platform services to you. We do not train third-party AI models on your individually-identifiable Customer Data. We may use aggregated, anonymised data derived from Platform usage (which does not identify you, your organisation, your end-customers, or any individual) to improve features and to develop and train our own machine learning models, as permitted by our Terms of Service.

7. Data Sharing and Disclosure

We share personal data only in the following circumstances:

• Sub-processors: Third-party service providers who assist us in providing the Platform. Each sub-processor is bound by data processing terms no less protective than our own. See Section 8 for the full list.
• Customer-enabled integrations: When you connect Xero, QuickBooks, or Stripe, data is shared with those services as directed by you. These services act as independent controllers or joint controllers for the data you send to them.
• Legal requirements: When required by law, court order, or governmental authority. We will notify you where legally permitted before making such disclosures.
• Business transfers: In connection with a merger, acquisition, or sale of assets, your data may be transferred to the successor entity. We will notify you before your data becomes subject to a different privacy policy.

We do not sell personal data to third parties. We do not share personal data with advertisers.

8. Sub-Processors

We use the following sub-processors to deliver the Platform:

We will notify customers of any material changes to our sub-processor list with at least 30 days' advance notice. Customers may object to a new sub-processor as set out in our Data Processing Agreement.

Google API Services User Data Policy. Where a customer connects their own Google Workspace/Gmail account to send documents on their behalf, TaggIQ's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. TaggIQ requests only the gmail.send scope: it can send email as the connecting user and cannot read, list, search, or otherwise access the contents of that mailbox. TaggIQ does not use this data for advertising or to train, fine-tune, or improve generalised AI or machine-learning models; does not permit human reading of it except where necessary for security, legal compliance, or with the user's explicit consent; and does not transfer it to any third party except to Google as necessary to provide the API functionality, to recipients designated by the customer, or as otherwise required by law.

9. International Data Transfers

Our primary infrastructure is hosted in the European Union (AWS eu-west-1, Ireland). Where personal data is transferred outside the European Economic Area, we ensure appropriate safeguards are in place, including:

• European Commission Standard Contractual Clauses (SCCs), as approved by Commission Implementing Decision (EU) 2021/914
• Transfers to countries with an adequacy decision from the European Commission
• For transfers to the United States, we rely on the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795) where the sub-processor is certified under that framework, and otherwise on Standard Contractual Clauses combined with supplementary technical measures including encryption in transit and at rest

You may request a copy of the relevant transfer safeguards by contacting us at privacy@taggiq.com.

10. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected:

• Account data: Retained while your account is active and for 30 days after account closure to allow reactivation. Deleted thereafter unless retention is required by law.
• Customer business data: Available for export for 30 days after subscription termination. Deleted from primary systems within 90 days of termination. Removed from backups within 180 days.
• Financial and billing records: Retained for 7 years to comply with Irish tax and accounting requirements (Taxes Consolidation Act 1997, s. 886).
• Usage and analytics logs: Retained for up to 12 months, then aggregated or deleted.
• Support correspondence: Retained for 2 years after resolution.
• Recipient data collected via Customer Size Collection forms: TaggIQ automatically anonymises Recipient Personal Data on Size Collections that have been in CLOSED status for the period the Customer has configured (default twenty-four (24) months). Anonymisation removes Recipient identity (name, email, phone, department, jersey number, initials, name-on-garment, notes) while preserving size selections and payment status for the Customer's financial records.

11. Your Rights Under GDPR

Where TaggIQ is the data controller, you have the following rights:

• Right of Access (Art. 15): Request a copy of the personal data we hold about you.
• Right to Rectification (Art. 16): Request correction of inaccurate or incomplete data.
• Right to Erasure (Art. 17): Request deletion of your personal data where there is no lawful reason for us to continue processing it.
• Right to Restrict Processing (Art. 18): Request limitation of processing in certain circumstances.
• Right to Data Portability (Art. 20): Receive your data in a structured, commonly used, machine-readable format.
• Right to Object (Art. 21): Object to processing based on legitimate interests or for direct marketing purposes.
• Right to Withdraw Consent (Art. 7(3)): Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal.

To exercise these rights, contact us at privacy@taggiq.com. We will respond within 30 days. If we need to extend this period, we will inform you within the initial 30 days with the reasons for the delay.

For data held within a customer's Platform account: If you are an end-customer or contact whose data is managed by a TaggIQ customer (the data controller), please direct your data subject request to that business directly. TaggIQ will assist the customer in fulfilling your request as required by our Data Processing Agreement.

12. Data Security

We implement appropriate technical and organisational measures to protect personal data, including:

• Encryption of data in transit (TLS 1.2+) and at rest (AWS RDS encryption, S3 server-side encryption)
• Multi-tenant data isolation: each organisation's data is logically separated at the database level. All queries are scoped to the authenticated organisation.
• Role-based access control (Owner, Sales Representative, Viewer) within each organisation
• JWT-based authentication with token rotation
• Hosted on AWS infrastructure which holds SOC 2, ISO 27001, and related certifications. TaggIQ itself does not currently hold these certifications but follows the relevant security practices.
• Regular dependency scanning and security assessment
• Documented incident response procedures

13. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify the Irish Data Protection Commission within 72 hours of becoming aware of the breach, as required by GDPR Article 33.
• Notify affected customers (data controllers) without undue delay where TaggIQ is acting as data processor, providing sufficient detail for the customer to meet its own notification obligations.
• Notify affected individuals directly where the breach is likely to result in a high risk to their rights and freedoms, as required by GDPR Article 34.

