Data processing agreement

This data processing agreement ("DPA") forms part of the terms of service between , () ("we", the processor) and the customer who uses Scanteo ("you", the controller). It applies when we process personal data on your behalf under Article 28 of the GDPR. It takes effect when you accept the terms of service; no signature is needed. Contact: .

1. Subject, duration and nature of processing

We host your QR codes, pages and settings, answer scans of your codes, count them, receive the forms on your pages and run the integrations you turn on. Processing lasts as long as your account exists and ends with its deletion as described in section 8.

2. Categories of data subjects and personal data

• People who scan your codes: time, code, device type, operating system, browser, referring website, language, country and city where available, a daily rotating hash of the IP address (the address itself is never stored) and, for A/B tests, the variant shown.
• Visitors of your pages: what they enter into your forms (for example name, email address, phone number, message, answers), stored encrypted.
• People in your content: details you put on contact cards, pages and files.
• Your team: names and email addresses of the members you invite, and the activity log of their changes.

We do not ask you to process special categories of data (Article 9 GDPR) and you agree not to collect them through our forms.

3. Our obligations

• We process personal data only on your documented instructions: the terms of service, this DPA and your settings in the product (for example the integrations you turn on). If an instruction seems to break data protection law, we will tell you.
• Everyone at our company with access to the data is bound by confidentiality.
• We apply the security measures in section 5.
• We help you, as far as we reasonably can, to answer requests of data subjects and to meet your obligations under Articles 32 to 36 GDPR.
• We tell you without undue delay, and where possible within 48 hours, after we become aware of a personal data breach affecting your data.
• We make available the information needed to show compliance with this DPA and allow audits as described in section 7.

4. Sub-processors

You authorise us to use the sub-processors listed below. We bind each of them by a written contract with data protection obligations no weaker than this DPA. We announce new sub-processors at least 30 days before they start by email to the account owner; you may object for reasonable data protection reasons, and if we cannot address the objection you may end the contract.

• [Hosting provider], hosting of the application and the database, [region];
• [Email delivery provider], notification emails;
• [Content delivery network], delivery of redirects and pages;
• Google Ireland Ltd, Web Risk: destinations of codes and links on pages (no data of people who scan);
• Cloudflare, Inc., Turnstile: spam protection of page forms, only when turned on.

Services you connect yourself (for example Google Analytics or your own webhook server) receive data on your instruction; for them you, not we, choose the recipient.

5. Security measures

• Encryption in transit (TLS) for all traffic; encryption at rest of form responses, contact card details and secrets of integrations.
• No storage of IP addresses of people who scan codes; daily keys for unique visitors deleted after two days.
• Access to the panel protected by passwords stored as one-way hashes, optional two-factor sign-in (required for our administrators) and roles per workspace.
• Separation of customer data by workspace in every query, tested automatically.
• Regular backups, logging of administrative actions and automated security tests before every release.

6. International transfers

We host your data in [region]. Where a sub-processor processes data outside the European Economic Area, the transfer is covered by an adequacy decision or the standard contractual clauses of the European Commission.

7. Audits

We answer reasonable written questions about our data protection measures. If those answers are not enough to show compliance, you may audit us once a year, at your cost, with 30 days' notice, during business hours and without access to other customers' data.

8. Deletion and return of data

You can export your codes, redirect map, scan statistics and form responses at any time. When you delete your account we delete your data within [30] days, except where the law requires us to keep it, and backups are overwritten within [35] days.

9. Liability and precedence

Liability under this DPA follows the terms of service. If this DPA and the terms of service conflict on data protection, this DPA prevails.