Privacy policy

This policy explains how QRtimer handles personal data. Questions or requests: [email protected].

1. Who is responsible

For account, organization and billing data, the operator of QRtimer is the controller. For data about participants, the organization that runs the event is the controller and QRtimer processes it on its behalf. Participants should contact that organization first; we will help it respond.

2. Data about our customers

When you sign in with Google we receive your name, email address and profile photo, never your Google password. We store your organization's details, letterhead, team members and settings, and records of your subscription and invoices. Payments are processed by PayPal; we never see card or bank details.

3. Data about participants

Organizations upload participants' names and, if they choose, email addresses, phone numbers, codes, groups and affiliations. When someone checks in we record the time, the method used and a hashed device identifier and hashed IP address to stop duplicate or fraudulent check-ins. If the organization turns on location check, the phone's position is compared with the venue and only the result (at the venue, or the distance) is kept. If it asks for a selfie, a small photo is taken only to confirm the person checking in is the registered participant; it is visible only to that organization's team and deleted automatically 30 days after it is taken. Reports downloaded by the organization may keep a copy.

4. Forms, quizzes and surveys

If an organization uses forms, we store participants' answers and, for quizzes, scores. For anonymous forms we store the answers without the participant's identity and keep only a separate record that the person has responded, so they are not asked twice.

5. Emails to participants

When an organization emails its participants through QRtimer we keep a record of each email sent and of anyone who unsubscribes, so that they are not emailed again. Replies go directly to the organization.

6. Website and cookies

We use only the cookies needed for signing in, security, remembering a check-in device, the language you browse in and a discount code you applied. Visits to public pages are counted without cookies or personal data. If Google Analytics is enabled on our public pages, Google processes usage data under its own terms.

7. Why we use data

To provide and secure the service, to prevent fraud, to take payments and keep accounting records, to send service emails, and to improve the service. The legal bases are the performance of our contract with customers, our legitimate interests in running a secure and reliable service, our legal obligations, and consent where it is required.

8. Who we share data with

Only service providers that help us run QRtimer, such as hosting, email delivery, PayPal and Google sign-in, under contracts that protect the data. We do not sell personal data. We disclose data if the law requires it.

9. International transfers

Our providers may process data in other countries. Where required we rely on appropriate safeguards such as standard contractual clauses.

10. How long we keep data

Account and event data are kept while the account is active and for a limited time after it is closed so that it can be exported. Invoices are kept as long as accounting law requires. Selfie photos are deleted after 30 days. Organizations can delete participants, forms and events at any time.

11. Security

Data is sent over encrypted connections, access is limited by role, sensitive identifiers are hashed, and photos are kept outside the public web folder.

12. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your data, to object to or restrict its use and to complain to a data protection authority. Customers can use these rights by contacting us. Participants should contact the organization that registered them; we will support it.

13. Children

QRtimer is intended for organizations, not for children to use directly. Organizations that register children are responsible for obtaining any consent required from a parent or guardian.

14. Changes

We may update this policy and will publish changes here, telling account owners about significant ones.