Privacy Policy

1. Who We Are

ShareMyCard.co, Share-MyCard.com, Share-MyCard and ShareMyCard.co.uk are trading names of HDUK Ltd, a company registered in England and Wales with company number 11813917. Registered office: 167 to 169 Great Portland Street, 5th Floor, London, W1W 5PF.

HDUK Ltd is the controller of the personal data described in this policy. We are registered with the Information Commissioner’s Office under registration number ZA558697.

This policy explains what personal data we collect when you visit Share My Card, create an account or publish a card, why we use it, who we share it with, how long we keep it and the rights you have. It should be read alongside our Terms and Conditions.

We follow the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR).

2. Our Services Only Serve Businesses

Share My Card is a service for businesses, sole traders and professionals. Accounts are only available to people aged 18 or over who are acting for a business. If we learn that we hold personal data about someone under 18, we will delete it. If you believe a child has given us personal data, please contact us.

3. The Data We Collect

When you create an account we collect your name, business name, email address, a password (stored only in encrypted, hashed form), and your answer confirming that you are signing up as a business.

When you create or edit a card we collect what you choose to put on it. This can include your business name, a contact name, job title, phone numbers, email addresses, a postal or trading address, website and social media links, a description of your business, its sector and location, and images such as a logo, photograph or banner.

When you contact us or use a card feedback form we collect your name, email address, the reasons you select and your message.

When you visit a card we record anonymous counts of activity: the day, the card, the type of action (for example a view, a contact save, a call, an email, a link click or a share) and the general source of the visit (for example search, social media, a QR code or a direct visit). These counts are not linked to you and do not include your IP address or any identifier.

Technical data. Like any website, our servers and our network provider receive your IP address, browser type and the pages you request. We use your IP address briefly to limit abuse of our forms and statistics. For this we store a scrambled, one-way code made from your address, which is deleted automatically within one hour. Our hosting provider and network provider keep standard security logs for a limited period.

We do not collect payment card details ourselves. If paid plans are introduced, payments will be handled by the payment providers listed in section 7.

4. Cards Are Public by Design

The purpose of a card is to be found. Once a card is approved and published, everything on it is publicly visible. It can be viewed, saved and shared by anyone, listed in our directory, included in structured data that helps search engines and AI assistants understand your business, and shown as a preview image when a link to it is shared.

Only put information on a card that you are happy to make public. If you add details of another person, such as a colleague, you must have their permission. You can edit or unpublish a card at any time from My Cards, or ask us to remove it.

Once a card has been public, copies may remain in search engine results, AI services, saved contacts or other people’s records for some time after you change or remove it. Those copies are outside our control, although removing the card from our site will usually lead to them being updated over time.

5. Why We Use Your Data and Our Lawful Basis

We only use personal data where the law allows it. The table below sets out our purposes and the lawful basis for each.

Purpose	Lawful basis
Creating and running your account, approving your account and cards, and publishing your cards	Contract: we need it to provide the service you asked for
Sending service emails, such as account approval, card approval, password resets and important changes to the service or our terms	Contract
Answering enquiries, feedback and complaints	Legitimate interests: responding to people who contact us
Providing card statistics to card owners and improving the service	Legitimate interests: showing owners how their cards perform, using anonymous counts only
Keeping the service secure and preventing spam, fraud and misuse	Legitimate interests: protecting our users, our service and the public
Telling you about new features or offers	Consent, or for existing customers, legitimate interests under the PECR soft opt in. You can opt out at any time
Keeping records for tax and accounting once paid plans exist, and meeting other legal duties	Legal obligation
Establishing or defending legal claims	Legitimate interests

Where we rely on legitimate interests, we have considered your rights and are satisfied that they are not overridden. You can ask us for details of that assessment.

If you do not give us the information needed to create an account, we cannot provide the account.

We do not sell your personal data. We do not use it for automated decisions that have legal or similarly significant effects on you. Accounts and cards are approved by a person.

6. Emails We Send

We send service emails that are needed to run your account. You cannot opt out of these while you have an account, because they are part of the service.

We will only send marketing emails if you have agreed to receive them or, where the law allows, if you are an existing customer and we are telling you about similar services. Every marketing email will include a way to unsubscribe, and you can also opt out by emailing us.

7. Who We Share Data With

We share personal data only with organisations that help us run the service, under contracts that require them to protect it and use it only on our instructions. These are:

Hosting: UK Servers, whose data centre in Coventry, United Kingdom, hosts our website and database.
Network and security: Cloudflare, which delivers our pages quickly and protects the site from attacks. Cloudflare processes technical data such as IP addresses and may do so outside the UK.
Email delivery: the provider we use to send account and service emails.
Payments, if paid plans are introduced: PayPal, Stripe and Tide Platform Ltd. These providers collect and store payment details under their own privacy policies. We receive confirmation of payments but not your full card number.

