Privacy policy

1. Introduction

This Policy explains how QRzen.io collects, uses, shares, retains and protects personal data when a person:

• Visits qrzen.io.
• Creates an Account.
• Starts a trial.
• Subscribes to a Plan.
• Uses tools, API or integrations.
• Contacts support.
• Receives communications.
• Scans dynamic codes.
• Accesses pages or content hosted through QRzen.io.

2. Data controller

The controller of the data associated with the administration of QRzen.io is:

In certain processing related to data that a Customer enters or collects for their own purposes, the Customer may act as controller and QRzen.io as the provider responsible for supplying the infrastructure.

3. Scope

This Policy applies to processing carried out by QRzen.io.

It does not generally govern:

• Independent processing carried out by our Customers.
• External destination sites.
• Third-party platforms.
• Providers whose relationship is directly with the user.

When a code directs to an external site, that site's policy should be consulted.

4. Categories of data subjects

We may process data of:

• Visitors.
• Customers.
• Authorized users.
• Company representatives.
• API users.
• Support requesters.
• End Users who scan codes.
• Business contacts.
• People included in content uploaded by Customers.
• Payment method holders.
• People exercising rights or filing complaints.

5. Data provided directly

We may collect:

• First and last name.
• Username.
• Email.
• Phone.
• Company.
• Job title.
• Address.
• Tax data.
• Billing address.
• Tax identification number.
• Preferences.
• Encrypted credentials.
• Communications with support.
• Requests and complaints.
• Survey responses.
• Consents.
• Account settings.
• Information provided during verifications.

6. Payment and billing data

Payments may be handled by external providers.

We may receive:

• Payment status.
• Amount.
• Currency.
• Date.
• Transaction identifier.
• Payment method type.
• Last digits.
• Issuing country.
• Result of antifraud checks.
• Information about refunds, disputes and chargebacks.

We normally do not receive or store the full card number or its security code.

7. Third-party authentication data

If the user logs in through an external provider, we may receive:

• External identifier.
• Name.
• Email.
• Profile picture.
• Company or professional profile.
• Technical tokens.
• Data authorized by the user.

The information will depend on the provider's permissions and configuration.

8. Technical and usage data

We may automatically record:

• Full IP address.
• Approximate country, inferred from the IP address at sign-up.
• Date and time.
• Session identifiers.
• Browser.
• Operating system.
• Device type.
• Language.
• Time zone.
• Resolution.
• Pages visited.
• Features used.
• Clicks and interactions.
• Referring URL.
• Campaign parameters.
• The click identifier of the ad that brought the user, when the landing URL includes one (for example gclid or fbclid), processed under legitimate interest to measure our own campaigns.
• Errors and performance.
• Access attempts.
• Security logs.
• Account activity.
• API data.
• Cookie preferences.
• Advertising identifiers, where consent exists.

For every account, we keep for 90 days a record of each user's important actions —sign-ins, password and email changes, changes to the team and to QR codes— with their IP address. The owner and administrators can see it, and it is kept even if a member leaves the team.

9. Code and project data

We may process:

• Code type.
• Destination.
• Content.
• Design.
• Logo.
• Files.
• Pages created.
• Domains.
• Folders.
• Tags.
• Campaigns.
• Settings.
• Creation and modification dates.
• Users with access.
• Technical history.
• Activation status.
• Limits and consumption.

10. Scan data

When a dynamic code is scanned or content managed by QRzen.io is accessed, we may collect:

• Full IP address.
• Date and time.
• Code scanned.
• Page or destination requested.
• Approximate country, region and city.
• Device type.
• Browser.
• Operating system.
• Language.
• Referrer.
• Technical identifiers.
• Interactions with the page.
• Conversion events.
• Bot, fraud or security signals.
• How the content was reached: by scanning the code or by opening its link.

Geolocation is usually inferred from the IP and may be inaccurate. We do not necessarily obtain the device's exact GPS location.

To count how many different browsers open the same code, we store a first-party cookie on the device with a random identifier, valid for 30 days from the last visit. It contains no data, is not matched with other sites or across codes of different Customers, and is not shared with third parties. It counts browsers, not people: the same visitor on two devices counts twice.

11. Data included by Customers

Customers may enter personal data of third parties into:

• vCards.
• Forms.
• Pages.
• Files.
• Events.
• Directories.
• Campaigns.
• Integrations.
• Content.
• Connected databases.

In these cases, the Customer generally determines why and how they use the data.

