.png)
.svg.png)
Data Processing Agreement of qr-logic.com
This Data Processing Agreement (DPA) governs the processing of personal data by QRlogic on behalf of business customers, in accordance with Art. 28 GDPR. It is automatically incorporated by reference into our Terms of Service — no separate signature is required to use the service.
Overview
This DPA is structured as follows:
| Section A | The key variables that apply to this DPA (parties, purpose, categories of data, sub-processors). |
|---|---|
| Section B | The general legal terms applicable to the processing. |
| Section C | The applicable technical and organizational measures (TOMs). |
Section A — Key terms
| Controller | The Customer, as identified in the Customer's QRlogic account. |
|---|---|
| Processor | Artur Schaefer (QRlogic), Calle Tarajal 17, Puerta K63, 38639 Chafiras, Tenerife, Spain Contact: support@qr-logic.com |
| Processing Purpose | The Processor provides QR code generation, hosting, and management services, including scan analytics for QR codes created by the Controller. The Processor processes personal data of the Controller's end users (individuals who scan the Controller's QR codes) on behalf of the Controller, including anonymized IP addresses, device type, and approximate location, for the purpose of providing scan analytics to the Controller. |
| Duration of Processing | Only as long as necessary for the Processing Purpose — i.e. for the duration of the Controller's active QRlogic subscription. All associated data is automatically deleted upon subscription expiration or termination. |
| Categories of Data Subjects | Customers, potential clients, and website visitors of the Controller; and general members of the public who scan QR codes created by the Controller (e.g. event attendees, product purchasers, or the general public, depending on the Controller's use case). |
| Categories of Personal Data | IP address (anonymized); device type; approximate location (country/region/city, derived from the anonymized IP address). Age is calculated transiently from a self-reported date of birth for routing purposes only (e.g. age-gated content) and is never stored. |
| Place of storage & processing | At the business address of the Processor and its approved Sub-processors, as indicated below. |
| On-premise audits | Not applicable. |
| Sub-processors | Elestio (France) — hosting infrastructure management Hetzner (Germany) — physical server infrastructure Note: The Processor's core software stack (Supabase) is self-hosted, open-source software running on the above infrastructure; there is no separate contractual relationship with a third-party company for this component. |
| Transfer outside of EU/EEA | Only allowed to countries where the Processor or an approved Sub-processor is registered. As all current parties and Sub-processors are registered within the EU/EEA, no transfer of the personal data described in this DPA currently takes place outside the EU/EEA. |
Section B — General terms
Purpose and scope
The purpose of this DPA is to ensure compliance with Article 28(3) and (4) GDPR. This DPA applies with respect to the processing of personal data as specified in Section A.
Interpretation
Where this DPA uses terms defined in the GDPR, those terms shall have the same meaning as in that law. This DPA shall be read and interpreted in light of the GDPR and shall not be interpreted in a way that conflicts with the rights and obligations provided for therein.
Obligations of the Parties
The Processor shall process personal data only on documented instructions from the Controller, unless required to do so by EU or Member State law. Subsequent instructions may be given throughout the duration of the processing and shall always be documented. The Processor shall immediately inform the Controller if an instruction, in its opinion, infringes applicable data protection law.
The Processor shall process personal data only for the specific purpose(s) set out in Section A, and processing shall only take place for the duration specified therein.
Security of processing
The Processor shall implement the technical and organizational measures specified in Section C to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access.
In the event of a personal data breach, the Processor shall notify the Controller without undue delay and at the latest within 48 hours after becoming aware of the breach, including a description of the nature of the breach, its likely consequences, and the measures taken to mitigate its effects.
The Processor shall grant access to personal data only to personnel for whom this is strictly necessary, and shall ensure such personnel are bound by confidentiality obligations.
Documentation and compliance
The Processor shall make available to the Controller all information necessary to demonstrate compliance with this DPA and shall, at the Controller's request, allow for and contribute to audits of the processing activities covered by this DPA. Such audits are limited to the Processor's records and do not extend to the Processor's physical premises.
Use of Sub-processors
The Processor has the Controller's general authorization to engage the Sub-processors listed in Section A. The Processor shall inform the Controller of any intended changes to that list at least 30 days in advance, giving the Controller the opportunity to object. Where a new Sub-processor is engaged, the Processor shall impose on it the same data protection obligations as set out in this DPA, and shall remain fully responsible to the Controller for the Sub-processor's performance.