We may also share personal data where we are required to by law, to respond to a valid request from a court, regulator or law enforcement body, to enforce our Terms and Conditions, or to protect the rights, property or safety of our users, the public or HDUK Ltd. We will only disclose what is necessary and lawful.

If HDUK Ltd, or the Share My Card business, is sold or reorganised, personal data may transfer to the new owner, who will be bound by this policy.

Published card content is public, as explained in section 4, and can be seen and used by anyone.

8. International Transfers

We store your account and card data in the United Kingdom. Some of our service providers, such as Cloudflare, may process data outside the UK. Where that happens, we make sure the transfer is protected, for example by relying on a UK adequacy decision or by using the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

9. Cookies and Similar Technologies

We keep cookies to a minimum and do not use advertising or tracking cookies.

Login cookies: if you log in, we set cookies that keep you logged in and protect your session. These are strictly necessary and are removed when you log out or when they expire.
Visit marker: when you view a card, we store a small marker in your browser for that browsing session only, so that refreshing the page is not counted as a second view. It contains no personal information and is cleared when you close the tab.
Security cookies: Cloudflare may set a strictly necessary cookie to protect the site from attacks and bots.

Because these are all strictly necessary for the service you request, we do not ask for consent for them. If we ever introduce cookies that are not strictly necessary, we will ask for your consent first and update this policy.

You can block or delete cookies in your browser settings, but if you block login cookies you will not be able to sign in.

10. How Long We Keep Data

Account details: for as long as your account is open. If you close your account, we delete or anonymise them within 30 days, unless we need to keep something for a reason below.
Cards: until you delete them or close your account. Unpublished and rejected cards are deleted when your account is closed.
Sign-up requests that are not approved: deleted within 30 days of the decision.
Enquiries, feedback and complaints: up to 2 years after the matter is closed.
Card statistics: anonymous daily counts are deleted automatically after 400 days.
Anti-abuse codes: deleted automatically within one hour.
Payment and accounting records, if paid plans are introduced: 6 years after the end of the financial year they relate to, as required by HMRC.
Backups: deleted data may remain in secure backups for up to 30 days before it is overwritten.

We may keep limited information for longer where it is needed to prevent repeated misuse of the service, to deal with a legal claim, or because the law requires it. We keep this to the minimum needed.

11. How We Protect Your Data

We use appropriate technical and organisational measures to protect personal data. These include encrypted connections for the whole site, hashed passwords, access to account data limited to authorised staff, approval checks before content is published, spam and abuse controls, and regular software updates.

No system is completely secure. If a personal data breach is likely to put your rights at risk, we will tell you without undue delay and, where required, report it to the Information Commissioner’s Office within 72 hours.

Please keep your password private and use one you do not use elsewhere.

12. Your Rights

Under UK data protection law you have the right to:

Access the personal data we hold about you and receive a copy.
Rectification: correct data that is wrong or incomplete. You can update most account details yourself on your Account page and your cards from My Cards.
Erasure: ask us to delete your data, subject to the exceptions in section 10.
Restriction: ask us to limit how we use your data, for example while a complaint about its accuracy is checked.
Portability: receive data you gave us in a structured, commonly used, machine readable format, or ask us to send it to another provider where technically possible.
Objection: object to our use of your data where we rely on legitimate interests. You can object to marketing at any time and we will stop.
Withdraw consent where we rely on consent. This does not affect anything we did before you withdrew it.

To use any of these rights, email us at [email protected]. We may need to confirm your identity first. We will respond within one month. If your request is complex, we may extend this by up to two further months and will tell you why. Using your rights is normally free.

13. Complaints

If you are unhappy with how we have handled your personal data, please contact us first at [email protected] and we will try to put it right.

You also have the right to complain to the Information Commissioner’s Office, the UK data protection regulator, at ico.org.uk or on 0303 123 1113.

14. Links to Other Websites

Cards and our pages contain links to other websites, including card owners’ own sites and social media profiles. We are not responsible for how those websites handle personal data. Please read their privacy policies.

15. Changes to This Policy

We may update this policy when our service or the law changes. The date at the top shows when it was last updated. If we make a significant change, we will tell account holders by email or by a notice on the site before it takes effect.

16. Contact Us

For any question about this policy or your personal data, email [email protected] or write to HDUK Ltd, 167 to 169 Great Portland Street, 5th Floor, London, W1W 5PF.