Data Processing Addendum

1.Roles and scope

For scan data, you are the controller and we are your processor. If you use KeeperQR for a client, so that you are yourself a processor, we are your subprocessor and these terms apply in the same way. Your use of the service, its settings, and these terms are your documented instructions. We will tell you if we believe an instruction breaks data protection law.

We are an independent controller, outside this addendum, for: your own account data; the narrow processing of scan requests needed to secure the service, such as bot filtering, rate limiting, and destination safety checks; and aggregated figures that identify no one. Our privacy policy covers that processing.

“Data protection law” means the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection, and US state privacy laws, to the extent each applies.

2.Details of processing

3.Your obligations

• You have a lawful basis for the scan data you collect, and you give the people who scan your codes any notice the law requires.
• You do not put personal data about scanners, or sensitive data about anyone, into destination URLs or code names.
• You respond to requests from the people who scan your codes, using the tools the service provides.

4.Our obligations

• We process scan data only on your documented instructions, including for international transfers, unless the law requires otherwise, in which case we will tell you first where the law allows.
• Everyone we authorise to process the data is bound by confidentiality.
• We maintain the security measures described below.
• We help you, as far as is reasonable and taking into account the nature of the processing, respond to data subject requests and carry out impact assessments and prior consultations with regulators.
• We notify you of a personal data breach affecting scan data without undue delay, and in any case within 72 hours of becoming aware of it. We will give you the information you need to meet your own obligations, as it becomes available.
• We delete scan data as described under Deletion.
• We make available the information needed to demonstrate compliance with Article 28, as described under Audits.

5.Subprocessors

You give general authorisation for us to use subprocessors. The current list, with what each one receives, is on the subprocessors page.

We will email you at least 30 days before adding or replacing a subprocessor, except where urgent replacement is needed for security or continuity, in which case we will tell you as soon as we can. You may object on reasonable data protection grounds within that period. If we cannot resolve the objection, you may end your subscription, and we will refund the unused portion of any prepaid subscription term.

Each subprocessor is bound by data protection obligations that are substantially as protective as these, and we remain responsible to you for its performance.

6.Security

• Encryption in transit with TLS, and encryption at rest by our database and hosting providers.
• IP addresses are hashed with a keyed function and masked before scan records are stored, and the hash is erased after 13 months.
• Every query is scoped to a workspace, so one customer’s data is separated from another’s.
• Accounts have no passwords: sign-in is by Google, a passkey, or a one-time emailed code stored only as a SHA-256 hash. Two-factor backup codes and QR code passwords are hashed with bcrypt. Two-factor secrets are encrypted with AES-256-GCM. Passkeys and two-factor authentication are available on every account.
• Access to production systems is limited to the people who run the service, using individual accounts.
• Automated bot filtering, rate limiting, and daily destination safety checks for awake codes; sleeping codes are checked when scanned.

7.International transfers

We are established in the United States and process scan data there, and scan requests are handled at our hosting provider’s edge location nearest the scanner. Where scan data is transferred to us from the EEA, the UK, or Switzerland, and no adequacy decision covers the transfer, the European Commission’s standard contractual clauses (Decision 2021/914) are incorporated into this addendum by reference, with you as data exporter and us as data importer:

• Module Two (controller to processor) applies where you are a controller, and Module Three (processor to processor) where you are a processor.
• In Clause 7 the docking clause does not apply. In Clause 9, option 2 (general authorisation) applies, with the notice period above. In Clause 11, the optional language does not apply.
• In Clause 13, the supervisory authority is the one that is competent for you. In Clauses 17 and 18, the law and courts of Ireland apply.
• Annex I is completed by the Details of processing section above, and Annex II by the Security section.
• For UK transfers, the UK International Data Transfer Addendum applies, with the tables completed by this section. For Swiss transfers, references to the GDPR mean the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner is a competent authority.

If the clauses conflict with this addendum or the terms, the clauses win.

8.US state privacy laws

Where US state privacy laws apply, we act as your service provider or processor. We will not sell or share scan data, retain, use, or disclose it for any purpose other than providing the service to you, or combine it with personal data from other sources except as those laws allow. We will tell you if we can no longer meet these obligations.

9.Data subject requests

If someone who scanned your code contacts us directly, we will not answer the request ourselves. We will pass it to you where we can identify you, and tell the person to contact you.

The service gives you the tools to respond: workspace owners can export retained scan records and condensed daily totals from Settings → Danger Zone on any plan. Pro also provides CSV export from Analytics. You can delete a code together with its scan history, or clear your workspace’s scan history.

10.Audits

We will answer reasonable written questions about our processing, and give you the security reports and certifications our infrastructure providers publish. If that is not enough to demonstrate compliance, or a regulator requires it, you may have an independent auditor, bound by confidentiality, audit our compliance with this addendum. Audits are limited to once every 12 months, need 30 days’ notice, are at your cost, and cover our own systems rather than our subprocessors’ facilities, which are covered by their reports.

11.Deletion

You can delete scan data at any time by deleting a code, clearing scan history, or deleting your account, and deletion from our database is immediate. Copies in our database provider’s backups expire on its rolling schedule. Separate 30-day encrypted recovery snapshots contain account and code data, but do not include scan history. When a Free code sleeps after six months without scans, its existing individual scan records are replaced with daily totals; Pro history is not condensed.

Cancelling a plan does not end processing, because your codes keep working and keep recording scans. If you want processing to stop, delete the codes or your account, after exporting anything you want to keep. If the service shuts down, we will delete scan data after the export period described in the terms.

12.Liability and contact

Each party’s liability under this addendum is subject to the limitation of liability in the terms, except where data protection law does not allow that.

Data protection questions, and requests for a countersigned copy of this addendum: support@keeperqr.com.