If a Customer publishes a feedback page, we store for them the ratings and comments the End User sends and, only if the Customer asks for them, their email and phone number. The page states who receives them. We do not store the IP address or the language with them, and they are deleted when the Customer deletes them or permanently deletes the code.

Affected individuals should first contact the Customer who published or collected the information. QRzen.io may cooperate where necessary.

12. Sensitive data

QRzen.io is not specifically designed to store special categories of data or highly sensitive information.

Customers must not enter medical, biometric, genetic, sexual, religious, political, union, criminal, highly sensitive financial information or government identifiers, unless:

• It is strictly necessary.
• It is lawful.
• There is a legal basis.
• Appropriate measures have been adopted.
• The Plan and functionality are adequate.

QRzen.io may remove or restrict sensitive content that generates risks.

13. Purposes of processing

We may use personal data to:

1. 1. Create and manage Accounts.
2. 2. Provide the Service.
3. 3. Generate and resolve codes.
4. 4. Host content.
5. 5. Provide statistics.
6. 6. Manage trials and Plans.
7. 7. Process payments.
8. 8. Issue invoices.
9. 9. Manage cancellations and refunds.
10. 10. Provide support.
11. 11. Authenticate users.
12. 12. Protect security.
13. 13. Prevent fraud and abuse.
14. 14. Enforce the Terms.
15. 15. Measure and improve the product.
16. 16. Fix errors.
17. 17. Develop features.
18. 18. Perform analytics.
19. 19. Personalize the experience.
20. 20. Send operational communications.
21. 21. Send commercial communications where lawful.
22. 22. Measure advertising campaigns.
23. 23. Comply with legal obligations.
24. 24. Defend rights and claims.
25. 25. Manage business reorganizations.
26. 26. Create aggregated or anonymized information.

14. Legal bases

Depending on the processing and the jurisdiction, the bases may be:

Performance of a contract

To create the Account, provide features, process payments, manage the subscription and provide support.

Pre-contractual measures

To handle requests before contracting and to allow a trial.

Consent

For non-necessary cookies, personalized advertising, certain communications and other processing that requires authorization.

Consent can be withdrawn without affecting prior processing.

Legitimate interest

For security, fraud prevention, improvement, limited analytics, administration, legal defense and professional communications, when our interests do not override the data subject's rights.

Legal obligation

For taxation, accounting, requirements, penalties, crime prevention and regulatory compliance.

Protection of rights and interests

In exceptional situations to protect users, third parties, QRzen.io or the public.

15. Operational communications

We may send messages necessary to:

• Confirm the Account.
• Reset passwords.
• Report on security.
• Notify payments.
• Respond to support.
• Communicate contractual changes.
• Report on suspension or expiration.
• Manage the Service.

These communications are not necessarily commercial and may be essential while an Account exists.

16. Commercial communications

We may send news, offers, content or recommendations when:

• The user has given their consent.
• Another valid legal basis exists.
• The law allows communications about similar services.

Each communication will normally include an unsubscribe mechanism.

Unsubscribing from marketing does not prevent operational communications.

17. Advertising and measurement

With consent where necessary, we may use advertising and measurement services to:

• Attribute campaigns.
• Measure conversions.
• Build audiences.
• Cap frequency.
• Personalize ads.
• Analyze performance.
• Detect advertising fraud.

Providers may process identifiers, IP, activity, campaign parameters and device data in accordance with their own policies.

Preferences can be managed from the cookie panel.

18. Cookies and similar technologies

We use cookies, pixels, local storage, SDKs, tags and similar technologies.

Some are necessary. Others will only be used when there is an adequate legal basis.

Additional information can be found in the Cookie Policy.

19. Recipients

We may share data with providers that help us with:

• Hosting.
• Infrastructure.
• Databases.
• Storage.
• Delivery networks.
• Security.
• Analytics.
• Advertising.
• Payments.
• Billing.
• Authentication.
• Email.
• Support.
• Development.
• Monitoring.
• Advice.
• Fraud prevention.
• Administrative management.

They will only receive the information reasonably necessary for their function and will be subject to appropriate contractual or legal obligations.

20. Customers and administrators

When an Account belongs to a company or team, its administrators may access data and activity of authorized users.

The organization will be responsible for informing its members.

If the user uses a corporate email, the organization may request control of the Account when it demonstrates sufficient rights and the law allows it.

21. Authorities and legal defense

We may disclose information when reasonably necessary to:

• Comply with a law.
• Respond to a valid order.
• Investigate fraud.
• Protect security.
• Prevent harm.
• Enforce contracts.
• Defend rights.
• Handle claims.

We will review the validity of requests where possible.

