Data processing agreement

1.Parties and roles

This Data processing agreement (DPA) is between the Customer that uses QRiva (the Controller) and RH COMMODITIES SRL, a Romanian company with registration code (CUI) 25651780 (QRiva, the Processor). It applies when QRiva processes personal data on the Customer's behalf through the service (Customer Personal Data). Terms such as personal data, processing, controller, processor, data subject and personal data breach have the meaning given in Regulation (EU) 2016/679 (GDPR).

Where the Customer itself acts as a processor for a third party, the Customer warrants that its own controller has authorised QRiva as a sub-processor on these terms, and QRiva acts only on the Customer's instructions.

This DPA prevails over the Terms of service on matters of personal data protection. In everything else, including liability, the Terms of service apply.

2.Details of the processing

• Subject matter and duration: providing QRiva to the Customer, for the duration of the Agreement and until deletion as described in section 10.
• Nature and purpose: hosting, storing, organising, transmitting, displaying, analysing and deleting data so that the Customer can publish codes, links, pages, cards, forms and product passports, measure scans and visits, collect and manage leads and form answers, take payments through its own Stripe account, and run its automations and integrations.
• Data subjects: Visitors who scan or open the Customer's codes and pages; people who fill in the Customer's forms, book, pay or share their details; the Customer's leads and contacts; people named on the Customer's cards and pages; the Customer's Members.
• Categories of data: scan and visit events (time, approximate location, device, browser, language, referrer, a rotating pseudonymous visitor identifier where allowed; no IP addresses); contact details; form answers and uploaded files; signatures; booking details; payment status; notes, tags and history the Customer adds to leads; any other data the Customer chooses to collect.
• Special categories: only if the Customer chooses to collect them, under its own responsibility, as allowed by the Acceptable use policy.

3.Customer's obligations

The Customer determines the purposes and means of the processing and is responsible for its lawfulness. In particular, the Customer is responsible for: having a lawful basis for every processing it carries out through QRiva; giving data subjects the information required by Articles 13 and 14 GDPR; obtaining any consent required, including consent for analytics or advertising tags under the ePrivacy rules; choosing retention periods and privacy settings suitable for its purposes; the accuracy of the data; and answering data subjects' requests.

The Customer's use of the service, its settings and its written requests are its complete instructions to QRiva. Additional instructions must be agreed in writing and may be charged. If QRiva considers that an instruction infringes data protection law, it will tell the Customer and may refuse to carry it out.

4.QRiva's obligations

QRiva will:

• process Customer Personal Data only on the Customer's documented instructions, including for transfers outside the European Economic Area, unless the law requires otherwise, in which case QRiva tells the Customer first unless the law forbids it;
• ensure that people authorised to process Customer Personal Data are bound by confidentiality;
• implement the technical and organisational measures described in section 6;
• respect the conditions for engaging sub-processors in section 7;
• taking into account the nature of the processing, assist the Customer, through the features of the service, in responding to data subjects' requests;
• assist the Customer, taking into account the information available to QRiva, with its obligations on security, breach notification, data protection impact assessments and prior consultation (Articles 32 to 36 GDPR);
• delete Customer Personal Data at the end of the service as described in section 10;
• make available the information necessary to demonstrate compliance with Article 28 GDPR and allow audits as described in section 9.

Assistance that goes beyond the features of the service, or that is required because of the Customer's own acts, may be charged at our usual rates.

5.Data subject requests

The Customer can access, correct, export and delete Customer Personal Data through the service. If QRiva receives a request from a data subject about Customer Personal Data, it will refer the data subject to the Customer, or pass the request to the Customer where the Customer can be identified, and will not answer it itself unless the Customer instructs it to.

