Digital Business Card Privacy: What NZ Professionals Should Check

A digital business card is as private as the data flow behind it. The QR code or NFC tap is only a doorway. What matters is what the card publishes, what it collects from the people who open it, where that information goes and who can still reach it after a staff member leaves. In New Zealand, the Privacy Act 2020 sets the rules for the collection side, and you can meet them with a handful of sensible choices.

This guide covers what to keep off your public profile, how to run a lead form without breaching trust, what to ask a provider about overseas processing, and how to treat offboarding as a privacy control.

TL;DR

• The tap or scan is rarely the risk. The risks are what your profile publishes, what your contact form collects and what the provider does with it behind the scenes.
• Publish only what a client needs to reach you for work. Keep home addresses, personal social accounts and private emails off the public card.
• Once a card collects someone else’s name, phone or email, you are collecting personal information under the Privacy Act 2020 and need a clear purpose, notice and a retention plan.
• Ask any provider where profile, analytics and captured-contact data are processed. “Hosted in New Zealand” does not answer the whole question.
• For teams, removing a leaver’s access and unpublishing their card is a privacy task, not just admin.

Table of Contents

• Are digital business cards safe?
• What to put on a public card, and what to leave off
• Where the real privacy duty begins: collecting other people’s details
• Don’t let a lead form become a marketing list
• “Hosted in New Zealand” is not the whole story
• QR codes and NFC: what to watch
• Teams: offboarding is a privacy control
• Our perspective: privacy is a design choice, not a disclaimer
• A practical privacy checklist before you share your card
• Choosing a plan that fits how you share
• FAQ
• Sources

Are digital business cards safe?

Generally yes, when you treat them like any other business system. A printed card is a one-way handover: once it is in someone’s pocket, you cannot change it, and it collects nothing. A digital card can be updated, withdrawn and measured. That flexibility is the benefit, and it is also why privacy needs thought.

A useful security review goes beyond “does the page use HTTPS”. A 2023 peer-reviewed paper on cybersecurity risks in digital business cards looks at the risks for organisations and end users, and recommends layered controls such as strong authentication, software updates and employee training. In practice that means thinking about five things:

1. Phishing and malicious redirects. Could someone swap a legitimate link for a harmful one?
2. Account takeover. Is your login protected by a strong, unique password?
3. Database compromise. What does the provider hold, and for how long?
4. Excessive analytics. Is anyone tracking more than they need to?
5. Over-sharing. Is the card itself publishing more than it should?

The fifth one is entirely in your hands, so start there.

What to put on a public card, and what to leave off

A digital card is a public page. Anyone who scans the code, taps the card or gets the link can read everything on it. The test is simple: would you be comfortable handing this detail to a stranger at a conference?

Reasonable to publish:

• Your name, role and organisation
• A work email and a work phone number
• Your business website and professional profiles
• A booking link, portfolio or capability document

Keep off the public profile:

• Home address
• Personal social accounts you do not use for work
• Private email addresses
• A mobile number you also use for password resets or two-factor codes

New Zealand guidance backs this restraint. Consumer Protection NZ says organisations should collect only the information they need for a lawful purpose and should not keep it longer than necessary. That duty sits with whoever collects data, but the habit is just as useful for what you choose to publish about yourself.

If you share different things with different audiences, use more than one card rather than one overloaded profile. A consultant might keep one card for corporate clients and another with a wider portfolio for creative work. EcoCard supports multi-card management and live updates, so changing a role or detail means editing one profile instead of reprinting. Our guide to creating a secure, live digital business card walks through the fields we suggest.

Where the real privacy duty begins: collecting other people’s details

Publishing your own details is your decision. The moment your card collects someone else’s information, the rules change. A contact form, an enquiry box or a “leave your details” prompt means you are collecting personal information about another person.

The Privacy Act 2020 has 13 principles. The Privacy Commissioner’s quick tour of the privacy principles says you can only collect personal information for a lawful purpose, and only where it is necessary for that purpose. The guidance also covers notice, fair collection, security, access, correction, use, retention and overseas disclosure.

For a card with a lead form, that translates into design decisions made before anyone fills it in:

• Ask for less. Name and email may be enough. A phone number, company size and budget might not be necessary for a first conversation.
• Say why. A short line such as “We will use your details to reply to this enquiry” does more than a long policy nobody reads.
• Say who sees it. If the details go to a CRM, a sales team or an assistant, tell people.
• Make optional things optional. People should be able to tell what is voluntary.
• Decide how long you will keep it. A pile of old event contacts is a liability. Delete or archive on a schedule.