22. Corporate transactions

Data may be disclosed in a merger, acquisition, financing, reorganization, insolvency, sale of assets or transfer of the Service.

We will require the recipient to respect the applicable obligations and will provide information where legally appropriate.

23. International transfers

QRzen.io provides a worldwide service and may use providers located in different countries.

When data is transferred outside the European Economic Area or a jurisdiction with equivalent protection, we will use recognized mechanisms where required, such as:

• Adequacy decisions.
• Standard contractual clauses.
• Binding corporate rules.
• Legal exceptions.
• Additional safeguards.

The specific location may vary depending on providers and features.

24. Retention

We do not keep all data for the same period.

We will keep it for as long as necessary to:

• Provide the Service.
• Maintain the Account.
• Allow a reasonable reactivation.
• Comply with legal obligations.
• Manage billing.
• Prevent fraud.
• Resolve incidents.
• Maintain security.
• Defend claims.

The periods may depend on the nature of the data, the Plan, the activity, tax requirements and limitation periods.

When the data is no longer necessary, it may be deleted, anonymized or isolated.

If the free trial ends and you never subscribe to a plan, we delete the account and everything in it about three weeks later, and we email you 10 days before.

QR codes you move to the trash are permanently deleted, together with their statistics, after 30 days.

25. Retention of scan data

Scan data may be kept for the duration of the Account and afterwards for the time reasonably necessary to provide statistics, prevent fraud, investigate incidents and comply with obligations.

We do not guarantee indefinite storage.

QRzen.io may:

• Aggregate data.
• Anonymize it.
• Reduce its precision.
• Set historical limits.
• Delete old records.
• Offer different periods depending on the Plan.

The Customer must export the statistics they need to keep.

26. Retention after cancellation

Cancelling a Plan does not imply the immediate deletion of all data.

We may keep projects for a reasonable period to facilitate a reactivation, without guaranteeing that they remain available.

The Customer may request the deletion of their Account, subject to legal and technical obligations.

27. Security

We apply reasonable technical and organizational measures, such as:

• Encryption in transit.
• Access controls.
• Permission management.
• Monitoring.
• Backups.
• Activity logging.
• Infrastructure protection.
• Fraud prevention.
• Updates.
• Environment separation.
• Incident procedures.

No system is completely secure.

The user must protect their credentials and notify us immediately of any incident.

28. Security incidents

If we detect a personal data breach, we will assess its risks and adopt the required measures, including notifications to authorities or affected individuals where appropriate.

Customers must inform us immediately of incidents related to their Account.

29. Data protection rights

Depending on applicable law, the data subject may request:

• Access.
• Rectification.
• Erasure.
• Objection.
• Restriction.
• Portability.
• Withdrawal of consent.
• Information about the processing.
• Review of certain automated decisions.
• Filing a complaint.

The rights are not absolute and may be subject to exceptions.

30. Exercising rights

Requests can be sent to:

help@qrzen.io

The request must indicate the right exercised and provide sufficient information to identify the data subject.

We may request reasonable identity verification.

We will respond within the legal deadlines.

When QRzen.io processes data solely on behalf of a Customer, we may forward the request to that Customer.

31. Complaints

The data subject may file a complaint with the competent data protection authority of their residence, workplace or the place of the alleged infringement, where the regulations allow it.

Before doing so, they can contact QRzen.io to try to resolve the matter.

32. Automated decisions

We may use automated systems to:

• Detect fraud.
• Identify malware.
• Block traffic.
• Classify risk.
• Limit abuse.
• Protect payments.
• Moderate content.

When a decision produces significant legal effects and the law requires it, the corresponding safeguards will be provided, including the possibility of human intervention.

33. Aggregated and anonymized information

We may create aggregated or anonymized statistics to:

• Analyze trends.
• Improve the Service.
• Publish metrics.
• Research security.
• Plan capacity.
• Develop products.

Information that no longer reasonably allows identifying a person may not be considered personal data.

34. Minors

QRzen.io is not specifically directed at minors under 18.

We do not knowingly collect data from minors who cannot validly consent to the processing without authorization from their representatives.

If a representative believes a minor has provided data improperly, they can write to help@qrzen.io.

Customers who create content directed at minors will be responsible for complying with applicable rules.

35. External links

Codes may direct to external sites.

QRzen.io does not control their privacy practices.

We recommend reviewing the destination's policy before providing information.

36. Changes to this Policy

We may update this Policy due to legal, technical, operational or commercial changes.

We will publish the updated version and its date.

When the change is substantial, we will provide reasonable notice where required or appropriate.

37. Contact

For privacy queries or rights: