Last updated: 16 September 2026. This Privacy Policy explains how TrustKard collects, uses, shares and protects personal information. It is intended to align with the Protection of Personal Information Act, 2013 (POPIA). Please read it together with our Terms & Conditions.
1. Who We Are
TrustKard is a digital business card platform operated by Martech (Pty) Ltd (trading as TrustKard), a company registered in the Republic of South Africa. Martech (Pty) Ltd is the responsible party for the personal information you provide about yourself and your account, and it decides how and why that information is processed. Our full legal name, company registration number, registered address, email address and website are set out in the footer of this page.
The platform enables companies to create branded digital cards and profile pages for their team members, share them via short links and QR codes, capture leads, and collect reviews. For the personal information a company collects through its own cards, links and contact forms (for example, leads and reviews), that company is the responsible party and we act as an operator (processor) on its behalf, processing that information only on its instructions.
2. Personal Information We Collect
- Account and company data: your name, email address, phone number, password (hashed), role, company details, billing address, VAT number, and profile information such as job title, photo, logos and custom fields.
- Card and usage data: the content of the digital cards and profiles you create, short links, QR codes, and information about how cards and links are viewed and scanned.
- Captured leads and reviews: information submitted by visitors through contact forms and review pages, such as names, contact details, messages and ratings.
- Payment data: payments are processed by PayFast. We do not store full card numbers; we hold tokenised payment references in encrypted form, together with limited details such as card brand, last four digits and expiry, and transaction records.
- Analytics and technical data: IP address, device, browser, operating system, referrer, UTM and other attribution parameters, and approximate geolocation derived from these signals, recorded against page views, link scans, contacts and review submissions.
- Custom domain and integration data: domain configuration you provide, and data exchanged with third-party services you choose to connect through our integrations engine.
- Communications: correspondence with our support team and related records.
3. How and Why We Use Personal Information
We use personal information to create and manage accounts and companies; to render and serve public cards, links, QR codes and wallet passes; to capture and deliver leads and reviews to the relevant company; to calculate and collect fees and process payments and store orders; to provide analytics and attribution reporting; to operate integrations you configure; to provide support; to maintain security and prevent abuse; and to comply with our legal obligations.
4. Our Justification for Processing
POPIA allows us to process personal information only where we have a lawful justification. Depending on the information and the purpose, we rely on one or more of the grounds set out in section 11 of POPIA:
- Consent: where you have consented to a specific use, such as receiving electronic marketing from us or the use of non-essential cookies. You may withdraw your consent at any time, after which we will stop the processing that relied on it.
- Conclusion or performance of a contract: where processing is necessary to provide the Service to you or your company under our Terms & Conditions, for example creating and managing accounts, rendering cards and links, and calculating and collecting fees.
- Compliance with a legal obligation: where the law requires us to process information, such as tax, accounting and record-keeping duties.
- Legitimate interests: where processing is necessary to pursue our legitimate interests, or those of a third party to whom the information is supplied, such as securing the platform, preventing abuse, and measuring and improving the Service, weighed against your rights and interests.
Where a company captures leads or reviews through its cards and links, that company is responsible for establishing its own justification for that processing under section 11.
5. How We Share Personal Information
We do not sell your personal information. We share it only as needed to operate the Service, including with:
- Companies and their users: leads, reviews and analytics captured through a company's cards and links are made available to that company.
- PayFast: our payment gateway, for processing payments and recurring or ad-hoc charges.
- Hosting and infrastructure providers: including cloud storage and hosting used to run the platform and store files.
- Service providers (operators): for geolocation enrichment, error monitoring, email delivery, wallet pass generation and similar functions, bound to process data only on our instructions.
- Google reCAPTCHA: protects the forms on our website and on public cards and pages, such as sign-in, contact, review and payment forms, against spam, fraud and automated abuse. When you submit one of these forms, reCAPTCHA assesses the request using technical information such as your IP address, browser and device details, and how you interact with the page. Google processes that information as our operator, only as needed to provide and maintain the reCAPTCHA service.
- Resellers: where your company is provisioned or managed through an authorised reseller, that reseller may access the company data necessary for its administrative and billing role.
- Authorities and advisors: where required by law, to enforce our terms, or to protect rights, safety and property.
6. Direct Marketing
We will only send you electronic direct marketing about our own products, features and offers (for example by email or SMS) where POPIA permits it: where you have consented to receive it, or where you are an existing customer, we obtained your details in the context of a sale, the marketing relates to our own similar products or services, and you were given an opportunity to opt out. Every marketing message includes an easy way to unsubscribe, and you can withdraw your consent or opt out at any time by emailing support@trustkard.com. We do not sell your personal information, and we do not share it with third parties for their own direct marketing.
