Privacy Policy — QR Suisse

This English version is a translation provided for information purposes only. In case of discrepancy between language versions, the French version is legally binding.

1. Who is responsible for your data

Skyday Sàrl, operator of the QR Suisse service, is responsible for the processing of your personal data within the meaning of the Swiss Federal Act on Data Protection (nFADP) and, where applicable, the GDPR (see §7).

• Registered office / full address: Rue de Lousse 32a, 1987 Hérémence, Switzerland (source: Commercial Register, zefix.ch, consulted on 2026-09-11)
• Company identification number (UID): CHE-347.343.213
• Contact for any question relating to your data: contact@qrsuisse.ch

For the part of payment processing that it carries out on its own behalf, Stripe is a separate controller (see §6.2). The same applies to Stripe Link (see §2.3).

For our advertising campaigns (§2.8), Google is also a controller for the part of the processing it carries out on its own behalf; for the collection of data on our website, Skyday Sàrl and Google may be regarded as joint controllers (see §6.4).

2. What data we collect, and why

QR Suisse only collects the data necessary for the operation of the service, the measurement of its audience and, if you agree, its advertising campaigns. We do not sell any data. We do not pass on to any third party, for advertising purposes, your email address, your name, or any data about your use of the dashboard.

Three processing activities on our public website depend on your consent. In the cookie banner shown on your first visit, you can accept them all or reject them all in one click, or choose category by category with "Customise". You can change this choice at any time:

• audience measurement (§2.4): aggregated statistics, which are not intended to identify you individually;
• advertising (§2.8): measuring the registrations obtained through our Google Ads advertisements;
• remarketing (§2.8): showing our advertisements to people who have visited our website, based on the pages visited.

For advertising and remarketing, Google acts as a controller. Refusing any of these categories has no consequence for your access to the website or your use of the service.

2.1 Your account data (if you hold an account)

Two ways of creating an account coexist today. The vast majority of accounts are created through self-service registration, open to the public and immediate: whether you create a private account or a business account, creation is instant, login happens automatically as soon as the account is created, and acceptance of the Terms and of this policy is recorded with its date and version (see table above). On a residual basis, certain businesses taking part in a pilot programme obtain an account through manual creation carried out by Skyday Sàrl, using the email address they provide us, without an invitation token sent by email. This residual case is distinct from inviting an additional user within an account that already exists ("Users" feature of your dashboard), which remains governed by its own rules and is not covered by this section.

If you use "Forgot your password?" on the login page to regain access to your account:

• The email address you enter is neither stored nor logged by us, whether or not it matches an account: it is used only to look up the account concerned. If the address matches an active user of an account that is neither suspended nor pending deletion, an email containing a single-use link is sent to the address registered on that account — never to any other address.
• The response displayed to you is identical whether or not the address matches an account ("If an account matches this address, you will receive an email within a few minutes"). We do not reveal whether an address is registered with us.
• To limit abuse (serial requests), we count requests per IP address and per email address using non-reversible fingerprints (salted hash), held in the server's memory only over a 60-minute window. These fingerprints are never written to a database or to disk, never linked to your account, and neither the IP address nor the email address appears in them in plain text. When the window expires they stop being taken into account and are removed from memory by an automatic purge; in any case they disappear when the server restarts.
• The link you receive is not passed on to any third party: no Google tool loads on the pages concerned (§2.4, §2.8), and the browser is instructed not to communicate the page's address to other websites.
• When you set your new password, your open sessions are closed — you must log in again with the new password — and we send you a notification email (with no link at all) so that you can react if the change was not made by you. The same applies when the link was triggered for you by an administrator of your account.

If you take part in a test on our validation environment ("staging") before a new feature goes into production, a test account is created there under the same rules — see §6.3 for details of this environment and §5 for its own, shorter retention period compared to your production account. On this environment, payment is simulated (Stripe test mode): no real banking data is ever entered there.

2.2 Usage statistics for your QR codes

For each QR code you create, we keep:

• a counter of the total number of scans (scanCount);
• a count of scans per calendar day (a single line per QR code and per day, with no other information), which feeds the trend curve on your dashboard.

Neither of these contains the slightest individual detail about the people who scan: no per-scan log, no individual timestamp, no device, no country, no browser, no IP address stored in the database. Two people who scan the same QR code on the same day are strictly indistinguishable within it.

