Answers to the questions merchants, partners and security reviewers most often ask when evaluating QrX. For how QrX protects data day to day, see "Security and Data Protection".

No. QrX B.V. is not a bank, electronic money institution or licensed payment service provider. Consumer payments are collected by licensed payment providers (currently Stripe, Mollie and MultiSafePay). QrX provides the software, the QR payment flow and the merchant tools around those payments, and never holds customer funds.

No. Card numbers and payment credentials are handled by the PCI DSS compliant payment provider. QrX receives the payment result and uses it to coordinate the delivery.

QrX hosts the platform on Google Cloud in the European Economic Area. If a service provider transfers data outside the EEA, QrX uses a valid transfer mechanism such as the EU Standard Contractual Clauses.

The current list is kept in the Privacy Policy and the Data Processing Addendum.

Yes. When QrX processes the data of a merchant's customers (for shipments, Payment on Delivery, PIN delivery or returns), QrX is the processor and the merchant is the controller. The QrX Data Processing Addendum (verwerkersovereenkomst) under Article 28 GDPR is part of the QrX Terms and Conditions and applies automatically. Read it at qrx.eu/data-processing-addendum. It covers security measures, sub-processors (with 14 days to object to a new one), breach notification, audits, and deletion or return of data.

QrX notifies the affected merchant without undue delay after becoming aware of a personal data breach, in time for the merchant to meet the 72-hour notification duty under Article 33 GDPR where it applies.

PortalX sign-in uses a password plus a one-time verification code. Role-based permissions define what each team member can see and do, and account scoping keeps each merchant's data within its own account and channels. API access uses a channel API key exchanged for short-lived Bearer tokens, and webhooks are signed with HMAC-SHA256.

QrX keeps personal data only as long as needed for its purpose. Fiscal records are kept for the statutory period (7 years, or 10 years for specific categories). The Privacy Policy lists the current retention periods for operational data, logs and backups, and their implementation status.

QrX does not take decisions based solely on automated processing that have legal or similarly significant effects. Payment success or failure is decided by the licensed payment provider. Fraud and security checks may flag a transaction for review, and a person can review a flag on request.

The public status page is status.qr-x.app.

QrX Payment on Delivery pages are served on go.qr-x.app, the merchant portal on portal.qr-x.app, the API on api.qr-x.net and the website on qrx.eu. QrX never asks for your password, verification code or card number by chat, email or phone.

Yes. Contact the QrX team through qrx.eu/security or qrx.eu/book-demo to discuss your integration, access requirements and security questionnaire. Under the Data Processing Addendum, QrX can answer audit requests with up-to-date security summaries or reports.

Contact QrX support at [email protected] and say it is a security report. For privacy matters, email [email protected]. Do not include secrets or passwords in your message. Security reports are always handled by a person.