Under section 69 of POPIA, where we seek your consent to electronic marketing and you are not already a customer, we may approach you only once, using the prescribed form (POPIA Form 4). Under the Consumer Protection Act, 2008 you also have the right to refuse direct marketing and to pre-emptively block it, including by registering on any applicable opt-out register.
A company that uses the platform may offer its own marketing opt-in on its contact forms. Where you give that consent, the company (not TrustKard) is the responsible party for its own marketing, and you should direct any marketing preferences or opt-outs to that company.
7. Your Rights and How to Exercise Them
Subject to applicable law, you have the right to: be notified about the processing of your personal information; request access to the personal information we hold about you; request that we correct, update or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained; object, on reasonable grounds, to processing; withdraw consent where we rely on it; and lodge a complaint with the Information Regulator.
To exercise any of these rights, contact our Information Officer at support@trustkard.com. Please give us enough detail to identify you and understand your request; we may ask you to verify your identity before we act, so that we protect your information. A request to correct or delete information may be made on the prescribed POPIA form (Form 2), and a request to access a record is made under the Promotion of Access to Information Act, 2000 (PAIA). We aim to respond to correction and deletion requests within 30 days; access requests are handled within the timeframes set by PAIA (generally 30 days, which may be extended in limited circumstances), and a prescribed fee may apply to an access request. There is no charge to object to processing or to opt out of marketing.
If you are a lead or reviewer whose information was captured through a company's card, link or contact form, that company is the responsible party, so please direct your request to that company, and we will assist it, as its operator, in responding.
8. Data Retention
We keep personal information only for as long as we have a lawful purpose to do so. How long we keep it depends on the type of information and why we hold it. As a general guide:
- Account and company profile data: kept while your account or company is active, and deleted or de-identified within a reasonable period (ordinarily up to 12 months) after the account is closed, unless we are required to keep it for longer.
- Billing, payment and transaction records: kept for at least five (5) years to meet South African tax and financial record-keeping obligations, and for as long as needed to resolve any dispute.
- Captured leads and reviews: held on behalf of the company that controls them and retained until that company deletes them or its account is closed, after which they are removed in line with our deletion processes.
- Analytics and technical logs (page views, link scans, device and attribution data): retained in identifiable form for up to 24 months, after which they are deleted or aggregated into de-identified statistics.
- Consent and acceptance records (for example, a record that you accepted our Terms or a billing mandate): kept for the life of the account and a reasonable period afterwards, so we can demonstrate the consent that was given.
- Support correspondence: kept for up to 24 months after the matter is resolved.
Where the law requires us to retain information for longer, or we need it to establish, exercise or defend a legal claim, we will keep it for that period and then delete or de-identify it.
9. Security
We maintain reasonable technical and organisational safeguards to protect personal information, including encryption of sensitive credentials and payment tokens, access controls and activity logging. No method of transmission or storage is completely secure, and you are responsible for keeping your login credentials and API keys confidential. We will notify affected parties and the Information Regulator of a security compromise where required by POPIA.
10. Cross-Border Transfers
Some of our service providers may process or store personal information outside the Republic of South Africa. Where we transfer personal information across borders, we take steps to ensure it receives a level of protection consistent with POPIA, for example through appropriate contractual safeguards or because the recipient is subject to comparable data-protection laws.
11. Cookies and Similar Technologies
We use cookies and similar technologies on our website and dashboard. They fall into two broad categories:
- Strictly necessary cookies: needed for the platform to work, for example to keep you signed in, remember your active company context, and protect the Service against fraud and abuse (including the cookie Google reCAPTCHA sets to protect our forms). The Service cannot function properly without these, so they are always set.
- Analytics and performance cookies: a limited set of first-party cookies and similar identifiers that help us understand how the Service and shared links are used, so we can measure attribution and improve the platform.
We do not use cookies to serve third-party advertising or to track you across unrelated websites. You can control or delete cookies at any time through your browser settings, and most browsers let you block cookies or warn you before one is set; blocking strictly necessary cookies may stop parts of the Service from working. Public cards and profile pages are designed to render without setting non-essential cookies on a visitor's device.
12. Children
The Service is intended for business use by adults and is not directed at children. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can address it.
13. Changes to this Policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, provide additional notice. Your continued use of the Service after changes take effect constitutes acceptance of the updated Policy.
14. Contact and Information Officer
For any privacy-related enquiry, to exercise your rights, or to reach our Information Officer, please contact Martech (Pty) Ltd t/a TrustKard by email at support@trustkard.com. Our registered address, website and other particulars are set out in the footer of this page.
If you are not satisfied with how we have handled your personal information or a request you have made, you have the right to lodge a complaint with the Information Regulator (South Africa):
- Website: https://inforegulator.org.za
- POPIA complaints: POPIAComplaints@inforegulator.org.za (on the prescribed POPIA Form 5)
- General enquiries: enquiries@inforegulator.org.za
- Physical address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191