The viewable history depth depends on your plan: the last 7 days (Free) or 15 months (Pro or Entreprise). The daily data itself is retained for 15 months for all accounts, then automatically deleted (§5) — so switching to the Pro or Entreprise plan immediately gives access to the history already built up.

Transient, non-persistent technical processing: at the moment of a scan, the IP address of the person scanning is transformed into a non-reversible fingerprint (salted hash) and kept in the server's memory for a maximum of 5 seconds, solely to avoid counting an accidental scan twice (double-tap, automatic preview by a camera app). This fingerprint is never written to a database, never associated with an identity, never visible in your statistics, and disappears permanently after the 5 seconds expire or when the server restarts. This mechanism is strictly identical on our validation environment (§6.3).

2.3 Subscription and billing (if you subscribe to the Pro or Entreprise plan)

Payment for the Pro or Entreprise subscription (monthly or annual) is entrusted to Stripe, our payment provider (§6.2). Specifically:

We do not require a name or billing address (Skyday Sàrl is not subject to VAT), and we do not store any card number or fragment, address, amount or invoice ourselves.

Stripe Link. When paying, the Stripe page may offer you the option to use Link, Stripe's one-click payment wallet: it allows your name, contact details and payment data to be saved with Stripe, for reuse afterwards with other merchants who, like us, use Stripe. We have chosen to keep this option enabled. For this specific feature, Stripe acts under its own terms, as an independent controller — not as a mere provider acting on our instructions: you and Stripe each separately determine the purposes and means of this particular processing (Link terms: stripe.com/legal/link; Link's own privacy policy: link.com/privacy). You can always enter your card manually, without ever using Link — this option always remains available on the payment page; Link is only ever offered, never required.

Subscription-related emails (receipts, invoices, failed payment) are sent to you by Stripe.

If your Pro or Entreprise subscription ends (cancellation or payment failure) while your account exceeds the Free plan quota, your account enters a grace period (14 days) and then a restricted state: your QR codes beyond the quota then show a neutral information page to the person scanning. This page never mentions the reason (unpaid invoice, cancellation): it only indicates that the QR code is no longer active and that its owner can reactivate it by switching to the Pro plan. It shows neither the QR code's destination nor any data from its contact card. If your account had one or more API keys or unused creation packs (§2.5, §2.6), these are not deleted: your API keys are frozen: they refuse authentication for as long as the account is not on the Pro or Entreprise plan, and their configuration (name, rights) is kept. On the Free plan, the "API keys" page of the dashboard does not show your keys: you cannot view, revoke, regenerate or reactivate them until you take out a Pro or Entreprise subscription again. The pack balance remains stored without being reset to zero (see §5 and §9.6 of the Terms). The configuration of your custom domain, if you have one, is also kept (§2.7).

2.4 Audience measurement of the public website

In addition to the data described above (which concerns your account and your use of the service once registered), we measure traffic on our public website (pages viewed before registration, source of the visit, registration conversion rate, drop-off point in the registration form), using Google Analytics 4 (GA4), a tool provided by Google LLC.

This processing is separate from the scan statistics for your QR codes (§2.2): it only concerns traffic on our own website, not the use of your QR codes by your customers.

At this stage, this processing only concerns visitors to the public website and the registration journey — not your use of the dashboard once logged in to your account, which is not measured by this tool.

This processing is only triggered after your explicit consent: as long as you have not accepted via the cookie banner, Google Analytics does not load on this website (no request is sent to Google) and no information about your visit is transmitted to it.

If you have accepted audience measurement without accepting the "Advertising" category, Google Analytics loads with the instruction not to place any advertising cookie, not to transmit any data to Google Ads and not to use your visits for personalised advertising. If you have also accepted "Advertising", the "registration completed" event is used to measure our Google Ads campaigns (§2.8). Your visits are only used for remarketing if you have accepted all three categories (§2.8).

Legal basis: your consent, given via the cookie banner, for the placing of cookies/identifiers by Google Analytics (Art. 45c of the Telecommunications Act for Switzerland; Art. 5(3) of the EU "ePrivacy" Directive for visitors residing in the European Union); as a complementary basis, the legitimate interest of Skyday Sàrl in measuring the use of its own website in order to improve it, for the processing of the data itself once the cookie has been placed.