The Privacy Commissioner also explains what people can expect when an organisation collects their information: they should be told when and why it is collected, and they can ask for access to it and request correction. Build a way for someone to do that, even if it is just a monitored email address.

We see this as privacy by design. Deciding which fields exist in the first place beats collecting everything and trying to justify it later. If you run events, our piece on following up within hours to capture leads at events covers the operational side, and lead capture QR codes for teams shows how to keep captured contacts from going stale.

Don’t let a lead form become a marketing list

The most common mistake is quiet: a person scans your card, leaves their email so you can send a PDF, and next week they are on your newsletter. That is where trust breaks.

The Privacy Commissioner’s AskUs guidance says that from a privacy point of view, opt-in is regarded as the better practice for marketing emails. Separately, the Unsolicited Electronic Messages Act 2007 applies to commercial electronic messages. The Association of Marketing’s FAQ on inferred and deemed consent is a practical reading of how consent and unsubscribe duties work under that Act. If you are unsure whether a particular message needs consent, check with a privacy or marketing lawyer.

The Commissioner’s 2024 public survey is a reminder why this matters. Concern about individual privacy had risen to 51%, up 5% from 2022. People are watching how you handle their details.

A defensible approach has three parts:

1. Reply to the enquiry, nothing more. The default use of a submitted form is the follow-up the person asked for.
2. Offer marketing as a separate tick box. Unticked, with plain wording.
3. Make leaving easy. Every message carries a working unsubscribe, and you action requests promptly.

If you track how people reach your forms, it helps to understand how links behave. This overview of dynamic QR codes and how they are tracked explains why the destination of a managed code can change and what you can measure, which is useful context when you write the notice that goes with a scan. Our networking follow-up templates show how to write a same-day message that respects these limits.

“Hosted in New Zealand” is not the whole story

Many buyers ask where their data is stored. It is a fair question, but it is only part of the picture. Principle 12 of the Privacy Act concerns disclosure of personal information outside New Zealand. An organisation may disclose personal information overseas where the recipient is subject to the NZ Act, provides comparable safeguards, has agreed to adequate protection such as contractual clauses, or the person has given informed permission when those safeguards are not otherwise in place. The Commissioner’s page on sending information overseas gives the short version: you can, but you must check who is receiving it.

For a digital card, the stack is wider than one server. Personal information can touch:

• Cloud hosting
• Analytics tools
• CRM integrations
• Email and forms
• Customer support platforms

So ask your provider plainly:

If you want a sense of what written data-processing terms look like, this data processing agreement checklist sets out clauses a business can look for when a processor handles personal information. It is written around South African law, so treat it as an example of the type of terms to ask about, not as the NZ test.

Check the privacy policy too. Consumer Protection NZ lists what a good policy should explain: what is collected, why, how long it is kept, how it is protected, whether it is shared, how to correct it and who to contact with a complaint. If a provider cannot answer in plain language, that tells you something.

QR codes and NFC: what to watch

The scan itself is a link. The sensible habits are the same ones you would use for any link:

• Show the destination. Place a short URL or name under the code so people can see where it goes before they open it.
• Protect the account behind it. If someone takes over your login, they can change where your code points. Use a strong, unique password and keep your recovery details current.
• Check printed codes. A sticker placed over a genuine code on a banner or lanyard is a known trick, so inspect codes in public places.
• Keep one link. An NFC card or QR code that points to a live profile never needs retagging, so the printed piece does not go out of date. Our NFC business card setup guide explains the one-link approach.

If you are placing codes on large formats, QR banner design guidance helps you size and position them so people scan the right thing.

One point in digital cards’ favour for recipients: they do not need to install an app. With EcoCard, the person receiving your details opens a normal web page, so they are not asked to hand a new vendor their data just to view yours.

Teams: offboarding is a privacy control

For an organisation, stale cards are a quiet exposure. A former employee’s card that still lists the company, a role and a working number can mislead clients and may route enquiries to nobody. A shared admin login nobody changed after a departure is worse.

A sound offboarding routine covers:

1. Remove the leaver’s access to the card platform and any connected tools.
2. Unpublish or reassign the card so the old profile stops representing the business.
3. Rotate shared administrative credentials if the person knew them.
4. Keep only records with a legitimate purpose. Delete the rest.
5. Handle access and correction requests from the leaver or from contacts they collected.

