Privacy policy

1.Who is responsible

The controller of the personal data described in this policy is RH COMMODITIES SRL, a Romanian company with registration code (CUI) 25651780 (QRiva, we). Our company details are in the Legal notice. For any question about personal data, write to support@qr-iva.com.

2.When a business is responsible instead

Businesses use QRiva to publish codes, pages, cards, forms and product passports. When you scan one of their codes, open one of their pages or fill in one of their forms, that business is the controller of your personal data and QRiva only processes it on the business's behalf, under our Data processing agreement. The business's own privacy notice applies, and the business is your point of contact for your rights. If you write to us about such data, we pass your request to the business.

To help businesses, this policy also describes below what QRiva records when someone scans or visits, but how that data is used is decided by the business.

3.Data we process as controller

Customers and their team members

• Account data: e-mail address, name if you add it, passkeys you register, sign-in method, preferences such as theme and layout, and the e-mail preferences you choose.
• Workspace and business data: business name, address, website and other details you enter, Members and their roles.
• Billing data: plan, billing name and address, VAT number, invoices and payment status. Card details are entered directly with Stripe; we never see or store card numbers.
• Sign-in and security data: the device, browser and network address of signed-in sessions, kept by our authentication provider so you can review and end sessions; records of important actions in the workspace; security and error logs. To limit abuse of public forms, reports and the safety checker, we keep a hash of the network address salted with a value that changes every day, which can't be turned back into the address and is deleted within two days.
• Support data: messages, attachments and the history of support tickets and sales enquiries.
• Acceptance records: the version of our terms you accepted, when, and by whom.

Visitors to our website

• Usage of our marketing pages: the page, the referring website and which button was clicked, counted without cookies and without identifying you, plus Vercel Web Analytics, which also sets no cookies and stores no IP addresses. If your browser sends Do Not Track, our own count is skipped.
• Whether a visit or a sign-up came from one of our ads: when you arrive by clicking a QRiva ad, we count it, and count it again if a new account follows, as a daily total per country and campaign. Nothing identifies you: no cookie, no click identifier, no address and no link to the account is kept, and the country is derived from the connection without storing the address.
• Google Analytics and Google Ads, only if you agree: if you accept them in the cookie panel on qr-iva.com, each separately, Google sets cookies and receives the pages you view, your browser and device details and your network address (processed by Google; QRiva never receives it) and, for Google Ads, which of our ads you came from and whether you signed up. Before you agree, nothing from Google loads.
• Questions to our assistant: the question you type (up to 500 characters), sent to our AI provider to produce an answer. Do not include personal data in it.
• Enquiries: your name, e-mail, company and message when you contact sales or support.
• Abuse reports: the report, a daily-salted hash of your network address to prevent repeated false reports, and, if you give it, your e-mail address, which we use to confirm receipt and tell you our decision.

4.Why we use data, and our legal bases

• To provide QRiva under our contract with the customer: accounts, workspaces, publishing, sign-in, billing, support and service e-mails (Article 6(1)(b) GDPR, and Article 6(1)(f) for Members who are not themselves the contracting party).
• To keep QRiva safe and working: screening destinations, preventing abuse and fraud, rate limiting, security logs, investigating incidents and fixing errors (our legitimate interest, Article 6(1)(f)).
• To improve QRiva: understanding how features are used, from aggregated data that does not identify anyone (legitimate interest).
• To tell customers about QRiva: tips and news about features related to the service they use, which they can turn off in every such e-mail and in their e-mail preferences (legitimate interest, and article 12(2) of Romanian Law 506/2004 for existing customers).
• To know which of our ads bring customers: anonymous daily totals of visits and new accounts that started on our ads, per country and campaign (legitimate interest; no one is identified).
• To measure our website and our advertising: with Google Analytics and Google Ads, on qr-iva.com's own pages only, and only with your consent (Article 6(1)(a) GDPR and article 4(5) of Romanian Law 506/2004). You can withdraw it at any time with Cookie settings at the bottom of our website; withdrawing does not affect what happened before.
• To meet legal obligations: keeping accounting records, answering lawful requests of authorities, and acting on reports of illegal content (Article 6(1)(c)).
• To establish, exercise or defend legal claims, including recovering unpaid amounts (legitimate interest).

