GDPR Data Protection

Under GDPR, you have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate data
• Erasure: Request deletion of your data
• Portability: Receive your data in a machine-readable format
• Restriction: Limit how we process your data
• Object: Object to certain processing activities

We process the following categories of personal data:

• Identity data (name, email address)
• Contact data (email, phone number)
• Financial data (payment information via Stripe)
• Usage data (QR code analytics, platform usage)
• Technical data (IP address, browser type)

We process your data based on:

• Contract: To provide our QR code services
• Legitimate Interest: For analytics and service improvement
• Consent: For marketing communications (where required)
• Legal Obligation: For tax and financial reporting

We retain personal data only as long as necessary:

• Account data: Until account deletion + 30 days
• Payment records: 7 years (legal requirement)
• Analytics data: 2 years maximum
• Support communications: 3 years

Your data may be transferred outside the EU/EEA to service providers with appropriate safeguards including adequacy decisions and standard contractual clauses.

We implement technical and organizational measures including encryption, access controls, regular security assessments, and staff training.

In case of a data breach, we will notify the relevant supervisory authority within 72 hours and affected individuals without undue delay if there is high risk to rights and freedoms.

Our Data Protection Officer can be contacted at:

• Email: dpo@qrcontent.com
• Post: QR Content AB, DPO, [Address], Sweden

You have the right to lodge a complaint with a supervisory authority, particularly in your country of residence, workplace, or where the alleged infringement occurred.