Retention: two retention periods are set in the configuration of Google Analytics 4. The detailed data of each visit (page views, events) is retained for 2 months. Data linked to your browser's identifier, including measured registrations, is retained for 14 months at most, which allows us to recognise a later visit from the same browser and to compare traffic trends year-on-year. The data is then deleted according to that tool's own purge mechanism. The standard Google Analytics reports, which only contain aggregated statistics, remain available beyond these periods.

Objecting / withdrawing your consent: you may at any time refuse or withdraw your consent via the "Manage my cookie preferences" link in the footer, available on every page of the website. Withdrawing your consent to audience measurement also ends the measurement of advertising conversions and remarketing (§2.8), which rely on Google Analytics.

2.5 Technical log of Pro/Entreprise API calls

If your account has one or more Pro or Entreprise plan API keys and you use them to call our QR code management API programmatically, we keep a technical log of these calls. This processing is separate from the scan statistics (§2.2) and the audience measurement of the public website (§2.4), and has no product-statistics purpose: it is used solely for investigation in the event of a reported abuse, a compromised API key, or a dispute over the use of your quota. The number of active keys your account can have depends on your plan (1 for Pro, 10 for Entreprise — see §5 of the Terms); this log works the same way regardless of how many active keys your account has.

We do not record any IP address in this log, not even in hashed form.

Retention: a rolling 12 months, with a daily automatic purge of older entries.

Recipients: Jérôme, only in the event of an investigation (reported abuse, compromised key, dispute over quota). No third party.

Hosting: Infomaniak, like the rest of the service (§6.1) — no transfer outside Switzerland.

2.6 Additional API creation packs (if you purchase any)

If your account is on the Pro or Entreprise plan and you purchase an additional creation pack (§5 of the Terms) to go beyond the included monthly quota, payment — a single payment, with no subscription or automatic renewal — is entrusted to Stripe, in the same way as for the subscription (§2.3). In addition to the data already described in §2.3, we store:

This data follows the same fate as the rest of your account's data: retained for as long as the account exists (§5), deleted with it.

2.7 Custom domain (Pro and Entreprise plans)

With a Pro or Entreprise subscription, you can attach a custom domain to your account, that is, a subdomain of a domain name you control (for example qr.your-company.ch); your QR codes then use this address (§5 of the Terms). If this name contains your name or that of your sole proprietorship (for example qr.john-smith.ch), it is personal data.

DNS verification. Our servers query the public DNS to verify the two records you have created (CNAME and TXT): when you start a verification from the dashboard, and then regularly while your account is on a paid plan. These queries only concern your hostname and transmit no other data.

HTTPS certificate and public logs (Certificate Transparency). So that your QR codes can be served over HTTPS under your domain, our gateway (§6.1) automatically obtains a certificate from the Let's Encrypt certificate authority (§6.6), the first time your domain is accessed after it has been verified. Since a certificate is valid for 90 days at most, the gateway may then request new ones for your domain. Only your hostname appears in these requests: none of your contact details are sent to Let's Encrypt. As with any public HTTPS certificate, Let's Encrypt publishes each certificate, and therefore your hostname, in public logs known as "Certificate Transparency" logs: these logs, kept by several organisations around the world, can be consulted by anyone and are designed never to be modified. This publication is permanent: neither we nor Let's Encrypt can withdraw it, even after your domain is removed or your account is deleted (§5, §8). Your hostname is in any case already public as soon as you create the DNS records. Do not add a custom domain whose name must not be made public.

Scans through your domain. Scans of a QR code printed with your custom domain first go through our gateway, hosted by Infomaniak in Geneva (§6.1), which forwards them to our application. The IP address of the person scanning passes through the gateway so that the request can be forwarded. The scan is then processed exactly like any other scan (§2.2): the custom domain adds no data to your statistics.

Gateway technical logs. Like any server, the gateway keeps technical operating logs (start-up, errors, obtaining certificates). They may contain your hostname and the IP address of some requests. They are used solely for the operation and security of the service, are only consulted for those purposes, are not used for statistics and are not passed on to any third party.

