Privacy Policy

1. Controller

The controller within the meaning of Art. 4(7) GDPR is:

SEE Service Group, Inhaber Sascha Ernst Franklinstr. 18, 58089 Hagen Germany Email: contact@viveqode.com Phone: +49 2331 6957172

2. Data protection officer

No data protection officer has been appointed because the requirements of Art. 37 GDPR and § 38 BDSG are not met. Please send privacy requests to contact@viveqode.com.

3. Hosting and visiting the website

The website, app interface and database run on a dedicated server of netcup GmbH (Karlsruhe) in a data centre in Nuremberg, Germany. A data processing agreement under Art. 28 GDPR is in place with netcup.

When you visit, the server necessarily processes your IP address, date and time, the requested address and browser and system details in order to deliver the page. Our web server does not write access logs. To prevent abuse we briefly count requests per IP address in memory (rate limiting); these counters are not stored permanently and expire after 24 hours at the latest. Technical error messages of the application contain no IP addresses and are discarded with the next update of the application at the latest.

Fonts are served from our own server; no connection is made to Google Fonts or other font providers when you load a page. We use no analytics, advertising or social media trackers.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a secure, working website) or Art. 6(1)(b) where you use a contract with us.

4. Cookies and local storage

We use only strictly necessary cookies (sign-in, protection against form abuse, language setting) and store the shopping cart locally in your browser. Under § 25(2)(2) TDDDG no consent is required. The full list is on the Cookies page.

Go to the cookie overview

5. Customer account

• Data processed: email address, username, password (bcrypt hash only), optionally salutation, first and last name, address, profile details; with two-factor sign-in enabled, the encrypted TOTP secret and one-time backup codes (hash only).
• On registration we send a confirmation link to your email address (double opt-in). Unconfirmed accounts cannot sign in.
• Team feature: if an account invites team members, we process their email address and role to enable shared access.
• For the iOS app the device receives sign-in tokens; their checksum and the app's device identifier (user agent) are stored so you can sign out on individual devices.
• Legal basis: Art. 6(1)(b) GDPR (contract).

6. QR codes, content and public pages

• We store the content you place behind your codes (text, links, images, logos, business card details, schedules, QR design) and publish it when the code is scanned. Only publish data that is meant to be public; for third-party data you need their consent.
• Public pages are blocked from search engines by default (noindex). On paid plans you can allow search engine listing per page; only then do we add the page to our sitemap.
• A web business card offers visitors a vCard download containing the contact details you entered.
• Legal basis: Art. 6(1)(b) GDPR.

7. Scans and analytics

Anyone who scans a ViveQode code or clicks a link on a ViveQode page is redirected via our server. If the code belongs to an account with analytics (Creator and up) or to one of ViveQode's own campaigns, we store per event:

• time, code and type of event (scan, click, vCard download)
• a pseudonymous identifier: checksum (SHA-256) of the previously truncated IP address and the browser identifier; the IP address itself is not stored
• country and region, derived from the truncated IP address using a local database on our server (not shared)
• device class (smartphone, tablet, desktop) and, if transmitted, only the domain name of the referring page

For codes on the Free plan we store no scan events. No cookies are set when scanning. The legal basis is Art. 6(1)(f) GDPR (our customers' and our interest in audience measurement without identifying individuals). Where we process scan data for customers we act as their processor; business customers can request an agreement under Art. 28 GDPR. Customers using scan analytics inform their visitors about it themselves.

8. External links and YouTube

Links on public pages lead to the destination only after confirmation. The operators of linked pages are responsible for their content and privacy.

Embedded YouTube videos load only when you click them, and then via the privacy-enhanced mode (youtube-nocookie.com) of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Only with that click are your IP address and device details sent to Google; a transfer to the USA is possible (EU-US Data Privacy Framework). The legal basis is your consent given by the click, Art. 6(1)(a) GDPR.

9. Bot protection (ALTCHA)

We protect registration, sign-in, the inquiry form and the report form with ALTCHA. Your browser solves a small computing task set and checked by our own server. No cookies are set and no data is sent to third parties. The legal basis is Art. 6(1)(f) GDPR (protection against automated abuse).

10. Shop, subscriptions and payment (Stripe)

• For payment we redirect you to Stripe (Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland). Stripe processes your payment data itself; we do not receive card or bank details. Stripe also issues the invoices. A transfer to Stripe, Inc. in the USA is possible (EU-US Data Privacy Framework, standard contractual clauses).
• We store the order, billing address, shipping address where applicable, subscription status, the Stripe customer number and the time you accepted the terms and the withdrawal notice.
• Physical items (printed or embroidered apparel) are produced, depending on the product, by Shirtigo GmbH (Cologne, print-on-demand with shipping directly to you) or by the textile printer Backyard Prints (Germany). For this we transmit your name, shipping address and order contents including the print motif with your QR code. Both process the data as our processors under Art. 28 GDPR. The respective carrier receives your name and shipping address for delivery.
• Legal bases: Art. 6(1)(b) GDPR (contract) and (c) (retention under commercial and tax law).

11. Emails, contact and inquiries

• System emails (confirmation, password reset, order and account notices) are sent via our email server at netcup GmbH. We do not send marketing newsletters.
• If you write to us or use the Customization inquiry, we process your details (name, email, company, requirements, message) to reply. Legal basis: Art. 6(1)(b) GDPR (pre-contractual steps) or (f).
• Reporting content: through the report form we store the reason, your optional message and the page concerned in order to review the report (Art. 6(1)(c) and (f) GDPR, Art. 16 Digital Services Act).

