GDPR Notice

1. Data controller

Your personal data is processed by QuvtyQR (data controller) within the scope described below. Contact: [email protected].

2. Data we process and purposes

• Identity/contact data: Account creation and service delivery.
• Transaction security data: IP and session logs — security and abuse prevention.
• Customer data: Name and phone collected from businesses' customers for orders/reservations.
• Transaction security, billing and fraud-prevention data: IP address and the country determined from it, phone number, the card's issuing country and card fingerprint received from our payment provider (Stripe) (the card number is not stored), and payment dispute (chargeback) records — regional pricing and location verification, billing and tax obligations, preventing fraud and chargebacks, and preventing accounts closed due to a chargeback from being reopened.
• Device and browser security data: Device identifier cookie (qq_did), browser fingerprint (a one-way SHA-256 hash, qq_fp), approximate location derived from the IP address by Cloudflare (country, region, city, approximate coordinates), browser user agent and language, recorded at sign-up, sign-in and payment — account and payment security, preventing fraud and chargebacks, and enforcing the permanent ban after a chargeback (the device identifiers of a banned account are blocked; IP and browser fingerprint are only supporting signals and never block on their own). Hardware identifiers such as IMEI are not collected.
• Consent records: Document version, time, IP address, country, device identifier and browser user agent when you accept the Terms of Use and the Privacy Policy (sign-up, purchases, turning on auto-renewal) — proof of consent and of the conclusion of the contract; for payments, the record ID is attached to the payment at Stripe.

3. Legal basis

We process your data on the bases of performance of a contract, compliance with legal obligations and our legitimate interests (Art. 6 GDPR). Transaction security, billing and fraud-prevention data are processed for the conclusion and performance of a contract (Art. 6(1)(b)), compliance with legal obligations such as billing and tax (Art. 6(1)(c)) and our legitimate interest in preventing fraud (Art. 6(1)(f)). Blocking records of accounts closed due to a chargeback are kept for as long as the blocking purpose continues and for the applicable statutory retention periods. Device and browser security data are processed on the basis of our legitimate interest in preventing fraud (Art. 6(1)(f)) and the performance of the contract (Art. 6(1)(b)); consent records are kept to prove the conclusion of the contract (Art. 6(1)(b)). Security records are kept for 2 years.

4. International transfers

Data needed for payments, location verification and fraud prevention is shared with our payment provider, Stripe. Where data is transferred outside the EEA, we rely on appropriate safeguards such as Standard Contractual Clauses with our infrastructure and payment providers. Cloudflare, our network and security provider, processes IP addresses to protect the service and to determine approximate location.

5. Your rights (GDPR Art. 15–22)

• Access your personal data and obtain a copy,
• Rectify inaccurate data or complete incomplete data,
• Erase your data (‘right to be forgotten’) and restrict processing,
• Data portability, and object to processing — including lodging a complaint with your supervisory authority.

6. Exercising your rights

To exercise your rights, contact [email protected]. We respond within one month at the latest.