Account information: name, email address, phone number, company name, business registration details and login credentials when you create a QrX account.

Transaction data: payment amounts, payment status, order references, delivery addresses, QR code scan events and payment confirmations processed through our platform.

Financial information: bank account details (IBAN), billing addresses, invoicing data and payment settlement information necessary to process transactions.

Technical data: IP address, browser type, device identifiers, operating system, screen resolution and usage analytics collected automatically when you access our Services.

Communication data: messages, support requests, feedback and correspondence exchanged with our team.

Delivery data: carrier information, tracking numbers, delivery status updates and proof-of-delivery records related to QrX On Delivery flows.

Merchant consignee data (processor role): name, address, email, phone, order reference, parcel and payment status of a merchant's customers, processed only to provide the Services the merchant requested.

To provide and operate our payment services, including QR code generation, payment processing, delivery coordination and real-time transaction tracking.

To verify your identity, authenticate your account and maintain the security of our platform through fraud detection and prevention measures.

To communicate with you about your account, transactions and service updates, and to respond to your support requests.

To process settlements, generate invoices and manage billing in accordance with your merchant agreement.

To improve our platform's performance, develop new features and analyse usage patterns to enhance the user experience.

To comply with legal obligations including tax reporting, anti-money laundering regulations and financial record-keeping requirements under Dutch and EU law.

Contract performance: processing necessary to provide our Services to merchants, carriers and customers, including account management and payment processing.

Legitimate interests: processing necessary for fraud prevention, platform security, service improvement and business analytics, where these interests are not overridden by your rights.

Legal obligations: processing required to comply with Dutch tax law, financial regulations, anti-money laundering legislation and other mandatory legal requirements.

Consent: where we rely on your explicit consent, for example for marketing communications or optional analytics cookies. You may withdraw consent at any time.

Processor instructions: where QrX acts as processor, we process consignee data on the merchant's documented instructions and on the legal bases that merchant determines as controller.

Payment service providers: Stripe, Mollie and MultiSafePay process payments. Each payment service provider acts as an independent controller or as a processor, depending on the payment flow and its own terms.

Delivery partners: carriers such as UPS, GLS and Peddler receive delivery and payment data necessary to coordinate QrX On Delivery operations.

Cloud infrastructure: we host the Services on Google Cloud (including Cloud Run) in the European Economic Area, with related Google services needed to run the platform. Cloudflare provides infrastructure, content delivery and file storage.

Communication providers: Bird (SMS and WhatsApp), SendGrid (email) and Firebase (push notifications) process contact data to deliver transactional messages.

Analytics and monitoring: Sentry for error tracking, Microsoft Clarity for website and consumer payment page analytics and session insights, and Intercom for customer support, each bound by a data processing agreement.

Public authorities: we disclose data when required by Dutch or EU law, a binding court order, or a competent supervisory authority.

Google Cloud and Firebase: hosting, storage, application runtime and push notifications.

Cloudflare: infrastructure, content delivery and file storage.

Stripe, Mollie and MultiSafePay: payment collection and settlement.

Bird (MessageBird): SMS, WhatsApp and related messaging used for PIN delivery and transactional notices.

SendGrid: transactional email delivery.

UPS and other carriers selected for a shipment: name, address and parcel data required to transport the order.

Sentry (error monitoring), Microsoft Clarity (website and consumer payment page analytics and session insights) and Intercom (customer support): each bound by a data processing agreement.

Operational data and exclusively owned files: deleted without undue delay during confirmed customer deletion once no longer needed, with no additional standard waiting period. An open obligation preserves only necessary evidence, not the entire account.

Necessary QrX fiscal records: 7 years from the applicable statutory starting point; 10 years only for an applicable longer category, such as OSS/IOSS or property records. For Dutch fiscal administration, the period starts when the data loses its current relevance. Closing an account does not restart it. This does not apply automatically to every transaction detail or file.

Ordinary email and technical logs: at most 30 days from original registration. Reliably attributable unnecessary customer logs are deleted earlier during customer deletion. Later events do not restart the original message's period.

Necessary security and access logs: at most 90 days from the event. Minimal deletion accountability records are kept at most 24 months after completion, limited to necessary references, actor, policy version, counts and outcomes, without a copy of deleted content.

Restricted disaster-recovery backups: at most 190 days from archive creation, with earlier targeted erasure where safely possible. Before restored data is made available, prior deletions are reapplied using the current independent deletion register.

Invoices, settlement documents and necessary evidence: follow the underlying record's period. Other correspondence and files are classified by purpose; no indefinite retention follows from this schedule.

Right of access: request a copy of the personal data we hold about you.

Right to rectification: request correction of inaccurate or incomplete personal data.

Right to erasure: request deletion of your personal data where there is no compelling reason for continued processing ("right to be forgotten").

Right to restriction: request that we limit the processing of your data in certain circumstances.

Right to data portability: receive your personal data in a structured, machine-readable format and transmit it to another controller.

Right to object: object to processing based on legitimate interests, including direct marketing.

Right to withdraw consent: where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.

Right to lodge a complaint: you may complain to a supervisory authority, in particular in the EU member state of your habitual residence, place of work, or of an alleged infringement.