Privacy Policy

QrX has two GDPR roles. For merchant users, website visitors, support contacts and our own billing and security logs, QrX B.V. is the controller. We decide the purposes and means of that processing.

For personal data that a merchant uploads or sends to QrX so we can create shipments, deliver PIN codes, collect Payment on Delivery, handle returns or send transactional messages to that merchant's customers (consignees), the merchant is the controller and QrX B.V. is the processor. We process that data only on the merchant's documented instructions, as set out in the Data Processing Addendum (verwerkersovereenkomst).

The Data Processing Addendum that applies when QrX acts as processor is published here: Data Processing Addendum.

The personal data we collect depends on how you interact with our Services. We collect the following categories of data:

• •Account information — name, email address, phone number, company name, business registration details and login credentials when you create a QrX account.
• •Transaction data — payment amounts, payment status, order references, delivery addresses, QR code scan events and payment confirmations processed through our platform.
• •Financial information — bank account details (IBAN), billing addresses, invoicing data and payment settlement information necessary to process transactions.
• •Technical data — IP address, browser type, device identifiers, operating system, screen resolution and usage analytics collected automatically when you access our Services.
• •Communication data — messages, support requests, feedback and correspondence exchanged with our team.
• •Delivery data — carrier information, tracking numbers, delivery status updates and proof-of-delivery records related to QrX On Delivery flows.
• •Merchant consignee data (processor role): name, address, email, phone, order reference, parcel and payment status of a merchant's customers, processed only to provide the Services the merchant requested.

We process personal data only for specific, legitimate purposes:

• •To provide and operate our payment services, including QR code generation, payment processing, delivery coordination and real-time transaction tracking.
• •To verify your identity, authenticate your account and maintain the security of our platform through fraud detection and prevention measures.
• •To communicate with you about your account, transactions, service updates and respond to your support requests.
• •To process settlements, generate invoices and manage billing in accordance with your merchant agreement.
• •To improve our platform's performance, develop new features and analyse usage patterns to enhance the user experience.
• •To comply with legal obligations including tax reporting, anti-money laundering regulations and financial record-keeping requirements under Dutch and EU law.

Under the GDPR, we process personal data based on the following legal grounds:

• •Contract performance — processing necessary to provide our Services to merchants, carriers and customers, including account management and payment processing.
• •Legitimate interests — processing necessary for fraud prevention, platform security, service improvement and business analytics, where these interests are not overridden by your rights.
• •Legal obligations — processing required to comply with Dutch tax law, financial regulations, anti-money laundering legislation and other mandatory legal requirements.
• •Consent — where we rely on your explicit consent, for example for marketing communications or optional analytics cookies. You may withdraw consent at any time.
• •Processor instructions: where QrX acts as processor, we process consignee data on the merchant's documented instructions and on the legal bases that merchant determines as controller.

We share personal data only when necessary for the purposes described in this policy. Recipients include:

• •Payment service providers: Mollie, Stripe and MultiSafepay process payments. Each PSP acts as an independent controller or as a processor, depending on the payment flow and its own terms.
• •Delivery partners — carriers such as UPS, GLS and Peddler receive delivery and payment data necessary to coordinate QrX On Delivery operations.
• •Cloud infrastructure: we host the Services on Google Cloud (including Cloud Run) in the European Economic Area, with related Google services needed to run the platform.
• •Communication providers: Bird (SMS and WhatsApp), SendGrid (email) and Firebase (push notifications) process contact data to deliver transactional messages.
• •Analytics and monitoring — Sentry for error tracking and Intercom for customer support, both bound by data processing agreements.
• •Public authorities: we disclose data when required by Dutch or EU law, a binding court order, or a competent supervisory authority.

We never sell your personal data to third parties. All processors and partners are contractually bound to process data securely and in compliance with applicable law.

When QrX acts as processor, we use the following categories of sub-processors. A current list is also in the Data Processing Addendum. We remain responsible for their processing under Article 28 GDPR.

• •Google Cloud and Firebase: hosting, storage, application runtime and push notifications.
• •Mollie, Stripe and MultiSafepay: payment collection and settlement.
• •Bird (MessageBird): SMS, WhatsApp and related messaging used for PIN delivery and transactional notices.
• •SendGrid: transactional email delivery.
• •UPS and other carriers selected for a shipment: name, address and parcel data required to transport the order.
• •Sentry (error monitoring) and Intercom (customer support), each bound by a data processing agreement.

Under the General Data Protection Regulation, you have the following rights regarding your personal data:

• •Right of access — request a copy of the personal data we hold about you.
• •Right to rectification — request correction of inaccurate or incomplete personal data.
• •Right to erasure — request deletion of your personal data where there is no compelling reason for continued processing ("right to be forgotten").
• •Right to restriction — request that we limit the processing of your data in certain circumstances.
• •Right to data portability — receive your personal data in a structured, machine-readable format and transmit it to another controller.
• •Right to object — object to processing based on legitimate interests, including direct marketing.
• •Right to withdraw consent — where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.
• •Right to lodge a complaint: you may complain to a supervisory authority, in particular in the EU member state of your habitual residence, place of work, or of an alleged infringement.

To exercise any of these rights, contact us at privacy@qr-x.me. We will respond within 30 days. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at www.autoriteitpersoonsgegevens.nl.

For QrX B.V. the lead supervisory authority is the Dutch Autoriteit Persoonsgegevens (AP), PO Box 93374, 2509 AJ The Hague, the Netherlands, www.autoriteitpersoonsgegevens.nl.

Our platform uses cookies and similar technologies for authentication, preferences and analytics. Essential cookies are required for the platform to function. Non-essential cookies are only placed with your consent.

For full details, please read our Cookie Policy.