End of subscription and removal. When your paid subscription ends, your configuration (hostname, token, status) is kept, without being re-verified, so that your domain can become active again if you take out a subscription again. You can remove your domain from the dashboard at any time, whatever your plan: its configuration is then deleted immediately.

2.8 Online advertising (Google Ads), with consent

We may promote QR Suisse through advertisements served by Google Ads, Google's advertising service (on Google Search and on websites and apps in Google's advertising network). This covers two uses, each subject to its own consent:

• conversion measurement ("Advertising" category): to know which advertisements are useful, we measure how many people create an account after clicking on one of them;
• remarketing ("Remarketing" category): we may show our advertisements to people who have visited our public website without registering.

Both rely on Google Analytics (§2.4). Conversion measurement only takes place if you have accepted "Audience measurement" and "Advertising". Remarketing only takes place if you have accepted all three categories: "Audience measurement", "Advertising" and "Remarketing". If you tick "Remarketing" without "Advertising", your choice is saved but has no effect: no advertising cookie is placed, no data is transmitted to Google Ads and your visits are not used for remarketing.

Conversion measurement. When you click on one of our advertisements, Google adds a click identifier to the address of the landing page. If you have accepted the "Advertising" category, this identifier is stored in a cookie on our website. If you then create an account, Google Analytics links your registration to that click and passes this conversion on to our Google Ads account.

Remarketing. If you have accepted all three categories and have not registered, we may show you QR Suisse advertisements on websites and apps in Google's advertising network after your visit. To do so, Google Analytics adds you to an audience list, which we share with our Google Ads account. Google then recognises your browser, using its own identifiers, when it shows you advertisements. We only see the approximate size of these lists, never who is on them.

• Lists are built solely from the pages of our public website and the registration journey.
• People whose registration has been measured are excluded from these advertisements.
• You remain on a list that we use for our advertisements for 90 days at most after your last corresponding visit. Google Analytics also automatically keeps a list of all measured visitors, whose duration is set by Google: we never use it to serve our advertisements.
• No list is based on any health-related information, and we do not target anyone based on their health. Our pages for medical practices are aimed at professionals in their professional capacity.
• We use neither "similar audiences" nor audience expansion based on our lists.

Remarketing is profiling within the meaning of the nFADP: an automated assessment of your likely interest in our service, based on your visits. It only takes place with your express consent, given by ticking the "Remarketing" category or by clicking "Accept all", whose text expressly mentions it, and has no consequence for you other than an advertisement being displayed.

In our Google Ads account, we only see aggregated figures (conversions per campaign or advertisement, approximate size of the lists), never the identity of a person. We do not record the click identifier in our database and do not use it ourselves.

What we do not do:

• We do not pass on to Google your email address, your name or any other data from your account, not even in encrypted or hashed form. We use neither Google's "enhanced conversions" nor "Customer Match".
• No Google tool loads on your dashboard once you are logged in, nor on the invitation, password reset or QR code redirection pages. Advertising only concerns our public website and the registration journey.
• We do not use the "Google signals" feature, which links visits to the Google accounts of signed-in visitors.
• Our campaigns are only served in Switzerland.

Before your consent. As long as you have not accepted the "Advertising" category, no advertising cookie is placed and no data is transmitted to Google Ads. As long as you have not accepted both "Advertising" and "Remarketing", your visits are not used for remarketing. If you have not accepted audience measurement either, no Google tool loads (§2.4, §9).

If you had already made a choice before version 1.12 of this policy was published: the banner is shown to you again. Consent previously given to audience measurement counts neither as consent to advertising nor as consent to remarketing.

Google's role. For the data it receives through Google Ads, Google is a controller and also uses that data for its own purposes (§6.4). You can manage, in general, the personalisation of the advertisements Google shows you in "My Ad Center" (myadcenter.google.com). This setting is independent of your choices on our website.

Legal basis: your express consent, given by accepting the "Advertising" category for conversion measurement and the "Remarketing" category for remarketing (see §3). This processing does not take place without your consent; we do not rely on legitimate interest instead.

Retention: see §5.

