Which QR code provider is GDPR compliant?

Our answer: There is no GDPR seal for QR code providers, as the GDPR does not recognize such a seal. However, you can check whether a provider answers the six questions below openly. Same-QR answers them in its privacy policy, even where the answer is not just "EU".

Question 1: Does the scan set cookies?

No one has consented to a privacy policy when scanning. Therefore, cookies on the scan page usually require consent, and a banner before the menu is annoying. Ask whether the scan page and hosted pages set cookies.

Question 2: Are third parties loaded?

Fonts, analytics tools, or ad networks from third parties receive your guest's IP address. A look in the browser's developer tools shows which addresses a page reloads.

Question 3: Where are the data stored, and who can see them?

Three levels are important: the operator's location, the data center locations, and the list of service providers. Almost every web service uses US-based service providers. What matters is that they are named and there are legal bases for the transfer.

Question 4: Is there a data processing agreement?

If your codes process personal data, such as from a contact form, you need a data processing agreement. A reputable provider provides it without being asked.

Question 5: What is stored, and for how long?

A provider should be able to say what a scan logs and when it is deleted. "We only store what is absolutely necessary" is not an answer.

Question 6: Can I delete everything?

Codes, pages, account. Also ask whether the short address of a deleted code is reassigned. Otherwise, a stranger could end up behind your old stickers.

What you must handle yourself

If your code leads to your own website, your privacy policy applies there. If you use UTM parameters and an analytics tool, you need the appropriate consent there. On a page with a contact form, you state what you use the data for.

The answers from Same-QR

• scan pages and hosted pages without cookies, nothing loaded from third parties
• Operator ARAVILO in Innsbruck, application and database in EU data centers, where the service provider allows it, some service providers from the USA, all mentioned in the privacy policy
• Data processing agreement at sameqr.com/avv
• Short addresses of deleted codes are never reassigned

Conclusion

Do not ask "GDPR compliant?", but ask about cookies, third parties, storage location, contract, retention period, and deletion. Whoever answers all six in writing is a good candidate.

Frequently asked questions