Privacy Policy
ATOUCH gift card system — atouch.com and the ATouch Gift Cards app.
Last updated: 19 September 2026
This policy explains what personal data ATOUCH handles, why, and what your rights are. ATOUCH provides a gift card management system for businesses: a mobile app and API that retailers use to create, print, sell and manage physical gift cards in their own shops.
The data controller for the account data described in section 2 is [LEGAL ENTITY NAME], trading as ATOUCH, [REGISTERED ADDRESS], Ireland (company number [CRO NUMBER]). For any privacy question or request, contact support@atouch.com. We have not appointed a Data Protection Officer, as we are not required to under Article 37 GDPR; privacy requests go to the address above.
1. Two roles, two sets of rules
Two different groups of people appear in our system, and our legal role differs for each:
- Retailers — our account holders. For their account data we are the data controller (section 2).
- Retailers' customers — people who buy or receive a gift card from a retailer. For their data we are a data processor, acting on the retailer's instructions; the retailer is the controller (section 3).
2. Retailer accounts — data we control
- Account details. Your email address (used to sign in) and, if you provide it, your business name. Legal basis: performance of the contract (Art. 6(1)(b)).
- Subscription details. Payment is processed by Stripe on Stripe's own hosted page — card details go to Stripe and never reach us. We keep your subscription status and a payment reference. Legal basis: performance of the contract, and our legal obligation to keep transaction records (Art. 6(1)(b) and (c)).
- Your business's gift card records. The cards you create, their designs, balances, and the ledger of sales, top-ups and redemptions your staff record. Legal basis: performance of the contract.
- Service emails. Account emails (verification, password reset, deletion confirmation, API key creation, payment problems) sent from no-reply@atouch.com.
- Plan emails. Starter (free) accounts also receive a welcome email when they sign up, and a notice when 80% and when 100% of their yearly card allowance has been used. Each links to our paid plans. Legal basis: our legitimate interest in telling you about your own plan and its limits (Art. 6(1)(f)). To stop them, email support@atouch.com — every one of these emails says so — and we will stop sending them to your account. The account emails above are not affected. We send no other marketing email.
- Technical logs. Application logs recording requests, errors and the account they relate to, used to operate and debug the service. Legal basis: our legitimate interest in a secure, working service (Art. 6(1)(f)).
3. Retailers' customers — data we process for the retailer
When a retailer sells a gift card, they may record details of the sale in our system. The retailer decides what to record and why; we only act on their instructions. This can include:
- A customer email address, if the retailer records one — used to send the gift card's PIN and balance information at the retailer's request.
- Additional fields the retailer configures (for example a customer's name). Retailers choose these field names themselves; they are instructed not to collect special-category data (health, beliefs, and the other Article 9 categories) in them, and the system is not designed to hold such data.
- The card's transaction history — sale, redemption, top-up and balance amounts.
- Email delivery outcomes. Where we send a gift card email for a retailer, we record whether it was delivered, bounced or was marked as spam, so the retailer can correct a wrong address.
If you are a retailer's customer: the retailer you bought your card from controls this data, so the quickest route for access, correction or erasure is to contact them. You can also write to support@atouch.com and we will either act on the retailer's instruction or pass your request to them without undue delay, and tell you that we have done so.
Retailers: the Article 28 terms governing this processing are in our Data Processing Agreement, which forms part of your contract with us.
4. What we never do
- We do not sell personal data, and we do not share it for anyone else's marketing.
- This website sets no cookies and runs no analytics or advertising trackers. The mobile app contains no advertising or third-party analytics SDKs.
- We carry out no automated decision-making or profiling that produces legal or similarly significant effects (Art. 22).
- Our services are for businesses and are not directed at children.
5. Who else processes data, and where
All ATOUCH data is stored in Amazon Web Services' Ireland (eu-west-1) region. We use these sub-processors:
| Provider | Purpose | Location / transfers |
|---|---|---|
| Amazon Web Services | Database, file storage for card designs, sign-in (Cognito), email sending (SES), application hosting and logs | Ireland (eu-west-1). Support access from outside the EEA is governed by AWS's standard contractual clauses. |
| Stripe | Subscription payments and payment records | Stripe Payments Europe Ltd (Ireland), with onward transfer to Stripe, Inc. (USA) under standard contractual clauses / the EU–US Data Privacy Framework. See Stripe's privacy policy. |
| Only where a gift card is added to Google Wallet: the pass details (card identifier and balance link) are sent to Google to create the pass | Google LLC (USA) under standard contractual clauses / the EU–US Data Privacy Framework. |
We will tell retailers in advance of any change to this list, as set out in the DPA.
6. How long we keep data
| Data | Retention |
|---|---|
| Retailer account (email, business name, settings) | For the life of the account, then 30 days after deletion (see below). |
| Gift cards, balances and their transaction ledger | For the life of the account. These are the commercial record a customer's balance is honoured against, so they are not deleted while the card can still be redeemed. |
| Customer email addresses and sale metadata | Held with the card's sale record, on the retailer's instruction, for the life of the account. A retailer can correct or clear the address on the current sale at any time. |
| Deleted accounts | Moved to a restricted store for 30 days — during which the account can be restored by signing up again with the same email address — then permanently and automatically deleted. |
| Database backups | Continuous point-in-time recovery covering a rolling 35 days. Deleted data ages out of backups within that window. |
| Application logs | Retained for operational and security purposes; not used for any other purpose. |
| Payment records | Kept as financial records for as long as Irish tax and accounting law requires (currently six years). |
7. Security
Measures we take include (Art. 32): all data encrypted at rest and in transit (TLS); access to production systems restricted to the operator and protected by multi-factor authentication; gift card PINs never included in bulk data exports or in any email to a retailer; API keys stored only as hashes, capped per account, and revocable at any time; and continuous database backups. We will notify affected retailers without undue delay if a personal data breach affects their data, and will notify the Data Protection Commission where the law requires it.
8. The mobile app on your device
The app asks for two device permissions, both only when the related feature is used: the camera, to scan a gift card's QR code, and storage, to attach a card design image and to save printable card PDFs. Photographs and files stay on your device except for a design image you deliberately upload. Files the app writes to your device (preview PDFs, CSV exports, staged images) are temporary and are cleared automatically.
9. Your rights
Under the GDPR you have the right to access, correct, export and erase your personal data, to restrict or object to processing, and to withdraw consent where processing relies on it. You also have the right to lodge a complaint with the Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28.
- Retailers can delete their account in the app (Settings → Delete Account, confirmed by email), which removes the account and its card data on the schedule in section 6.
- Anyone can exercise any of these rights by emailing support@atouch.com. We respond within one month, and will tell you if we need longer because a request is complex.
- Retailers' customers: see section 3 — your retailer controls the record, but we will help.
10. Changes
If this policy changes materially we will update this page and its date, and notify account holders by email where the change affects them.