Withdrawing your consent: at any time, category by category, via the "Manage my cookie preferences" link in the footer. If you withdraw "Remarketing", your visits no longer add you to our remarketing lists; conversion measurement continues as long as "Advertising" remains accepted. If you withdraw "Advertising", no more data is transmitted to Google Ads from your browser, your visits no longer add you to our remarketing lists, and the advertising cookies placed on our domain are deleted. Any membership of a list that we use for our advertisements ends no later than 90 days after your last corresponding visit (§5). Withdrawal applies for the future: it does not affect conversions already transmitted.

2.9 Support requests (Pro and Entreprise plans)

If your account is on the Pro or Entreprise plan, you can send us a support request from your dashboard ("Contact support") and follow it in "My requests". Within your account, each request is only visible to the user who sent it: neither the administrators nor the other users of the account have access to it. If your account goes back to the Free plan, you can still read your requests, but you can no longer send new ones, write in an existing request or mark it as resolved.

Sensitive data. Do not include in your requests any patient or health data, other sensitive data, passwords or API keys: we never need them. If you are bound by professional secrecy, it is up to you not to send us any data covered by it. If such a passage reaches us nonetheless, we may erase it from the request: it is then replaced by the mention "[data removed]". You can also ask us to erase it by writing to contact@qrsuisse.ch.

Who handles your request. Your requests are read and handled by a person at Skyday Sàrl, without any artificial intelligence tool. No third party has access to them, apart from our hosting provider Infomaniak, which acts on our behalf as a processor (§6.1).

Notification emails. When we have replied, we let you know by email. This email contains neither the content of your request nor that of our reply: you read them in "My requests", once logged in. It is sent only to the user who sent the request, to the email address of their login, in the language of the request; it is not sent if that user has been deactivated, or if the account is suspended or pending deletion. On our side, each new request or new message from you triggers an alert sent to our contact@qrsuisse.ch address (§2.10): it contains neither the subject, nor the text, nor your name, nor the identity of your account, only a link to our administration interface. These emails are sent via Infomaniak's messaging service (§6.1).

Closure, reopening and retention. As long as your account is on the Pro or Entreprise plan, you can mark a request as resolved at any time, even before we reply, with the "Mark as resolved" button: it is then closed. Otherwise, a request we have replied to is closed automatically if you have not written in it within 30 days of our last reply; a request awaiting our reply is never closed automatically. We may also close a request ourselves. A closed request can be reopened: if you write in it (on the Pro or Entreprise plan), or if we write in it. We only write in a closed request to follow up on that same request, for example to complete or correct our reply, or to let you know that the problem you reported has been fixed; never about another subject, and never solely to extend its retention. You are notified by email under the conditions described above. For a new question, we recommend opening a new request. Requests are kept for 24 months after they were last closed, whether by you, by us or automatically (for an open request, including a reopened one, 24 months after it was last modified), then deleted automatically, together with all their messages and the internal record of our actions. Reopening cancels the previous closure: the 24-month period starts again from the next closure. In any case, they are deleted, together with that record, when your account is permanently deleted (§5).

If the user who sent a request is deactivated by an administrator of the account, the request is kept, linked to the account, until the deadline above; no one in the account can see it any more and no further email is sent about it. That user can obtain access to their requests by writing to contact@qrsuisse.ch.

Legal basis: performance of the subscription contract; for your optional feedback on our replies, for the internal record of our actions and for overall statistics on how requests are resolved, Skyday Sàrl's legitimate interest (see §3).

Hosting: Infomaniak, in Switzerland (§6.1) — no transfer outside Switzerland.

2.10 Messages sent to contact@qrsuisse.ch

If you write to us at contact@qrsuisse.ch, whether or not you are a customer (a question, exercising your rights, a request outside the dashboard), we process your email address, your name if it appears, the content of your message and of any attachments, as well as our replies, solely to reply to you and, where applicable, to follow up on your request. These messages are read by a person at Skyday Sàrl, without any artificial intelligence tool. They are hosted in Switzerland by Infomaniak's messaging service (§6.1), without forwarding or copying to any other mailbox.

Retention: 12 months after our last exchange with you. We delete these messages once a quarter; a message is therefore erased no later than 15 months after that last exchange.

Legal basis: our legitimate interest in replying to the messages sent to us; if you are a customer, performance of the contract (see §3).

