This agreement supplements our terms of service and applies whenever we process personal data on your behalf. A counter-signed copy is available on request from privacy@saiberlab.com.
1. Roles
For data about people who scan your codes, submit your forms or view your hosted pages, you are the controller and we are the processor. For your own account data — your name, email, billing details and audit records — we are the controller, and our privacy policy governs it.
2. Scope of processing
| Item | Detail |
|---|---|
| Subject matter | Providing QR code generation, redirection, hosted pages and scan analytics |
| Duration | For as long as your account exists, plus the deletion window in section 7 |
| Categories of data subject | People who scan your codes, view your hosted pages, or submit your forms |
| Categories of personal data | Approximate location derived from network address; device, operating system and browser; referring source; a rotating pseudonymous visitor hash; plus any data you choose to collect through a form you create |
| Special category data | None processed by design. Do not collect it through QRCode by saiberlab forms |
Note what is absent: we do not store the IP address of anyone who scans, and we set no cookie on a redirect. The address is used in memory to derive a country and a hash, then discarded. This materially reduces what you are accountable for as controller.
3. Our obligations
- We process personal data only on your documented instructions, including transfers.
- Everyone with access is bound by confidentiality and has access only where their role requires it.
- We implement the measures in section 5.
- We assist you with data subject requests, breach notification, and data protection impact assessments, to the extent our role makes possible.
- We notify you without undue delay on becoming aware of a personal data breach affecting your data.
- We make available the information needed to demonstrate compliance with this agreement.
4. Sub-processors
You give general authorisation for us to engage sub-processors. We maintain a current list, available on request, and will give at least 30 days’ notice before adding or replacing one, during which you may object on reasonable data protection grounds and — if we cannot resolve it — terminate without penalty for the unused period.
Each sub-processor is bound by terms no less protective than these. Our current categories are hosting and database infrastructure, payment processing, transactional email, and error monitoring. None of them receives your visitors’ IP addresses, because we do not have them to pass on: geolocation is resolved against a database on our own servers.
5. Security measures
Encryption in transit (TLS) and of sensitive fields at rest (AES-256-GCM); argon2id password hashing; server-side authorisation on every request against a role-based permission model; databases not exposed to the internet; audit logging of changes; logs redacted of credentials. Our security page describes these in full, including what we have not done.
6. International transfers
Data is stored in the European Union. Where a sub-processor processes data elsewhere, the transfer is covered by the Standard Contractual Clauses, which are incorporated into this agreement by reference, with module two (controller to processor) applying.
7. Return and deletion
You can export your data at any time from your account settings, without asking us. On termination, data is retained for 30 days — so an accidental or malicious deletion can be reversed — and then permanently deleted, except where law requires us to keep it. Individual scan records are deleted at the end of your plan’s retention period as a matter of course; aggregate daily counts are kept so your historical charts survive.
8. Audit
On reasonable written notice, and no more than once a year unless a supervisory authority requires otherwise, we will provide the information reasonably necessary to demonstrate compliance. We do not hold a third-party certification to offer in place of this, and say so rather than pointing at a badge.
9. Liability
Liability under this agreement is subject to the limitations in our terms of service.