GDPR & data protection.

01 Data controller

The data controller responsible for your personal data is:

Scope note: Taggzi is expanding across five verticals — Taggzi-Pet (live), Taggzi-Travel, Taggzi-Active, Taggzi-Care, and Taggzi-Luxe (each launching in turn). This notice currently applies to Taggzi-Pet and any general account / commerce activity. As each additional vertical launches we will update these terms to describe the specific data types it handles.

Data Protection Officer: Taggzi is not required to appoint a statutory Data Protection Officer under UK GDPR Article 37 because we are a small controller whose core activities do not involve large-scale, regular monitoring of data subjects or large-scale processing of special-category data. All privacy queries are handled directly by the sole trader named above (or their successor entity once incorporation completes) at privacy@taggzi.com. If our activities change so that Article 37 applies, we will appoint a DPO and publish their contact details here.

02 Personal data we collect and why

03 Legitimate interests

Where we rely on legitimate interests as our legal basis, we have carried out a balancing test and concluded that our interests are not overridden by your rights. Specifically:

• Scan logs (IP hash): We record a one-way SHA-256 hash of the scanner's IP to detect abuse and provide owners with tag activity data. Raw IP addresses are never stored. You can object to this processing — see section 7.
• Service security and fraud prevention: Detecting and preventing fraudulent or abusive use of the service.

04 Who we share data with

We never sell, rent, or trade your personal data to third parties for marketing purposes.

05 International data transfers

Your data is primarily stored on UK servers (20i / StackCP). Certain sub-processors listed in section 4 are established in the United States (Stripe, Resend, Apple, Google/FCM, Google/Gemini, Anthropic, ShipStation) or the European Union (Meta Platforms Ireland). All transfers outside the UK are protected by:

• Standard Contractual Clauses (SCCs) as approved by the EU Commission; and
• The UK International Data Transfer Addendum (IDTA) issued by the ICO, which brings each transfer within the UK's adequacy framework.

No transfer takes place to any country the ICO has not confirmed as adequate or to any recipient not bound by SCCs + IDTA. You can request a copy of any transfer safeguard by emailing privacy@taggzi.com.

05a Special category data (UK GDPR Article 9)

Taggzi-Pet may contain optional veterinary or animal-medical notes. This is data about an animal, not a human data subject, so Article 9 does not apply to the current live service.

The Taggzi-Care vertical (medical-alert and carer-contact tags for people) is announced but not yet accepting orders. When it launches, it will process Article 9 human health data under one or more of:

• Article 9(2)(a) — explicit consent, obtained through a dedicated consent flow separate from general account signup;
• Article 9(2)(c) — protection of vital interests where the data subject is physically or legally incapable of giving consent (e.g. medical emergency after a Taggzi-Care tag is scanned).

Before Taggzi-Care goes live we will publish a dedicated Data Protection Impact Assessment (DPIA) and update this notice with the specific safeguards for Article 9 data (encryption at rest, minimisation, retention, breach-notification thresholds). We will not begin collecting Article 9 human data before that update is published on this page.

06 Your rights under UK GDPR

07 How to exercise your rights

08 Cookies

Google Ads cookies are only set if you choose "Accept" in the cookie banner, and never on pet profile or other finder-facing pages. Change your choice any time with Cookie settings.

09 Children's data & age of use

Two distinct age thresholds apply, in line with UK law:

• Age 13 — UK GDPR digital-consent floor. Taggzi is not directed at children under 13 and we do not knowingly collect personal data from anyone under 13. If you believe a child under 13 has provided us with data, contact privacy@taggzi.com and we will delete it promptly.
• Age 18 — contractual capacity. A Taggzi account is a paid contract (Pro subscription, tag order, delivery of goods) which under English law requires contractual capacity. We therefore require the account holder to be aged 18 or over. Parents / guardians aged 18+ may hold the account and add pet or item profiles on behalf of a minor. The account-holder eligibility clause is at section 3 of the Terms of Service.

10 Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• HTTPS encryption in transit (TLS 1.2+)
• Passwords stored as bcrypt hashes — never in plaintext
• IP addresses never stored — only one-way SHA-256 hashes
• Payment data never touches our servers — Stripe handles all card processing
• Access to personal data restricted to authorised personnel only
• Email verification required before account activation

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and affected individuals without undue delay as required by Article 33–34 UK GDPR.

11 Changes to this notice

We may update this notice to reflect changes in our practices or legal obligations. We will notify registered users by email of any material changes. The "Last updated" date at the top of this page indicates when the notice was last revised.

12 Complaints

If you are dissatisfied with how we have handled your personal data, you have the right to lodge a complaint with the UK's supervisory authority:

We would appreciate the opportunity to address your concerns before you contact the ICO — please email privacy@taggzi.com first.

13 Related documents

For complete details, read our full Privacy Policy. To exercise your rights immediately, visit Account Settings → My Data.