2.11 Protection against duplicate creations via the API (Pro and Entreprise plans)

When your program creates a QR code through our API (§2.5), it can add an Idempotency-Key header to its request, that is, a value it chooses to designate this creation. This header is optional. If it is present and the creation takes place, we keep the following data:

If the same request reaches us a second time, for example because your program sent it again after a network outage, we do not create a second QR code. We return the one already created, without deducting another creation from your monthly quota or a credit from a pack (§2.6). The content of the request, in particular the label, the destination and the details of a contact card, is not copied for this purpose: it is only stored in the QR code itself (§2.1). If the creation does not take place (invalid request, insufficient rights, quota exhausted, error on our side), we record nothing: you can reuse the same value once the problem has been resolved.

Choose a random value (we recommend a UUID v4) and do not put any personal data in it, such as a name, an email address or a customer number. We only keep its fingerprint, but this value does not need to mean anything.

No other use: this data is used solely to avoid duplicates. It is not used for statistics, for billing or to analyse your use of the API. The header value is not written to any log. Every call is still recorded in the technical log of API calls (§2.5), where a repeated request is identifiable as such; this log contains neither the header value nor its fingerprint.

Retention: this data is no longer taken into account 24 hours after the creation. A request sent later therefore creates a new QR code and counts as a new creation. A daily automatic purge then deletes it, no later than 72 hours after the creation. In any case, it is deleted along with your account (§5). If you delete the QR code in the meantime, its identifier is removed from this data: a repeated request with the same value is then refused, without a new creation. If you revoke the API key, this data is no longer used and is deleted within the same period.

Recipients: none. This data is processed automatically, and no third party has access to it.

Hosting: Infomaniak, like the rest of the service (§6.1) — no transfer outside Switzerland.

Legal basis: performance of the contract (see §3).

3. Legal basis for processing

• Account and content of QR codes: performance of the contract binding us — the pilot agreement for SMEs still in the pilot phase, the terms and conditions (general terms) from the point of subscription, including on the Free plan (Art. 31 para. 2 let. a nFADP by analogy / Art. 6(1)(b) GDPR where applicable). No separate consent required.
• Aggregated scan statistics: the legitimate interest of Skyday Sàrl and of the account holder in measuring the use of a QR code they have created, in a strictly aggregated and non-individualising way — processing is reduced to the minimum necessary for this purpose (§2.2).
• Subscription and billing: performance of the subscription contract (Pro or Entreprise); retention of accounting records under a legal obligation (Art. 958f of the Swiss Code of Obligations (CO)). The processing that Stripe carries out on its own behalf (fraud, regulatory obligations, and Link for the part it processes in its own name) is based on the legal grounds described in Stripe's privacy policy (and, for Link, in Link's own policy).
• Audience measurement of the public website: your consent, given via the cookie banner (Art. 45c of the Telecommunications Act for Switzerland; Art. 5(3) of the EU "ePrivacy" Directive for visitors residing in the EU); as a complementary basis, the legitimate interest of Skyday Sàrl in measuring the use of its own website — details in §2.4.
• Online advertising: Google Ads conversion measurement (§2.8): your express consent, given by accepting the "Advertising" category in the cookie banner (Art. 45c of the Telecommunications Act and Art. 31 para. 1 nFADP for Switzerland; Art. 5(3) of the EU "ePrivacy" Directive and Art. 6(1)(a) GDPR for visitors residing in the European Union). This consent is separate from the consent given for audience measurement. No other basis is relied upon.
• Google Ads remarketing (§2.8): your express consent, given by accepting the "Remarketing" category in the cookie banner, separate from the two above (same provisions). It only takes effect if you have also accepted audience measurement and advertising. The "Accept all" button counts as accepting all three categories; each is recorded and can be withdrawn separately. No other basis is relied upon.
• Technical log of Pro/Entreprise API calls: the legitimate interest of Skyday Sàrl and of the key holder in being able to investigate an abuse, a compromised key or a dispute over the use of the quota — not a product-statistics purpose; as a complementary basis, the performance or evidencing of the Pro/Entreprise subscription contract in the event of disagreement over the quota (§2.5).
• Purchase of an additional API creation pack (§2.6): performance of the contract to purchase the pack — a one-off service, distinct from the subscription but subject to the same contractual logic (Art. 31 para. 2 let. a nFADP by analogy / Art. 6(1)(b) GDPR where applicable). No separate consent required.
• Custom domain (§2.7): performance of the Pro or Entreprise subscription contract, of which the custom domain is a feature you choose to activate (Art. 31 para. 2 let. a nFADP by analogy / Art. 6(1)(b) GDPR where applicable). Publication of the hostname in the Certificate Transparency logs is required by the main browsers for an HTTPS certificate to be accepted: it is inseparable from the feature. No separate consent required. For the gateway technical logs: Skyday Sàrl's legitimate interest in ensuring the operation and security of the service.
• Support requests (§2.9): performance of the Pro or Entreprise subscription contract, of which form-based support is a service (Art. 31 para. 2 let. a nFADP by analogy / Art. 6(1)(b) GDPR where applicable). For your optional feedback on our replies, for the internal record of our actions and for overall statistics on how requests are resolved: Skyday Sàrl's legitimate interest in improving its support and in being able to establish who handled a request (Art. 31 para. 1 nFADP / Art. 6(1)(f) GDPR where applicable). No separate consent required.
• Messages sent to contact@qrsuisse.ch (§2.10): Skyday Sàrl's legitimate interest in replying to the messages sent to it (Art. 31 para. 1 nFADP / Art. 6(1)(f) GDPR where applicable); where you are a customer, performance of the contract binding us.
• Protection against duplicate creations via the API (§2.11): performance of the Pro or Entreprise subscription contract and, where applicable, of the contract to purchase a creation pack: the aim is not to create the same QR code twice or count the same creation twice (Art. 31 para. 2 let. a nFADP by analogy / Art. 6(1)(b) GDPR where applicable). No separate consent required.

