Data Processing Agreement

1. Scope of the processing

• Subject matter and purpose: providing the QRKIT service you use: redirecting and hosting your dynamic QR codes, pages and files, scan and page analytics, forms, coupons, contact cards and wallet passes, notifications, and the developer API.
• Data subjects: people who scan your codes or visit your hosted pages, people who submit your forms or claim your coupons, and people whose details you put into your codes (for example on a business card).
• Categories of data: shortened (truncated) IP address, approximate location (country, region, city), device, operating system, browser, referrer and time of a scan; precise location only when you turn on precise location or geofencing and the visitor allows it in their browser; the answers people give in your forms; coupon claims; and any personal data you put into your codes and pages.
• Duration: for as long as you use the service, and then as set out in section 6.

QRKIT processes data about its own customers (your account, billing, support and product analytics) as a controller, as described in the Privacy Policy. This DPA does not cover that processing.

2. Your instructions

We process the data only on your documented instructions, which are these Terms, this DPA, and the settings you choose in QRKIT, unless EU or member state law requires otherwise (we will tell you first where the law allows). We tell you if we believe an instruction breaks data protection law. You are responsible for having a legal basis for the processing, including any consent and notice your visitors need, for example for tracking pixels you add to a code.

3. Confidentiality and security

Everyone at QRKIT who can access the data is bound by confidentiality. We apply appropriate technical and organisational measures, including encryption in transit (TLS), shortened IP addresses for scans, access limited to people who need it with strong authentication, separation of customer data by workspace, backups, logging of administrative access, automatic deletion under our retention schedule, and regular review of these measures.

4. Sub-processors

You give general authorisation for the sub-processors listed in our Privacy Policy. We impose data protection obligations on each of them that are no less protective than this DPA and remain responsible for them. We announce new sub-processors by updating that list before they start processing your data. You can object on reasonable data protection grounds by emailing [email protected] within 14 days of the update; if we cannot resolve the objection, you may cancel and we will refund any prepaid fees for the remaining period. Transfers outside the EU/EEA are protected by the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework.

5. Assistance and breaches

• We help you answer requests from people exercising their GDPR rights, mainly through the dashboard (deleting codes and form answers, and exporting analytics and form answers as CSV), and forward any request we receive about your data to you.
• We notify you without undue delay after becoming aware of a personal data breach affecting your data, with the information we have at the time, and help you meet your own notification duties.
• We make available the information reasonably needed to show compliance with Art. 28, such as this DPA, our sub-processor list and answers to a reasonable security questionnaire once a year. Where a supervisory authority requires it, or that information is not enough to show compliance, we will agree a further review with you, at your cost, with reasonable notice and in a way that protects other customers' data.

6. End of the service

When you delete data, codes, or your account, we delete the related personal data from live systems, and backups are overwritten in their normal cycle (about 30 days), unless the law requires us to keep it. You can export analytics and form answers as CSV before you leave. Scan data is in any case deleted after the retention periods in our Privacy Policy.

7. Liability and order of precedence

The limitation of liability in the Terms of Service applies to this DPA and covers all claims under it together with the Terms, except where the GDPR does not allow it. If this DPA and the Terms conflict on data protection, this DPA wins.