14. Cookies and Tracking Technologies

We use the following categories of cookies:

• Strictly necessary cookies: Required for the Platform to function (authentication, security, session management). These do not require consent under the ePrivacy Directive.
• Analytics cookies: Help us understand how users interact with the Platform. These are only set with your consent.
• Preference cookies: Remember your settings and preferences. Set with your consent.

If you allow analytics cookies, we record the first page you visited, the website that referred you and any campaign tag in the link, and store them with your enquiry or new account to see which channels bring customers. We never store the rest of the link. You can withdraw consent in Cookie settings, or ask privacy@taggiq.com to delete what is stored with your enquiry or account.

You can manage your cookie preferences through the cookie consent banner displayed when you first visit our website, or by adjusting your browser settings. Disabling certain cookies may affect Platform functionality.

15. Automated Decision-Making

TaggIQ does not currently use automated decision-making or profiling that produces legal effects or similarly significantly affects you, as described in GDPR Article 22. If we introduce such processing in the future, we will update this policy and provide you with appropriate information and the right to obtain human intervention.

16. Children's Privacy

Our Platform is a business-to-business service and is not directed to individuals under 18 years of age. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately at privacy@taggiq.com and we will delete it promptly.

17. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes that affect how we process your personal data, we will notify you by email at least 30 days before the changes take effect. Non-material changes (clarifications, formatting) will be reflected by updating the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

18. Complaints

If you have concerns about how we handle your personal data, please contact us first at privacy@taggiq.com. We will work to resolve your concerns promptly.

You also have the right to lodge a complaint with the Irish Data Protection Commission:

19. Contact Us

20. US State Privacy Rights

This Section 20 supplements the rest of this Privacy Policy and applies to residents of US states whose laws grant them privacy rights, including California (under the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020, "CCPA"), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA), and other US states with comparable laws (collectively, "Applicable US Privacy Law"). Defined terms in this Section have the meaning given in the applicable state law.

20.1 No Sale or Sharing of Personal Information

TaggIQ does not "sell" personal information for monetary or other valuable consideration, and does not "share" personal information for cross-context behavioural advertising, as those terms are defined under Applicable US Privacy Law. This has been true for the twelve (12) months preceding the date of this Privacy Policy and continues. TaggIQ has not sold or shared the personal information of any individual we have actual knowledge to be under 16 years of age.

20.2 Categories of Personal Information We Collect

In the twelve (12) months preceding the date of this Privacy Policy, TaggIQ has collected the following categories of personal information identified in California Civil Code §1798.140(v):

The sources from which we collect this information, the business and commercial purposes for which we collect it, and the categories of third parties to which we disclose it are described in Sections 4, 5, 6, 7, and 8 of this Privacy Policy.

20.3 Sensitive Personal Information

TaggIQ collects the following "sensitive personal information" as defined under CCPA §1798.140(ae): account log-in credentials (username and password). TaggIQ uses sensitive personal information only for the purpose of providing access control to the Platform, which falls within the exceptions in CCPA §1798.121(a) that do not trigger a "Limit Use of Sensitive Personal Information" right.

20.4 Your Rights

Subject to identity verification and to applicable exceptions, residents of covered US states have the following rights:

• Right to Know / Access: the categories and specific pieces of personal information we have collected about you.
• Right to Delete: deletion of personal information we have collected from you, subject to legal exceptions.
• Right to Correct: correction of inaccurate personal information.
• Right to Opt Out of Sale or Sharing: TaggIQ does not sell or share personal information; this right is preserved if our practices change.
• Right to Limit Use of Sensitive Personal Information: not applicable because TaggIQ uses sensitive personal information only for permitted purposes (see 20.3).
• Right to Non-Discrimination: we will not deny, charge a different price for, or provide a different level or quality of service because you exercised your privacy rights.
• Right to Data Portability: in California, this right is exercised through the Right to Access by requesting a copy in a structured, machine-readable format.
• Right to Appeal: if we decline a request, residents of states with appeal rights (including Virginia, Colorado, and Connecticut) may appeal by replying to our response within sixty (60) days, and we will respond within sixty (60) days.

20.5 How to Exercise Your Rights

Submit your request to privacy@taggiq.com. We will verify your identity by matching information you provide against information we already hold. Where the request relates to data within a TaggIQ Customer's account (where TaggIQ is the data processor and the Customer is the data controller; see Section 2 above), we will forward the request to the Customer for handling. We will respond within forty-five (45) days; we may extend this period once by up to forty-five (45) days where reasonably necessary, with notice to you within the initial response window.

20.6 Authorised Agents

You may designate an authorised agent to submit a request on your behalf. We will require: (a) signed written permission from you authorising the agent; (b) proof of the agent's identity; and (c) direct verification from you that you authorised the request.

20.7 Global Privacy Control

TaggIQ recognises the Global Privacy Control (GPC) browser signal. Because TaggIQ does not sell or share personal information as those terms are defined under Applicable US Privacy Law, the GPC signal does not change our processing. We acknowledge its receipt for compliance.

20.8 California "Shine the Light"

California residents may request information about the categories of personal information disclosed to third parties for those third parties' direct marketing purposes during the immediately preceding calendar year. TaggIQ does not disclose personal information to third parties for those parties' direct marketing purposes.

20.9 Financial Incentives

TaggIQ does not offer financial incentives or price or service differences in exchange for the collection, sale, or sharing of personal information.

20.10 Retention

TaggIQ retains personal information for the periods set out in Section 10 above. After the applicable retention period, personal information is deleted or de-identified, except where retention is required by law (such as for tax compliance under the Internal Revenue Code).

20.11 Complaints to State Authorities

You may file a complaint with your state Attorney General's office or applicable state privacy regulator. California residents may also contact the California Privacy Protection Agency at cppa.ca.gov.