4. Who has access to your data

• Internally: only the person(s) operating the service for Skyday Sàrl, including via the Stripe dashboard for billing.
• You only see the data of your own account and the aggregated statistics of your own QR codes — never those of another account holder. This also applies to your API keys and your creation packs (§2.5, §2.6).
• Within an account with several users, users authorised to see QR codes created by others see, for each of these QR codes, the first and last name of the user who created it, or the name of the API key that created it — never their email address. A deactivated user continues to be shown as the author of their QR codes, with the mention "(deactivated)"; if a user is deleted, their QR codes remain in the account and are shown as created by a "Former member".
• List export and image download (Pro and Entreprise plans): the users of an account can export the list of the QR codes they can see to a CSV file. Its columns are: Identifier, Label, Type, Public URL, Destination (link-type QR codes), Status, Scans, "Created on", Created by, Tags. The "Created by" column only appears for users authorised to see QR codes created by others. The destination is included in full: for an email, phone or SMS QR code, it includes the email address or phone number (and, where applicable, the message) that you entered; for a calendar QR code, the event details. The file never contains the content of business cards or users' email addresses. It is generated by our servers at the time of your request and sent to you directly, without being stored by us. Users can also download the images of several QR codes, bundled in a ZIP file: these images and this file are generated directly in your browser, from the public address of each QR code; our servers neither produce nor keep them. Once downloaded, these files are the responsibility of the account holder.
• People who scan a contact-card type QR code receive the contact details you have chosen to publish there.
• We do not sell any data, and no reseller or data broker has access to your data. The only third parties are our hosting and payment processors (§6), Google and Gencie for the audience measurement of the public website (§2.4, §6.4, §6.5), Google for online advertising (§2.8, §6.4) (these two processing activities only if you have consented to them), and Let's Encrypt if you use a custom domain (§2.7, §6.6). If you use Stripe Link (§2.3), Stripe shares your data with the other merchants with whom you choose to pay via Link — outside our relationship with you, under Link's own terms.
• Google, for the audience measurement of the public website (§2.4) and, depending on the categories you have accepted, for the measurement of our Google Ads campaigns and remarketing (§2.8), in the roles described in §6.4.
• Gencie (Weboard product, a Swiss company), to whom we grant read-only access to our Google Analytics and Search Console data, via an official API connection, so that we can view it in a single dashboard. Gencie does not carry out any additional collection on this website: it only accesses the data already described in §2.4. This mention is strictly limited to the reporting module of Weboard, the only module we use; Weboard also offers other features, not activated here, including an analysis module relying on third-party artificial intelligence tools — this module is not described in this policy as long as it is not used for this website, and an update would be published before any future activation.
• Let's Encrypt (Internet Security Research Group, United States), only if you use a custom domain: receives your hostname in order to issue the corresponding HTTPS certificate, and publishes it in the public Certificate Transparency logs, which anyone can consult (§2.7, §6.6).
• Technical log of Pro/Entreprise API calls (§2.5): viewable only by Jérôme, only in the event of an investigation. No third party has access to it.
• Duplicate-prevention data for API creations (§2.11): processed automatically, not viewed by anyone outside a technical intervention on the service. No third party has access to it.
• Support requests and messages sent to contact@qrsuisse.ch (§2.9, §2.10): read only by the person(s) operating the service for Skyday Sàrl, without any artificial intelligence tool. Within your account, a support request is only visible to the user who sent it. No third party has access to them, apart from our hosting provider Infomaniak, as processor (§6.1).

