Privacy policy
Last updated: 20 October 2026
This English version is a courtesy translation. In case of discrepancy, the Spanish version prevails.
The key points: we do not sell or share your data, we do not use it for advertising, and the person opening a card is not identified. Your data is hosted in the European Union and you can download or delete it whenever you like.
Who is the controller
The controller of the data described here is INDOLE DATA TECHNOLOGY S.L.L., NIF B39887120, Paseo del Niño 3, 39300 Torrelavega (Cantabria), Spain. For any question about your data, write to oscar@indole.es.
One important distinction: when someone leaves their details on another person’s or organisation’s card, the controller of that data is the card holder, and TARJE2ME processes it on their behalf as a processor (see section 3).
What data we process, why, and on what legal basis
| Who you are | Data | Purpose | Legal basis |
|---|---|---|---|
| Website visitor | Technical connection data; whatever you type into a form (name, email, phone, organisation, message) | Serving the website securely; answering your enquiry, demo, dossier or waiting-list request | Legitimate interest in website security; your consent when you submit the form; pre-contractual steps if you request a demo or a quote |
| Card holder | Account (name and email; you sign in without a password, using a one-time code sent to your email), what you publish on your card, your contacts and aggregate statistics for your card | Providing the service, displaying your card, notifying you of important account matters and supporting you | Performance of the contract you accept when you sign up |
| Member of a client organisation | The data your organisation uploads or syncs (name, job title, department, contact details, photo) | Creating and maintaining your company card | We process this data as a processor for your organisation, which is the controller |
| Shop customer | Contact, delivery and billing data; artwork you upload | Handling, producing, shipping and invoicing your order | Performance of the contract and legal obligations (tax and accounting) |
| Client or business contact | Professional contact details | Managing the business relationship and, if you agree, sending you service news | Contract or legitimate interest; consent for marketing communications |
We do not make automated decisions with legal effects on you, nor do we build marketing profiles. Card statistics (channel, device and date) do not identify the person who opens the card.
Data you leave on someone else’s card
If you fill in a card’s “Leave me your details” form, your data goes into the contacts of that card’s holder (a person or an organisation), who is the controller and must inform you and handle your rights. TARJE2ME stores it, always on their behalf and following their instructions, as a processor (Art. 28 GDPR).
Before you submit, the form tells you what your data will be used for and asks for your explicit consent. We keep proof of that consent (text, version and date) without storing your IP address. If you don’t know whom to contact, write to us at oscar@indole.es and we will pass your request on.
Offers from Índole (only if you agree)
TARJE2ME is free. In the last step before you get your card we ask you, with an unticked box, whether you agree that Índole (INDOLE DATA TECHNOLOGY S.L.L.) may use your name and the contact details on your card (phone and email) to call or write to you with offers of its services.
We do not pass on or share this data with other companies.
Legal basis: your consent (Art. 6(1)(a) GDPR; Art. 66 of Spanish Law 11/2022 on Telecommunications for calls and Art. 21 of the LSSI for electronic communications). It is optional: your card is free whether you agree or not. We keep a record of what you agreed to, the exact wording, the version and the date.
Withdrawing it: at any time, under “Your contact permissions” in your account, or by writing to us. Withdrawing does not affect what was done before or your card. We keep this data for this purpose while you keep the permission and your account.
How long we keep it
- Website enquiries and requests: as long as needed to reply and, at most, one year afterwards if no business relationship follows.
- Account and cards: while you keep your account. If you delete it, your card, contacts and statistics are deleted; links, QR codes and NFC chips stop showing your data.
- Client organisation data: for the term of the contract with the organisation and, when it ends, returned or deleted as it instructs.
- Orders and invoices: the periods required by law (generally six years for commercial records, plus tax limitation periods).
- Backups: renewed in cycles; deleted data disappears from them in the next cycle.
Who else is involved
We do not sell or share your data. Only the following have access, under a processing agreement and to the extent necessary:
- Hosting: servers located in the European Union, managed by Índole.
- Transactional email, payment gateway and shipping, when those features go live (shop and Pro plan payments, NFC card deliveries). We will list each provider here before it processes any data.
- Optional automatic AI reading: only if it is enabled and you use it, what you send (a photo, a website or a text) is processed by Anthropic (USA) to read it. See the next section.
- The integrations you or your organisation connect, once available (Odoo and other CRMs): data will be sent to those systems because you decide so, and is governed there by their own terms.
- Public authorities where required by law (for example, the Spanish Tax Agency).
International transfers
Service data is hosted in the European Union. To fill in your card or add a paper card using artificial intelligence there are two options:
- Use your AI. You copy our instructions into your own ChatGPT, Gemini, Claude or Copilot and paste its reply into TARJE2ME. TARJE2ME sends nothing to any AI provider: whatever you share with your AI is governed by the terms of the service you choose.
- Automatic reading (optional). Only if it is enabled and you choose to use it, what you send (a photo, a website or a text) is processed by Anthropic, in the United States, with its Claude model, solely to read it. It is not stored or used to train models. This is an international transfer made with the safeguards required by Chapter V GDPR.
Your rights
You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent at any time, by writing to oscar@indole.es (say which right you are exercising; if needed, we will ask you to prove your identity). Much of this you can do yourself from your account: edit your data, export your contacts or delete your account.
If you believe we have not handled your rights properly, you can lodge a complaint with the Spanish Data Protection Agency (aepd.es).
Security
We encrypt data in transit, restrict access by role, use passwordless sign-in with a one-time code sent to your email, make backups and keep an audit log. More detail on the security page.