12. iOS app

• App Store: downloads and updates are handled by Apple (Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland), which is responsible for this itself. There are no purchases in the app.
• Camera and photos: scanning and reading QR codes from photos happen on the device. Images are not uploaded.
• Without an account: the scanner, link check and quick QR work without signing in; we store nothing about you in that case.
• Scan history: stored on the device and can be turned off in settings. Only if you enable cloud sync (off by default) do we store the entries in your account; turning it off deletes the cloud copy.
• Location (optional): if you allow access, the app notes the approximate location of a scan in the history on the device.
• Usage statistics (optional, off by default): if you enable "Send analytics", the app sends the type and source of a scan and, if location access is allowed, the coordinates to your account. We use this to improve the app and delete the data after 12 months. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw in settings at any time.
• Safe Scan (link check): the app first checks scanned links on the device. It resolves short links by requesting the address itself; the short-link provider sees your IP address. For further checks the app asks our server: for space reasons the device only holds part of Google's list of dangerous sites. So that the complete list still counts, the app sends shortened checksums (4-byte hash prefixes) to our server for every link it checks – never the address itself and never the full checksum. The server compares them with its copy of the list; whether a match really belongs to the address is decided by the app on the device. We neither store nor log these checksums; we process your IP address only briefly in memory to limit requests. You can turn this off in settings under “Use Google's complete list”. If you tap “Check more thoroughly”, the server asks the responsible domain registry via RDAP only for the domain's registration date. For confirmations our server compares shortened checksums with the Google Web Risk API (Google Ireland Limited). Google receives neither the address nor your IP address or account data, only our server's request. Legal basis: Art. 6(1)(b) and (f) GDPR (protection against fraudulent links).
• Checking redirect targets: if you set an external target address for a code (direct redirect or link list), our server compares this address with the Google Web Risk API when you save it, when the code is opened and regularly in the background, in the same way as Safe Scan, i.e. only via shortened checksums. If the target is on Google's list of dangerous sites, we reject the save or block the code and notify you by email; we record the block and the target address for review and accountability. When the app checks a ViveQode code, it requests the code's address once to find its target; this check is not counted as a scan in the statistics. Legal basis: Art. 6(1)(b) and (f) GDPR (protecting visitors from fraudulent redirects).
• Reports from Safe Scan: if you tap “Report as scam” or “Report false alarm” on the check card, we email the type of report, the domain, the app's rating and the app version to our team. The full address is only included if you explicitly choose so in that step. No account data is transmitted. We use the report only to improve warnings and delete it once it has been handled. Legal basis: Art. 6(1)(f) GDPR, and your consent for the full address (Art. 6(1)(a) GDPR).
• Sign-in data is kept in the device keychain; widget data (your own code) only in storage shared by the app and widget on the device. The app uses no push notifications, advertising IDs or tracking SDKs.

13. Recipients and transfers to third countries

Recipients are only the service providers named above: netcup GmbH (hosting, email; processor), Shirtigo GmbH and Backyard Prints (apparel production; processors), Stripe (payment), Google (Web Risk; YouTube only after a click), Apple (app distribution) and the respective carrier. We do not sell data or share it for advertising. Transfers to third countries take place only on the basis of an adequacy decision (e.g. EU-US Data Privacy Framework) or appropriate safeguards under Art. 46 GDPR (standard contractual clauses). Authorities receive data only where we are legally obliged to provide it.

14. Retention periods

• Account data and content: until you delete your account.
• Scan and click events (pseudonymous): 24 months, then deleted automatically; immediately when a code is deleted.
• Optional app usage statistics: 12 months.
• Scan history in your account (cloud sync): until you delete it or turn sync off.
• Order, invoice and payment data and records of consent: 10 years (§ 147 AO, § 257 HGB).
• Customization inquiries: 12 months after last processing; resolved content reports: 24 months.
• Security and change log (audit log): 36 months; entries about orders and payments like invoice data.
• We create backups daily and delete them after 14 days; deleted data also disappears from the backups by then at the latest.

15. Deleting your account and QR code guarantee

You can delete your account yourself in the dashboard or the app. We then remove your personal data and content. Purchased lifetime codes (code packs, apparel, web business card) remain scannable without any personal reference and show a generic ViveQode page so printed material does not lead nowhere. Data we are legally required to keep is blocked until the retention period ends.

16. Your rights

• Access (Art. 15 GDPR); you can download an export of your data yourself in the dashboard under Account.
• Rectification (Art. 16), erasure (Art. 17), restriction (Art. 18) and data portability (Art. 20).
• Withdrawal of consent with effect for the future (Art. 7(3)), e.g. by turning off "Send analytics" in the app.
• Complaint to a supervisory authority (Art. 77). The competent authority is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

17. Obligation to provide data, no automated decisions

You are not obliged to provide data. Without an email address, however, we cannot create an account, and without payment and address details we cannot process an order. No automated decisions or profiling under Art. 22 GDPR take place.

18. Data security

All connections are TLS-encrypted (with HSTS). We store passwords only as bcrypt hashes. Further measures: Content Security Policy, verification of Stripe signatures, sanitizing of uploaded content, request limiting, daily backups and two-factor sign-in for all accounts.

19. Changes

We update this policy when our processing or the law changes. We inform registered users of material changes by email.