Digital business cards and UK GDPR

A digital business card handles personal data in two directions: your details go to the people you meet, and theirs come back to you. Under UK GDPR and the Data Protection Act 2018, both are fine when you collect only what you need, use it for what people expect, and keep it secure. This guide covers the practical points. It is general information, not legal advice.

01Your own details

Your profile is information you choose to publish. The main questions are what else the profile does when someone opens it. A privacy-friendly profile sets no tracking cookies, doesn’t build advertising profiles of visitors and doesn’t keep visitors’ IP addresses for analytics. Nexus works this way: we count views and clicks without identifying who the visitor is.

02The contacts you collect

When someone shares their details from your profile, you are collecting personal data. For business contacts, the lawful basis is often legitimate interests: they gave you their details so you could follow up about what you discussed. Keep it to that purpose and to the details you need.

• Tell people what happens with their details. The Nexus exchange form asks people to agree to share their details with you and tells them they can ask for deletion at any time.
• Keep contacts somewhere secure, not in a personal phone’s address book that leaves with the employee.
• Delete contacts you no longer need, and handle requests to see or delete data promptly.

03Follow-up emails and marketing

A personal follow-up about the conversation you had is usually expected. Adding someone to a marketing list is different: the Privacy and Electronic Communications Regulations (PECR) set rules for electronic marketing, and for many individuals that means consent. If you plan to send newsletters, ask clearly and record the answer.

04Security

The UK GDPR expects appropriate security for the data you hold. When choosing a provider, ask how data is protected. For reference, Nexus uses:

• Encryption in transit (TLS with HSTS) and AES-256-GCM field-level encryption for contact data and secrets at rest.
• Hashed passwords, optional two-factor sign-in and checks against breached passwords.
• Rate limiting and an audit log of security-relevant actions.
• Data export and deletion on request, and hosting in an EU data region.

05For companies

If your team collects contacts on company profiles, your company is usually the controller and the card provider is a processor. That means you need a data processing agreement with the provider and a clear list of their subprocessors. Nexus offers both; the security page lists our subprocessors.