Digital business cards and data protection: GDPR and Swiss FADP

A digital business card carries personal data: yours, and that of the people who leave you their details. Here is concretely what VisitCard, a Swiss company subject to the Swiss Federal Act on Data Protection (FADP), does to protect it.

Data hosted in the EUSwiss company · NeuchâtelSelf-service export and deletion

Create my card for free See pricing

14 days of Pro free when you sign up · no credit card

What VisitCard actually does

Hosting in the European Union

The database and uploaded images are stored in the EU (Cloudflare’s EU jurisdiction), encrypted at rest; traffic is encrypted with TLS. Transactional emails are sent from our email provider’s EU region.

A contact form that informs

Below your card’s form, a notice explains who receives the details and how long they are kept, with a link to the privacy policy and a “Delete my data” link. The marketing consent box is optional and never pre-ticked.

You choose whether your card appears on Google

Your card is reachable by anyone who has its link or QR code; you decide whether it may appear in search engine results.

Export and deletion

From your settings, download all your account data (JSON file) and delete your account. Each contact received can be deleted individually; CSV export of contacts is included in Pro.

Who is responsible for what?

VisitCard is operated by a Swiss company based in Neuchâtel, subject to the Swiss Federal Act on Data Protection (FADP); for users located in the European Union, it strives to respect the principles of the GDPR. The privacy policy details the data processed, the legal bases, the processors and your rights.

The contacts who write to you through your card are passed on to you: what you do with them afterwards (follow-up, newsletter, prospecting) is your responsibility. That is why the visitor’s marketing consent is recorded separately from their message.

Where is the data stored?

The database and images are stored in the European Union. The application is delivered through Cloudflare’s global network, and several providers (hosting, Stripe payments, email delivery) are US companies: any transfers are governed by standard contractual clauses approved by the European Commission. The full list is in the privacy policy.

What VisitCard does not do

Details received through your card are neither sold nor used for advertising.
Your card statistics are aggregated (views, country, device type).
The photo of a scanned paper card is only used to read it: it is not kept (business card scanner).

This page describes how VisitCard works; it is not legal advice on your own situation.

Frequently asked questions

Is VisitCard GDPR and FADP compliant?

VisitCard is subject to the Swiss FADP and strives to respect the principles of the GDPR for its users in the EU: data hosted in the EU, information for visitors, export and deletion. The privacy policy details these commitments; your own compliance also depends on how you use the contacts you receive.

Where is my data hosted?

The database and uploaded images are stored in the European Union, with Cloudflare (EU jurisdiction). The application is served by Cloudflare’s global network.

How do I export or delete my data?

In your dashboard settings: “Export my data” downloads a complete JSON file, and “Delete my account” erases your account, cards and contacts. A single contact can also be deleted from your address book.

What does a visitor see before sending me their details?

A notice below the form: who receives their details, how long they are kept, a link to the privacy policy and a link to request deletion. Agreeing to be contacted is an optional box, never ticked in advance.

Does my card appear on Google?

You choose whether your card may appear in search engines. Either way, it remains reachable by anyone who has its link or QR code.

A Swiss digital business card, hosted in the EU