Data processing agreement (DPA) template

1. Parties

• Controller ("Customer"): Company name, Address, Contact person and email
• Processor ("QRVesta"): QRVesta, info@qrvesta.com

2. Subject matter and duration

QRVesta processes personal data on the Customer's behalf while providing the dynamic QR code management service (terms of use). This agreement applies for as long as the Service is provided and until the data has been deleted afterwards.

3. Nature of the processing

• Purpose: creating and storing QR codes, redirecting to their destination or showing their content when scanned, scan statistics, user and permission management.
• Data subjects: the Customer's panel users; people whose details the Customer puts into QR content (e.g. business card holders); people who scan the Customer's codes.
• Types of data: username and display name; optional notification email address; QR content (e.g. name, phone number, email, address, links, Wi-Fi passwords); scan records (time, country, device type, operating system; no IP address); activity log (including the shortened IP address and country of sign-in events).
• Special categories of data: not intended to be processed; the Customer does not enter such data in QR content.
• Retention: the periods in the privacy policy.

4. Instructions and confidentiality

QRVesta processes personal data only on the Customer's documented instructions (this agreement, the terms of use and the Customer's actions in the panel). The operator exports a workspace's data only at the Customer's request or when the Service ends. It informs the Customer if it considers an instruction unlawful. Persons with access to the data are bound by confidentiality.

5. Security measures

QRVesta applies at least the following technical and organisational measures:

• HTTPS only; passwords stored as salted PBKDF2 hashes; limits on password guessing;
• session cookies that scripts cannot read and that are not sent cross-site; session time-outs;
• role- and project-based access control; an activity log of important actions;
• a strict content security policy; no scripts loaded from elsewhere;
• no IP addresses in scan records and shortened IP addresses in the activity log (data minimisation); Wi-Fi passwords shown only to roles that may edit codes; bot protection on the panel sign-in;
• daily automatic deletion of data whose period has expired; nightly backups encrypted with AES-256 under a key only the operator holds, only the newest 14 kept, in Cloudflare R2 (EU jurisdiction); production access limited to the operator.

6. Sub-processors

The Customer gives general authorisation for the providers listed on the sub-processors page. QRVesta announces a new sub-processor at least 30 days in advance, to the email address the Customer gives in this agreement; the Customer may object on reasonable grounds and, if the objection cannot be resolved, terminate the Service. QRVesta imposes obligations on its sub-processors equivalent to those in this agreement.

7. International transfers

Data is held on Cloudflare's infrastructure, the database with a Western Europe location hint, and may be processed outside the EEA and Turkey. Transfers rely on the safeguards of Chapter V GDPR and Art. 9 KVKK (standard contractual clauses).

8. Assistance and breach notification

QRVesta reasonably assists with answering data subject requests, impact assessments and correspondence with supervisory authorities, and forwards requests it receives to the Customer. It informs the Customer, at the email address given in this agreement, without undue delay after becoming aware of a personal data breach, describing its nature, the data affected and the measures taken.

9. Information and audits

QRVesta provides the information needed to demonstrate compliance with this agreement. The Customer may carry out or commission an audit with reasonable prior notice, at its own cost and at most once a year (additionally after a breach).

10. End of the agreement

When the Service ends, QRVesta returns the data by exporting it, at the Customer's choice, and deletes it within 30 days, except where the law requires it to be kept. Copies in the encrypted nightly backups are deleted as the newest 14 backups are replaced, within 14 days; Cloudflare D1 point-in-time recovery copies expire on their own within 7 days at most.

11. Signatures