Digital Business Card and GDPR: What You Need to Know

Digital business cards via NFC are modern and practical — and anyone using them professionally will sooner or later ask: is this actually GDPR-compliant? The short answer: the card itself is not the issue. The complexities lie in the system behind it. This guide gives a realistic overview without causing unnecessary alarm.

What the card itself stores — and what it does not

An NFC chip stores nothing but a URL. No names, no email addresses, no device data, no cookies, no tracking. The chip is a passive data store: it outputs the link when a smartphone reads it — nothing more.

From a GDPR perspective, the card itself is entirely neutral. Personal data within the meaning of Art. 4 GDPR is not processed by the chip.

Where GDPR comes into play: the server behind the URL

When someone taps an NFC business card, the smartphone accesses the stored URL. This access automatically generates a log entry on the web server:

• IP address of the smartphone
• Timestamp
• Browser type and operating system (user agent)

An IP address qualifies as personal data under GDPR. This means: anyone operating a server that is accessed when someone taps is processing personal data — and must make this transparent in their privacy policy.

This applies to any website visit and is not specific to NFC. Anyone operating their own website faces the same situation.

When does it get more complex?

The data protection situation becomes more complex when additional services load on the profile behind the URL:

• Google Analytics, Meta Pixel, Hotjar: These services set cookies and create user profiles. They are GDPR-relevant and require either a consent banner or a privacy-compliant alternative (e.g. self-hosted Matomo).
• Embedded maps (Google Maps): Google Maps loads data from Google servers. This must also be covered in the privacy policy and may require consent.
• Contact forms: Anyone who fills in and submits a form is actively giving consent — this must be clearly communicated.

Keeping your digital profile lean — no tracking, no third-party scripts, only static contact details — lets you operate in a GDPR-compliant manner without a lot of infrastructure.

NFC business card vs. business card app: which is more privacy-friendly?

Many business card app providers collect far more data than necessary:

• Device identifiers (IDFA, GAID)
• Contact lists (if the app requests access)
• Location data
• Usage profiles (which profiles are accessed and when)

A simple NFC business card pointing to your own professional website or a minimal profile has a significantly smaller data footprint than an app-based solution. This is a genuine argument for NFC cards with your own profile rather than app platforms with opaque data policies.

Checklist: operating an NFC business card in a GDPR-compliant way

1. Privacy policy linked on the profile (or accessible)
2. Server logging mentioned in the privacy policy (IP, timestamp)
3. Tracking services only used with valid consent (or avoided entirely)
4. Google Maps, YouTube etc. only loaded after consent (or privacy-friendly alternatives used)
5. Contact forms with clear consent wording
6. Data processing agreement (DPA) in place with the hosting provider

Glastrix NFC business cards: what the card itself provides

Glastrix cards are hardware: UV-printed on glass, metal, wood, or bamboo, with an embedded NTAG215 chip. The card itself stores only the URL of the customer profile. What data that profile processes is entirely the customer's responsibility — Glastrix provides only the hardware card.

Anyone running their digital profile on their own domain with minimal third-party services can operate a Glastrix NFC business card in a GDPR-compliant and professional manner.