International transfers
Any transfer of personal data to a country outside the EU/EEA shall only take place if authorized in accordance with Section A and in compliance with Chapter V GDPR.
Data subject rights
The Processor shall promptly notify the Controller of any request received directly from a data subject and shall not respond to it directly, unless authorized to do so by the Controller. The Processor shall assist the Controller in fulfilling its obligations to respond to data subjects exercising their rights under Chapter III GDPR (including the rights of access, rectification, erasure, restriction, portability, objection, and to not be subject to automated decision-making).
Termination
In the event that the Processor is in material breach of this DPA, the Controller may instruct the Processor to temporarily suspend processing until compliance is restored, or terminate this DPA where such breach is not remedied within a reasonable time, or where the Processor fails to comply with a binding decision of a competent court or supervisory authority.
Miscellaneous
Confidentiality: The Parties agree to keep the terms and existence of this Agreement confidential, unless agreed otherwise.
Entire agreement: This DPA is the entire agreement between the Parties relating to its scope, superseding all prior agreements on the same subject.
Amendments: Any amendments must be made in writing (including non-qualified e-signature solutions).
Severability: If any provision of this DPA is held invalid or unenforceable, the remaining provisions shall remain in full force and effect.
Governing law & jurisdiction: As per the Terms of Service.
Section C — Technical and Organizational Measures (TOMs)
Description of the technical and organizational security measures implemented by the Processor:
Organizational security measures
Operational structure
QRlogic is currently operated by a single individual, who also acts as the Processor under this DPA. Formal multi-person organizational procedures common in larger organizations are therefore not applicable in their typical form. Security is instead embedded directly into the technical architecture, development workflow, and infrastructure choices described below, all of which are personally reviewed and maintained by the Processor.
Security maintenance
The Processor conducts regular, comprehensive security reviews of the service (informed by OWASP principles), keeps software dependencies up to date and responds promptly to critical vulnerability disclosures, and keeps the underlying application framework continuously updated to current stable versions.
Incident response
In the event of a security incident affecting personal data processed under this DPA, the Processor will investigate the incident and notify the Controller in accordance with the "Security of processing" provisions of Section B.
Technical security measures
Access control
- Row Level Security (RLS) enforced on every database table, ensuring each Controller can only access their own data.
- Server-side authentication required on all routes that handle personal data; never enforced client-side only.
- Server-side verification of data ownership before every write or delete operation.
- Passwords never stored in plain text; hashed, with minimum length and complexity requirements enforced.
- Login error messages deliberately neutral to prevent account enumeration.
Encryption and transport security
- All communication with the service takes place over HTTPS/TLS.
- User passwords are hashed via the authentication provider, never processed or stored in plain text.
Attack and abuse protection
- Content-Security-Policy (CSP) headers enforced on all pages.
- Rate-limiting against brute-force attempts on login, registration, and public-facing forms.
- Automated bot submissions mitigated through a honeypot field and timestamp check, without third-party services.
- Protection against SQL injection via exclusive use of parameterized database queries.
- Protection against cross-site scripting (XSS) via input validation and output escaping.
Data minimization
- IP addresses for scan analytics are anonymized before storage (last octet removed).
- API responses limited to fields strictly necessary for the relevant function.
- Approximate geographic location determined locally on the Processor's own server using an offline database, without transmitting the IP address to any external service.
Data retention and deletion
- QR code data, scan data, and uploaded files are automatically and permanently deleted once the Controller's paid subscription period ends.
- A Controller's account is automatically deleted if no active subscription has existed for 3 years.
- Controllers may permanently delete their own account and all associated data at any time via self-service.
Infrastructure and data residency
The Processor's core database and authentication software (Supabase) is self-hosted, open-source software operated on the Processor's own infrastructure; there is no contractual relationship with Supabase Inc. (USA) for this component. This infrastructure runs exclusively on servers located in the European Union (Elestio, France, and Hetzner, Germany; data center location: Falkenstein, Saxony, Germany), a deliberate choice made to reduce exposure to non-EU legal access requests such as the U.S. CLOUD Act. Elestio holds ISO 27001 and SOC 2 certifications; support access by Elestio personnel is disabled by default and only granted on a temporary, logged basis at the Processor's explicit request.
Backups
Automated backups of the underlying infrastructure are provided as part of the hosting service by Elestio: backups are performed daily, retained for 180 days, and encrypted at rest using AES-256, held separately from the deployed environment.