This policy explains what personal data TagNMatch processes, why, how long we keep it and what rights you have.
§1Who we are
TagNMatch is run by ARBNEXO (details in the Impressum). For any question about your data, write to privacy@arbnexo.com.
§2Data about brand accounts
When you and your team use TagNMatch, we process your name, email address, password (stored only as a hash), company details, the products and files you add, and security data such as sign-ins, devices, IP addresses and an audit log of changes.
§3Data about shoppers
Shoppers need no account. When a QR code is scanned we record the time, the product, the country, language and device type, and only the network part of the IP address. Questions to a product assistant are stored without the IP address. A shopper who signs up for a brand's news gives their email address with consent. For this data the brand is the controller and we process it on its behalf.
§4Why we use data, and on what legal basis
- To provide the service you signed up for (contract).
- To keep accounts and the service secure (legitimate interest).
- To send marketing emails or brand news, only with consent you can withdraw at any time.
- To meet legal obligations.
We do not sell personal data and do not use it for advertising.
§6Service providers
We use a few providers for hosting and storage (in the EU), email delivery, error monitoring and the AI model that writes assistant answers. They process data only on our instructions. If a provider processes data outside the EU, we rely on safeguards such as standard contractual clauses. A DPA and our subprocessor list are available on request at privacy@arbnexo.com.
§7How long we keep data
We keep account data while the account exists. Scans are deleted after 90 days, assistant questions after one year and the security audit log after two years. When you delete your account or close a company, its data is erased after a 14-day grace period. Backups roll over within about six months.
§8Your rights
You can access, correct, export or delete your data, object to or restrict processing, and withdraw consent at any time. Most of this works in your account settings (the export link is valid for 24 hours); for anything else write to privacy@arbnexo.com. You can also complain to a data protection authority.
§9Changes
If this policy changes, we update the date above and tell account holders about important changes.