Data processing agreement

1. Who this applies to

This agreement (the "DPA") is between you, the customer who holds a QRSalt account ("you", the controller), and , a Norwegian company ("we", the processor). It forms part of our terms of service and applies automatically whenever we process personal data on your behalf. Nothing needs signing; if your organisation needs a countersigned copy, email support@qrsalt.com.

Words such as "personal data", "processing", "controller", "processor" and "personal data breach" mean what they mean in the GDPR (Regulation (EU) 2016/679), as it applies in Norway and the rest of the EEA. Where UK or Swiss law applies to you, the equivalent terms of those laws apply in the same way. Where a US state privacy law applies, we act as your service provider or processor under it: we use the data only to provide the service to you, and do not sell it, share it for cross-context behavioural advertising, or combine it with data from elsewhere.

This DPA does not cover data about you as our customer (your account, your billing). We are the controller of that, as the privacy policy explains.

2. What we process for you

We also use scan and request records ourselves, as an independent controller, for one purpose only: keeping the service secure and free of abuse (for example, spotting a code used for phishing). The privacy policy describes that use.

3. Your instructions

We process this data only on your documented instructions, which are these terms, the settings you choose in the product, and anything else you ask of us in writing, unless the law requires otherwise; if it does, we will tell you first unless the law forbids that. If we think an instruction breaks data protection law, we will say so.

You are responsible for having a lawful basis for the data you collect with the service, for telling the people concerned (for example, in a notice on your form or on the printed piece beside your code), and for what your forms ask.

4. Confidentiality

Only people who need to run or support the service can access your data, and they are bound by confidentiality. We do not look at your data except to provide the service, to fix a problem, to deal with abuse, when the law requires it, or when you ask us to.

5. Security

We maintain technical and organisational measures appropriate to the risk, as Article 32 requires. Today they include:

• Encryption in transit: every page, redirect and API call is served over HTTPS, with HSTS.
• Cloudflare in front of our own domains, filtering attacks and bots. The server accepts forwarded visitor addresses only from Cloudflare's published network ranges, so they cannot be forged to get around rate limits.
• Scan and form analytics never store a raw IP address; the daily visitor hash uses a key that is thrown away each day. Individual scan records are deleted after 30 days, once they have been added to daily totals.
• Passwords are stored only as salted scrypt hashes; session tokens, API keys and authenticator backup codes only as hashes; authenticator secrets encrypted. Two-step sign-in with an authenticator app is available to every account.
• Every read of customer data checks that the signed-in person belongs to the workspace. Team roles limit who can change what.
• Rate limits and bot checks on sign-in, forms and other public endpoints.
• Uploaded pictures are re-encoded and fingerprinted; code destinations are checked against Google Safe Browsing when set and periodically after.
• Administrative access is limited to named staff accounts and sits behind Cloudflare Access as well as our own sign-in. Administrative actions are logged.
• Hourly database backups and daily file backups. Copies on the server are readable only by the system administrator. Off-site copies are encrypted on the server before upload to Cloudflare R2, with a key held only by us and kept off the server; each upload is verified, and restores are tested regularly.

We do not hold ISO 27001, SOC 2 or similar certifications. We will answer reasonable security questionnaires.

6. Sub-processors

You give us general authorisation to use the sub-processors on our sub-processor list. We bind each of them by contract to data protection obligations that meet Article 28 of the GDPR, and we remain responsible to you for them.

We will update the list at least 30 days before a new sub-processor starts processing your data, and notify you by email if you have asked to be told. You may object on reasonable data protection grounds within that time; if we cannot resolve the objection, you may end the affected service and we will refund any prepaid fees for the unused period.

7. International transfers

The service is hosted in the United States. Where your data leaves the EEA, the UK or Switzerland, the transfer to our sub-processors is covered by the European Commission's Standard Contractual Clauses (with the UK and Swiss addenda where they apply), or by the EU–US Data Privacy Framework where the recipient is certified under it, as shown for each provider on the sub-processor list.

8. Helping you meet your obligations

• Requests from people. If someone asks us about data we hold for you, we will pass the request to you rather than answer it ourselves. The product lets you find, export and delete scan data, form responses and content yourself; where it does not, we will help.
• Assessments and consultations. We will give you the information you reasonably need for a data protection impact assessment or a consultation with a supervisory authority about the service.

9. Personal data breaches

We will tell you without undue delay after becoming aware of a personal data breach affecting your data, by email to the account owner. We will say what happened, what data and roughly how many people are affected, the likely consequences, what we are doing about it, and who to contact, and add detail as we learn it. We will help you notify a supervisory authority or the people affected where you need to.

10. Deletion and return

You can export and delete your data at any time from the dashboard. Ending a paid plan does not delete it; delete it, or your account, if you want it gone. When you delete your account, it can be restored for 30 days, and after that everything we hold for you is permanently deleted from the live system. Backups containing it expire on their own schedule: copies on our server within 30 days, and encrypted off-site copies within 12 months. Until then they are kept encrypted or access-controlled and unused, and if we ever had to restore one we would delete your data again before bringing it back into service. We keep a copy of anything only where the law requires us to.

11. Audits

We will make available the information needed to show that we meet Article 28, starting with this page, the sub-processor list and our answers to your questions. If that is not enough, you (or an independent auditor bound by confidentiality) may audit our compliance once a year, at your cost, on 30 days' written notice, in a way that does not disrupt the service or expose other customers' data. More frequent audits are allowed after a breach affecting you or when a supervisory authority requires one.

12. Liability and precedence

Liability under this DPA is subject to the limits in the terms of service, except where the law does not allow them. If this DPA and the terms of service conflict on data protection, this DPA wins. It is governed by Norwegian law, like the terms.

13. Contact

Data protection questions, requests for a signed copy and breach contacts: support@qrsalt.com. That is the same inbox as support, read by the people who run the service.