Is Your Digital Card Data Safe? GDPR & Saudi PDPL
Is your data safe on a digital business card? It is, if the platform collects the minimum, encrypts everything in transit, lets you export and delete on demand, and never sells your contacts. That is how ScaanMe operates, and this page explains it against the laws that actually matter in our markets: the EU's GDPR, Saudi Arabia's PDPL, Jordan's Personal Data Protection Law, and Kuwait's data privacy rules. If you hand your card to clients in Riyadh, Amman, Kuwait City, or Berlin, here is what each framework expects and how your digital business card holds up.
The privacy laws that apply in our markets
GDPR gets the headlines, but if your clients are in the Gulf and the Levant, regional laws matter more, and they are no longer theoretical.
| Law | Regulator | Applies when |
|---|---|---|
| GDPR (EU) | National data authorities | You process data of EU residents, wherever you are based |
| PDPL (Saudi Arabia) | SDAIA | You process personal data in Saudi Arabia or target Saudi residents |
| Personal Data Protection Law No. 24 of 2023 (Jordan) | Data protection council at the Ministry of Digital Economy | You process personal data of individuals in Jordan |
| Data privacy regulations (Kuwait) | CITRA | You provide telecom or digital services handling personal data in Kuwait |
The Saudi PDPL is the one Gulf professionals ask about most: it became fully enforceable on 14 September 2024 after its grace period ended, with penalties that can reach SAR 5 million. And enforcement of privacy law generally is real money: the DLA Piper GDPR survey counted roughly EUR 1.2 billion in European fines during 2025 alone, with EUR 7.1 billion in total since 2018. Per GDPR.eu, businesses based outside the EU must still comply when they process EU residents' data.
How ScaanMe handles your data
| Requirement | ScaanMe implementation |
|---|---|
| Lawful basis for processing | Consent and legitimate interest, as set out in the Privacy Policy |
| Data minimization | Only essential fields collected |
| Right to access | Full data export available |
| Right to deletion | Account and data deletion on request |
| Data portability | Export your account data on request |
| Encryption in transit | TLS on all connections |
| Password protection | Optional on any card you publish |
| Backups | Automated and encrypted |
These are the same principles the Saudi PDPL and Jordan's law demand: collect little, secure it, and give the person control.
Your data, your control
- Export anytime: download all your data in standard formats.
- Delete anytime: permanently remove your account and everything associated with it.
- No selling: ScaanMe never sells or shares your data with advertisers or data brokers.
- Transparent processing: the Privacy Policy lists exactly what is collected and why, in plain language.
For the people who view your card
Privacy runs both ways. When someone opens your digital card:
- No personal data is collected from the viewer without consent.
- Analytics count aggregate views, taps, and scans, not personal identities. The analytics guide explains exactly what you can and cannot see.
- Contact saves are initiated by the viewer downloading your .vcf file, never pushed to their phone.
A digital card should know less about your contacts than your phone already does, and be able to prove it.
What about payment data?
Subscription payments are processed through PCI DSS compliant payment providers, and ScaanMe never stores your full card number on its own servers. Your contacts and card content are completely separate from billing: nothing about who viewed your card or who you met ever enters a payment flow. A free plan is available and paid plans start from $8/month; you can create an account without entering any payment details at all.
FAQ
Does ScaanMe sell my contacts or my data?
No. ScaanMe's business model is subscriptions, not data. Your contacts, leads, and card analytics are never sold, rented, or shared with advertisers.
Is ScaanMe aligned with the Saudi PDPL?
ScaanMe applies the principles the PDPL requires: minimal collection, a lawful basis for processing, security safeguards, and working export and deletion rights. If your business operates in Saudi Arabia, using tools built this way is part of your own PDPL housekeeping.
Can I delete all my data?
Yes. Account deletion removes your profile, cards, contacts, and analytics permanently. You can request an export of your data first.
Where is my data stored?
On secured cloud servers, encrypted in transit with TLS and backed up in encrypted form. Access is restricted, and cards you publish can be protected with an optional password.
