Privacy Policy

Monact is operated by Thrilla Digital Ltd, registered in Scotland under number SC878333, registered office 150 Meiklehill Road, Kirkintilloch, Glasgow, G66 2JR. For the data described in section 2 we are the controller. For the data described in section 3 we are a processor acting for the seller.

Contact for anything in this policy: contact@monact.co.

1. Two groups of people

• Sellers — people with a Monact account.
• Buyers — people who scan a printed card and answer a question. We hold far less about this group, and deliberately so.

2. If you are a seller (we are the controller)

Where we rely on legitimate interests, the interest is running a secure, working service. We have considered your interests and rights and consider ours not to override them; you can object at any time (section 8).

We never see or store your card number. Our payment processor holds it.

3. If you scanned a card (we are the processor)

The seller who printed the card decides what to ask and why, which makes them the controller of your answers. We process them on their instructions under the Data Processing Agreement.

We do not ask for your name, email address or order number. We store:

• Your answers to the seller’s questions.
• A random identifier in a cookie, so the same browser is not counted twice and cannot submit the same survey repeatedly.
• A one-way hash of your IP address, for the same purpose. We cannot turn the hash back into your address.
• The time of the scan and which printed run it came from.

The seller sees your answers. They do not see your IP address or your identifier. If you type your name or email into a free-text answer, the seller will see it, because you wrote it — please do not, if you would rather they did not.

If you want your answers deleted, the quickest route is to ask the seller. You can also email us and we will pass the request to them and help them action it.

4. Cookies

The page a buyer lands on after scanning sets one cookie: a random visit identifier, described above. It is strictly necessary for the page to work correctly — without it the same person could submit repeatedly and the seller’s data would be meaningless — so under the Privacy and Electronic Communications Regulations it does not require consent.

On our own marketing pages — not the page a buyer reaches from a card, and not the dashboard — we ask whether we may use RB2B, a visitor-identification service. It only runs if you choose Accept. It stores an identifier in your browser and, for visitors in the United States, may match a visit to a public business profile so we can see which companies are looking at Monact. You can change your answer at any time with “Cookie choices” at the foot of every page.

Your answer is kept in your browser so we do not ask on every page. Remembering it is strictly necessary and needs no consent.

We run no advertising cookies on this website.

5. How long we keep things

• Response detail — for a period set by the seller’s plan, starting at 365 days. After that individual responses are deleted and only daily totals and answer distributions remain. Sellers are emailed before anything is deleted.
• Seller account data — while the account is open, then up to 90 days after closure so it can be restored if closed by mistake.
• Invoices and tax records — six years, as UK tax law requires.
• Backups — replaced on a rolling cycle; deleted data disappears from backups as they age out.

6. Who else processes it

We use a small number of providers, each for one job. They act on our instructions under contract and may not use the data for their own purposes.

We will update this list before adding a new processor that handles personal data. Sellers may object under the DPA.

7. International transfers

We are in the UK. Transfers from the EEA to the UK are covered by the European Commission’s adequacy decision for the UK, renewed in December 2025.

Where a provider processes data in the United States, that transfer is covered by the UK International Data Transfer Addendum, Standard Contractual Clauses, or the provider’s certification under the UK Extension to the EU–US Data Privacy Framework, as set out in that provider’s data processing terms.

8. Your rights

Under UK and EU data protection law you can ask us to:

• give you a copy of what we hold about you;
• correct anything inaccurate;
• delete it, where there is no overriding reason to keep it;
• restrict or object to how we use it, including profiling;
• give it to you, or another provider, in a portable format;
• withdraw consent, where consent was the basis (this does not affect past use).

Email contact@monact.co. We respond within one month and will not charge you. If a request concerns responses collected by a seller, we will pass it to them, because they are the controller of that data.

You can complain to a regulator. In the UK that is the Information Commissioner’s Office (ico.org.uk, helpline 0303 123 1113). In the EU it is the supervisory authority where you live or work. We would rather you came to us first, but you do not have to.

9. Security

Everything is served over HTTPS. Passwords are handled by our login provider and never stored by us. Buyer IP addresses are hashed with a secret salt before storage and are not reversible. Access to production data is limited to people who need it. No system is perfectly secure, and we will tell affected people and the regulator about a breach where the law requires it — within 72 hours of becoming aware, in the cases that require it.

10. Children

Monact is for businesses and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe we have, email us and we will delete it.

11. Automated decisions

We make no automated decisions producing legal or similarly significant effects. In particular, the product contains no rule that reads a buyer’s answer and changes what they are shown — see Compliance.

12. Changes

If we change this policy materially we will email account holders before it takes effect. The date at the top always reflects the current version.

Contact

Thrilla Digital Ltd (SC878333)
150 Meiklehill Road, Kirkintilloch, Glasgow, G66 2JR
contact@monact.co

This policy was drafted against UK GDPR, EU GDPR and PECR and has not been reviewed by a solicitor. It is not legal advice.