This is where central management earns its place. EcoCard’s business tools let an administrator keep branding consistent across staff cards and onboard or offboard people from one place, so a departure is one admin action rather than a hunt through personal accounts. See our guides to employee digital business cards and the employee offboarding checklist for NZ teams for the full process.

Our perspective: privacy is a design choice, not a disclaimer

We build EcoCard around a simple belief: a card should help you share the right information with the right person, and no more. That shapes how we think about the product.

First, public profile and lead capture are different jobs. A profile is information you choose to publish about yourself. Capturing a lead is collecting information about someone else, which carries duties. We encourage people to treat them separately and to decide the purpose of any form before it goes live.

Second, live updating is a privacy feature as much as a convenience. When a role changes, a number is retired or someone leaves, you edit the card once and every shared link shows the current version. Printed cards cannot do that, and old ones keep circulating with details you might no longer want out there.

Third, we think the honest answer to “is it safe?” is a checklist, not a slogan. Ask what is published, what is collected, who receives it, how long it is kept and who can still access it. Any provider, including us, should be able to answer those in plain words. Our list of digital business card benefits for teams covers how analytics and privacy fit together.

— Chris

A practical privacy checklist before you share your card

Run through this once, then revisit it each quarter.

For individuals

• Is every field on my public card something I would give a stranger at an event?
• Is my login unique and strong, with up-to-date recovery details?
• Does my lead form ask only for what I need?
• Does the form say why I am collecting details and who will see them?
• Do I have a plan to delete old contacts?

For business owners and administrators

• Have we asked our provider where profile, analytics and captured data are processed?
• Do we know which overseas recipients receive personal information, and what protects it?
• Is marketing a separate, opt-in choice, with a working unsubscribe?
• Does our offboarding routine unpublish cards and rotate shared credentials?
• Do staff know how to respond to a request for access or correction?

If you answer “not sure” to several of these, that is useful: it tells you where to tighten up first. For design choices that keep scans quick without over-collecting, see our notes on digital business card design that updates live.

Choosing a plan that fits how you share

If you want a card you control and can update live, EcoCard’s Individual plan is NZD 9.99 per month, and additional EcoCards are NZD 4.99 per month for when you want separate cards for separate audiences. For small teams, Starter is NZD 19.99 per month, Business is NZD 49.99 per month and Teams is NZD 99.99 per month, with central admin to keep branding and access under control. Enterprise is available on request, with no published price. You can see what is included on our features page, or read how pricing works for small teams in our GST-aware pricing guide.

FAQ

Are digital business cards safe?

Yes, when the card publishes only professional details, the account is protected by a strong password, and the provider is clear about what it collects and where it goes. The tap or scan is rarely the problem. Weak logins, over-sharing and unclear data handling are.

Do digital business cards fall under the Privacy Act 2020?

The Act applies to personal information an organisation collects. If your card has a contact form or lead capture, you are collecting other people’s information and need a lawful purpose, notice, security and a retention plan. For a specific situation, ask the Office of the Privacy Commissioner or a lawyer.

Does the provider have to store my data in New Zealand?

The Act does not simply require local storage. Principle 12 sets conditions for disclosing personal information to overseas recipients, such as comparable safeguards or contractual protection. Ask your provider where each type of data is processed, not only where the main server sits.

Can I add people who fill in my form to a mailing list?

Not automatically. The Privacy Commissioner says opt-in is the better practice, and the Unsolicited Electronic Messages Act 2007 applies to commercial emails. Use a separate, unticked consent box and a working unsubscribe link, and take advice if you are unsure.

What should happen to a card when an employee leaves?

Remove their access, unpublish or reassign the card, and rotate any shared admin credentials they knew. Keep only records you still have a legitimate reason to hold. Central management makes this one action for the administrator.

Sources

• Cybersecurity Risks in the Deployment and Use of Digital Business Cards
• Data and privacy, Consumer Protection NZ
• A quick tour of the privacy principles, Office of the Privacy Commissioner
• What are your privacy rights?, Office of the Privacy Commissioner
• FAQ: Inferred and Deemed Consent under the Unsolicited Electronic Messages Act
• Privacy Commission Report, March 2024
• Principle 12, Disclosure outside New Zealand

Recommended

• Employee Digital Business Cards: A Guide for NZ Teams
• 6 Pronoun Templates for Business Cards, NZ Context and Digital Privacy
• Secure, live digital business card: QR, link & vCard for professionals
• 6 Digital Business Card Benefits for Teams, From Analytics to Privacy

This article was produced with AI assistance and reviewed for accuracy. It is provided for general information only and is not professional advice.