We do not sell personal data. We share data with an advertising platform only for visitors to our own website who agree to it (Google Ads, above), never data about scans, a business's visitors or the content of a workspace. We do not make decisions about people with legal or similarly significant effects based only on automated processing. Automated safety screening can block a destination; the workspace is told why and can ask for a review by a person.

5.What QRiva records when someone scans or visits

On behalf of the business that published the code or page, QRiva records:

• the time, the code or page, the country and, unless the business uses strict privacy mode, the approximate region and city; the device type, operating system, browser, language and referring website. IP addresses are never stored.
• a first-party cookie and a hash of it that changes every month, used to count unique visitors, only if the visitor chooses Accept all or Limited in the cookie panel, and never in strict privacy mode;
• what visitors choose to send: form answers, uploaded files, signatures, bookings and details shared from a business card, with a record of the consent wording shown;
• payments made in forms, which are processed by Stripe for the business.

Businesses can add their own analytics or advertising tags, which load only after the visitor chooses Accept all for that business. See the Cookie policy.

6.Who receives data

We use service providers that process data on our instructions under written agreements: hosting, database and storage, e-mail delivery, payments, AI features and error monitoring. They are listed, with what each does and where, on our Subprocessors page.

If you accept them on our website, Google Ireland Limited receives data for Google Analytics, as our processor, and for Google Ads, as a separate controller for its own advertising purposes under Google's terms. Google explains how it uses this data at policies.google.com/technologies/partner-sites.

We also disclose data when the law requires it, to authorities with a lawful request, to our professional advisers under confidentiality, and to a buyer or successor if our business is sold or reorganised, under the same protections.

7.Where data is stored

QRiva's database and file storage are in the European Union, in Frankfurt, and its application servers run in the same region.

Some providers process data outside the European Economic Area, for example for payments, e-mail delivery, AI features or, if you accept them on our website, Google Analytics and Google Ads. Those transfers rely on an adequacy decision of the European Commission, including the EU-U.S. Data Privacy Framework for certified companies, or on the European Commission's standard contractual clauses.

8.How long we keep data

• Account and workspace data: while the account exists. Closing an account deletes, immediately, the account and the workspaces in which you were the only member.
• Billing and accounting records: for the period required by Romanian accounting law, currently 10 years from the end of the financial year.
• Support conversations: 24 months after the conversation is closed.
• Scan and visit events, and inactive leads: for the period each workspace chooses, after which they are deleted automatically every night; if a workspace chooses none, while the workspace exists.
• Google Analytics data about our website: at most 14 months in Google Analytics; its cookies last up to 13 months. Google Ads cookies: up to 90 days.
• Items in the trash: 30 days. Workspace export files: 7 days.
• Security, audit and error logs: as long as needed to secure the service and investigate incidents, and no longer than the workspace exists, except records of actions taken by QRiva staff, which we keep as accountability records.
• Acceptance records and records needed for legal claims: until the limitation period for claims has passed.
• Backups: where our database provider keeps backups, deleted data disappears from them when they are overwritten in its normal cycle.

9.How we protect data

Data is encrypted in transit and at rest, each workspace is isolated in the database, access follows each person's role, and access by QRiva staff is restricted to authorised people with defined roles; their actions are logged, and when staff view a workspace as its members see it, the access is time-limited and the owners are told. Our security page explains this in detail.

10.Your rights

Under the GDPR you have the right to access your personal data, to have it corrected or deleted, to restrict or object to its use, to receive it in a portable format, and to withdraw consent at any time without affecting earlier processing. You can object at any time to processing for marketing.

To use these rights, write to support@qr-iva.com. We may ask you to confirm your identity, and we reply within one month, which can be extended by two months for complex requests. Many rights can also be used directly in the app, for example by editing or exporting your data or closing your account.

You can complain to the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP, www.dataprotection.ro) or to the data protection authority of the EU country where you live or work.

11.Children

QRiva is for businesses and is not intended for anyone under 18. We do not knowingly collect children's data for our own purposes.

12.Changes to this policy

We may update this policy. The date at the top shows the latest version, and we tell customers about important changes by e-mail or in the app.