Data processing agreement

This agreement applies automatically when you use Art QR Codes for a business and our service handles personal data on your behalf (for example the city and device of people who scan your codes). It forms part of our terms. No signature is needed; if you need a signed copy, the text below is the whole agreement.

1. Roles

You are the controller of personal data in your account and in scans of your codes. Ratio Visuals LLC, which operates Art QR Codes, is your processor and acts only on your documented instructions: the settings you choose in the product.

2. What we process

Account data (email, optional name and company), the destinations and content of your codes, and scan records: time, approximate city and region from the IP address (looked up on our own server; the IP address itself is not stored), device type, operating system and browser. Optional returning-visitor routing uses a first-party cookie only after the person scanning agrees.

3. Purpose and duration

Only to provide the service: generating codes, forwarding scans, and showing you scan reports. We keep data while your account exists. When you delete your account we delete its data within 30 days, except billing records the law requires us to keep.

4. Our commitments

• Confidentiality: only people who run the service can access data, and only to operate it.
• Security: encrypted connections (HTTPS), hashed sign-in secrets, access limited per account and workspace, and backups on the same encrypted hosting volume.
• Subprocessors: listed on /subprocessors. We update that page before adding one; if you object, you can cancel and take an automatic refund within 7 days of your last payment.
• Assistance: you can export or delete your data from your account; for anything else, reply to any email we send.
• Breaches: we notify affected customers by email without undue delay, and within 72 hours of becoming aware of a breach of their data.
• International transfers: data is hosted in the United States; where EU or UK law applies, the European Commission's Standard Contractual Clauses (module 2 or 3, as applicable) are incorporated by reference.

5. Audits

We answer reasonable written security questions by email. On-site audits are not offered.

6. End of service

On cancellation, printed codes keep forwarding (see the promise); you can delete your account at any time to remove its data.