6.Security measures

QRiva implements the following measures, which it may update as long as the overall level of protection is not reduced:

• encryption of data in transit with TLS and of stored data at rest by the database and storage provider;
• isolation of each workspace in the database by row-level security policies, covered by automated tests;
• role-based access for Members, sign-in by e-mail link, one-time code or passkey, and no passwords stored by QRiva;
• no storage of visitors' IP addresses; pseudonymous visitor identifiers that rotate monthly; a strict privacy mode that keeps the country only, with no region, city or visitor identifier;
• access by QRiva staff restricted to authorised people with defined roles, with their actions logged; viewing a workspace as its members see it is limited in time, read-only and notified to the owners;
• rate limiting and abuse protection on public endpoints, and scrubbing of e-mail addresses, phone numbers and tokens from error logs;
• hosting and storage in the European Union, with established infrastructure providers.

7.Sub-processors

The Customer gives QRiva general authorisation to engage sub-processors. The current list is published on the Subprocessors page. QRiva imposes on each sub-processor, by written contract, data protection obligations no less protective than those in this DPA, and remains responsible to the Customer for its sub-processors as required by Article 28(4) GDPR.

QRiva informs the Customer of an intended new sub-processor by updating the Subprocessors page before the new sub-processor starts processing Customer Personal Data. The Customer may object on reasonable data protection grounds by writing to support@qr-iva.com within 14 days. QRiva will then try in good faith to address the objection. If it cannot, the Customer's only remedy is to stop using the affected feature or to end the Agreement, without a refund of fees already paid, except as stated in the Refunds and cancellation policy.

8.International transfers

Customer Personal Data is stored in the European Union. Where a sub-processor processes it outside the European Economic Area, QRiva ensures that the transfer is covered by an adequacy decision of the European Commission, including the EU-U.S. Data Privacy Framework for certified companies, or by the European Commission's standard contractual clauses concluded with that sub-processor, with supplementary measures where needed.

9.Information and audits

QRiva makes available, on request, the information reasonably necessary to demonstrate compliance with this DPA, including this document, the security page, the list of sub-processors and, where available, its providers' certifications and reports.

If that information is not sufficient, or a supervisory authority requires it, the Customer may carry out an audit, no more than once in any 12 months, with at least 30 days' written notice, during business hours, without disrupting the service or giving access to other customers' data, through an independent auditor bound by confidentiality who is not a competitor of QRiva. The Customer bears the costs of the audit and pays for QRiva's time at its usual rates.

10.Return and deletion

During the Agreement the Customer can export Customer Personal Data at any time through the service. Data the Customer deletes, or that reaches the retention period the Customer chose, is deleted from the live systems.

When a workspace is deleted, its Customer Personal Data and stored files are deleted from the live systems at once. When a paid plan ends, the items beyond the Free plan are deleted after the wind-down described in the Terms of service; the scan history of those items stays with the workspace, under the retention period the Customer chose, until the workspace is deleted. Where backups exist, deleted data disappears from them when they are overwritten in the provider's normal cycle. QRiva may keep data that the law requires it to keep, protected and used only for that purpose. The Customer is responsible for exporting the data it wants to keep before deletion.

11.Personal data breaches

QRiva notifies the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, by e-mail to the workspace's owners. The notice describes, as far as the information is available, the nature of the breach, the categories and approximate number of people and records concerned, the likely consequences and the measures taken or proposed. Information that is not available at first is provided as it becomes available.

QRiva takes reasonable steps to contain the breach and limit its effects. Notifying the supervisory authority and data subjects is the Customer's responsibility as controller. A notice from QRiva is not an admission of fault or liability.

12.Liability

Each party's liability under or in connection with this DPA is subject to the exclusions and limitations of liability in the Terms of service, which apply to this DPA as if set out in it, to the extent the law allows. This does not limit either party's liability to data subjects under Article 82 GDPR. The Customer indemnifies QRiva as set out in the Terms of service for claims and fines resulting from the Customer's processing.

13.Duration

This DPA applies for as long as QRiva processes Customer Personal Data, and its obligations on confidentiality, deletion and liability continue after the Agreement ends for as long as needed.