1. Data controller
For MYQRAD account and service data, the controller is Assist Control S.R.L., Bucharest, Romania.
2. Scope
This Privacy Policy applies to MYQRAD websites, customer accounts, dynamic QR campaign tools and related services where this policy is presented or linked.
A customer may also use MYQRAD to publish its own campaign content or collect information from scanners. In those situations the customer may act as a separate controller for the data it chooses to collect, and its own privacy information may also apply.
3. Personal data we may process
The data processed depends on how MYQRAD is used. It may include:
- Account data: customer ID, name, email address, account role, status and verification information.
- Authentication and security data: information needed to operate login, email verification, password reset, sessions, abuse prevention and account security.
- Campaign data: QR campaign configuration, destination content, uploaded material and settings supplied by the customer.
- Usage and analytics data: campaign activity and technical information used to provide analytics, which may include dates, browser or device information and approximate location where the relevant feature is enabled.
- Feature-specific data: information processed through enabled features such as appointments, leads or forms.
- Billing data: subscription and transaction information where paid services are used. Payment providers may process additional payment information under their own terms and privacy notices.
- Technical data: IP-related security information, server logs, error information and other technical records reasonably required to operate and protect the service.
- Customer-support data: account verification details and the content of messages submitted through the protected Customer Contact flow.
4. Why we process personal data
Depending on the data and context, we process personal data to:
- create, verify and administer customer accounts;
- provide, maintain and secure MYQRAD features;
- publish and operate customer-configured QR campaigns;
- provide analytics and other requested campaign functionality;
- process subscriptions and billing where applicable;
- respond to verified customer requests and resolve service issues;
- detect abuse, fraud, security incidents and prohibited activity;
- comply with legal obligations and establish, exercise or defend legal claims.
Under the GDPR, the relevant legal basis may include performance of a contract, compliance with a legal obligation, legitimate interests in operating and protecting the service, and consent where consent is legally required.
5. Data in customer campaigns
Customers decide what content and optional data-collection features they enable in their own campaigns. Customers are responsible for ensuring that their collection and use of scanner or end-user data has an appropriate legal basis and that required notices or consents are provided.
MYQRAD processes such data only as needed to provide the enabled functionality, subject to the service configuration and applicable law.
6. Cookies, sessions and local storage
MYQRAD uses technical mechanisms needed to operate the service, including sessions for authenticated application functions. The public site may use browser local storage for interface preferences such as the selected light or dark theme.
If non-essential analytics, advertising or tracking technologies are introduced, their use will be addressed through the appropriate notice or consent mechanism where required.
7. Service providers and other recipients
Personal data may be made available to service providers that are reasonably necessary to host, secure, operate or deliver MYQRAD, including infrastructure, email and payment providers where those services are used.
We may also disclose information where required by law, a binding legal process, or where reasonably necessary to protect rights, security, customers or the public. MYQRAD does not publish customer account information through the protected support-verification process.
8. International data transfers
Some service providers may process data outside Romania or the European Economic Area. Where European data-protection law requires safeguards for an international transfer, the appropriate legal transfer mechanism must be used.
9. Retention
Personal data is retained only for as long as reasonably necessary for the purpose for which it was collected, including account operation, security, dispute handling and legal or accounting obligations. Retention periods may differ by data category and enabled feature.
When data is no longer required, it is deleted, anonymised or otherwise handled in accordance with the applicable retention requirement.
10. Security
We use reasonable technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure or loss. No internet-connected system can provide an absolute guarantee of security.
Customers are responsible for protecting their own login credentials and for promptly reporting suspected unauthorised account access.
11. Your data-protection rights
Where the GDPR applies, you may have rights including access, rectification, erasure, restriction of processing, data portability, objection to certain processing, and withdrawal of consent where processing is based on consent. You may also have the right to lodge a complaint with the competent data-protection supervisory authority.
Verified MYQRAD customers can use the protected Customer Contact page for account-related privacy requests. The separate privacy-responsible details block above is intentionally disabled until the operator completes and publishes the relevant company details.
12. Minors
MYQRAD customer accounts are intended for persons aged 18 or older. We do not knowingly invite persons under 18 to create customer accounts.
13. Changes to this Privacy Policy
We may update this policy to reflect changes in MYQRAD, legal requirements or our processing practices. The current version is published on this page with its update date. Where required, additional notice will be provided for material changes.