Privacy Policy

For qrcandy.co, accounts, orders, support, the partner programme, and QRCandy's own service security, the following company is the data controller:

We have not appointed a data protection officer because the current processing does not require one. Privacy questions and rights requests go to hello@qrcandy.co with the subject Privacy Request.

Data comes from you, people acting for your organisation, a scanner's browser or device, QRCandy customers and partners, payment and delivery providers, our hosting and security systems, and public websites or brand sources when you use discovery.

The table states our purposes and GDPR Article 6 legal bases when QRCandy acts as controller. If you act for a company, contract performance may be the company's contract rather than a contract with you personally; in that case we normally rely on our and the company's legitimate interests in administering that relationship.

Our legitimate interests include operating and improving a secure storefront, fulfilling business orders, preventing fraud and abuse, keeping accurate campaign counts, supporting customers, and managing partner relationships. We balance those interests against the person's rights, minimise the data, and provide a right to object. Where we rely on consent, it can be withdrawn without affecting earlier lawful processing.

Required checkout fields are needed to form, pay for, or deliver the order. Without them we cannot complete that transaction. Optional fields are labelled or can be omitted. We do not use personal data for third-party advertising and do not make solely automated decisions about people that produce legal or similarly significant effects. AI-assisted brand suggestions are optional and remain for you to review.

For each accepted scan request, the application may record:

• timestamp, QR campaign/batch, destination, and resolved URL;
• HTTP user-agent and derived device/browser information;
• referring URL, if the scanner's app or browser supplies one;
• a two-letter country code supplied by hosting/CDN infrastructure; and
• a SHA-256 fingerprint made from the QR slug, request IP address, and user-agent to avoid counting immediate repeats as separate scans.

The application processes the request IP address transiently to route, secure, rate-limit, geolocate at country level, and build the fingerprint. It does not write the raw IP address into the QRCandy scan-event table. Hosting, CDN, or security logs may process IP addresses under their configured log-retention controls. A hash is pseudonymous personal data, not anonymous data.

The fingerprint is used for a five-minute deduplication window and is automatically removed from the event row after seven days. The remaining scan-event row is automatically deleted after 24 months. The relevant customer can see its campaign analytics; authorised QRCandy staff may access data only for support, security, compliance, or service operation.

As processor, QRCandy relies on the customer's documented instructions and the customer must identify its own legal basis. As independent controller for abuse prevention, count integrity, and QR infrastructure security, QRCandy relies on legitimate interests. You may object to that controller processing as explained in Section 8.

We do not sell personal data. We disclose only the data needed for the relevant service, and use processor agreements where the recipient processes on our behalf. Some recipients, especially payment providers and carriers, also act as independent controllers for their own legal, security, and operational purposes.

We may also disclose data to professional advisers, insurers, auditors, authorities, courts, or law enforcement where necessary and lawful; to protect people, rights, and the Service; or in a merger, financing, reorganisation, or sale subject to confidentiality and continuity of privacy protection.

Providers may process data in Sweden, elsewhere in the EEA, or in countries outside the EEA. The location depends on the selected service, hosting region, support path, and the provider's own infrastructure. We do not describe every provider as “US-based” because their contracting entities and processing locations differ.

For a restricted transfer, we use an available lawful mechanism such as an European Commission adequacy decision (including the EU-US Data Privacy Framework where the recipient and transfer are covered), the European Commission's Standard Contractual Clauses, and supplementary technical, organisational, or contractual measures where appropriate. Processor transfer obligations also appear in Section 11 of the Terms.

Email hello@qrcandy.co to ask about the mechanism relevant to your data or for a copy of applicable safeguards, subject to protection of confidential and security information.

We keep identifiable data only while needed for the purpose, an active relationship, legal obligations, or a genuine claim or security need. The current application uses these periods or criteria:

We may retain data longer if law requires it, a legal hold applies, or it is needed for a live complaint, chargeback, fraud investigation, or claim. When the exception ends, the ordinary period resumes. Anonymous aggregate statistics that no longer relate to a person may be kept.

Depending on the processing and applicable exceptions, GDPR gives you the following rights:

Send a request to hello@qrcandy.co with enough information for us to locate the data. We may verify identity and authority before disclosing or changing data. We normally respond within one month. For a complex request or several requests, GDPR allows up to two additional months and we will explain the extension within the first month. Requests are normally free; a reasonable fee or refusal is permitted only where the law allows, such as manifestly unfounded or excessive requests.

For Scan Data controlled by a QRCandy customer, contact the brand/customer shown on the product or destination first. QRCandy will assist that controller and will also handle any part for which QRCandy is controller. Rights are not absolute: for example, erasure does not override accounting retention or the establishment, exercise, or defence of legal claims.

Cookies and local storage both save or read information on your device and are subject to Swedish electronic-communications rules as well as GDPR when personal data is involved. QRCandy currently uses no third-party advertising, retargeting, or behavioural analytics on qrcandy.co.

Functional storage is used to provide a feature you request, such as login, cart, checkout, language, currency, or an applied referral code. A referral link asks the browser to remember that code so it can follow you to checkout; the cart shows the code and lets you remove it. You can also clear site data in your browser, but doing so signs you out and removes saved carts, drafts, preferences, and referral codes.

Stripe may use cookies or similar technologies on its separately hosted payment pages for checkout, fraud prevention, security, and performance under Stripe's own notices. Those technologies are controlled on Stripe's domain, not qrcandy.co.

We use measures proportionate to the nature and risk of the data, including HTTPS, hosted payment entry, hashed authentication credentials, role-based and row-level database access, separation of public and privileged server credentials, input and destination validation, rate limiting, short-lived deduplication identifiers, retention jobs, and restricted administrative access. Providers are selected and instructed with security and data-protection obligations appropriate to their role.

No online service can guarantee absolute security. Tell us immediately at hello@qrcandy.co if you suspect account compromise, an unsafe QR destination, or an unauthorised disclosure. We assess incidents and notify affected controllers, people, and authorities when the law requires.

Accounts, ordering, and the partner programme are intended for people aged 18 or older acting for themselves or an organisation. We do not knowingly create accounts for children or ask QR scanners for age, name, or contact details.

A child may nevertheless scan candy distributed by a customer. The passive request metadata described in Section 4 may then be processed. Customers must consider the likely audience, avoid unlawful targeting, and provide age-appropriate notices where required. Contact us if you believe a child's data needs review or deletion.

We update this policy when practices, providers, products, or law materially change. The effective date and version at the top identify the current text. Material changes will be brought to registered users' attention by email, dashboard notice, or another appropriate method before or when they take effect, depending on the nature and legal basis of the change.

We will seek fresh consent if a change requires it. An earlier version continues to describe processing that occurred while it applied; changing this notice does not create a new legal basis retroactively.

For privacy questions, objections, or rights requests, contact:

You can lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), particularly if you live or work in Sweden or believe the processing occurred here. You may also contact the competent supervisory authority in another EEA country where applicable.

You do not have to contact us before complaining, though we welcome the opportunity to resolve the concern. Our Terms of Sale and Service govern accounts, orders, QR services, and the processor relationship with customers.