5. Retention period

• During the relationship (pilot, or Free/Pro/Entreprise subscription): your account, your QR codes and their total counter are retained for as long as the relationship exists.
• Daily statistics: retained on a rolling 15-month basis, regardless of plan, then automatically deleted — the service's first automated deletion mechanism, limited to this daily data only. The total counter is not affected. The statistics of a deleted QR code or account disappear along with it.
• End of a pilot with no follow-up (rule confirmed by the management of Skyday Sàrl on 2026-09-11, duration specified on 2026-09-16, applicable to SMEs still in the pilot phase): a pilot officially ends either when the SME switches to the Pro subscription (the "End of the Pro or Entreprise subscription" rule below then applies — no deletion), or, failing that, automatically 6 months after it begins. In this second case — a pilot ending without a switch to the subscription — the account and associated QR codes are deleted no later than 3 months after this official end of the pilot, unless you instruct us otherwise.
• End of the Pro or Entreprise subscription, or a reduction in the number of allowed keys (e.g. Entreprise → Pro): your account is not deleted — it reverts (after the grace period, §2.3) to the rules of the Free plan, or keeps a reduced key quota, and you can resubscribe or switch to a higher plan at any time. Your excess API keys and unused creation packs are not deleted either: they are frozen — for an API key, a technical field (frozenAt) is set to the date of the freeze, the key refuses all authentication with the same generic message as an unknown key (anti-enumeration), and its configuration (name, rights) is kept; for a pack, the balance is kept exactly as is, never reset to zero or refunded. On the Free plan, the "API keys" page does not show your keys, and you cannot view, revoke, regenerate or reactivate them until you take out a Pro or Entreprise subscription again. On the Pro or Entreprise plan, a frozen key remains visible in your dashboard with a "Frozen" badge, and you can revoke it, regenerate it or reactivate it yourself with the "Reactivate" button. Two separate counting rules then apply: to reactivate a frozen key, only your active keys count, and reactivation is possible as long as their number is below your plan's limit; to create a new key, your frozen keys count too, until you revoke them. A reactivated key works immediately, with its configuration unchanged; your other frozen keys stay frozen. The date of this reactivation is recorded on the key, like its other management dates (creation, last use, regeneration, revocation), and kept with it. As long as your plan does not change, no frozen key is reactivated automatically: neither the renewal of your subscription, nor the revocation of another key, nor regenerating (rotating) the frozen key itself reactivates it. Your frozen packs become usable again as soon as your account is back on the Pro or Entreprise plan. Your frozen keys, however, only become active again automatically and immediately when you switch to a plan allowing more active keys (taking out a Pro or Entreprise subscription again, or switching from Pro to Entreprise — see §9.5 and §9.6 of the Terms), within the limit of the new plan: first the most recently frozen keys (in practice, those that were active just before the last freeze), then the others; within each of these two groups, the oldest (by creation date) first. Keys and packs are only deleted if the account itself is deleted (below, or §15.1 of the Terms).
• Custom domain (§2.7): its configuration (hostname, verification token, status and dates) is kept for as long as your account exists, including on the Free plan after a paid subscription ends, so that the domain can become active again if you take out a subscription again. It is deleted immediately if you remove the domain from the dashboard, which you can do at any time, whatever your plan, and together with your account in all the deletion cases described in this section. The domain's HTTPS certificate, a public document that only contains the hostname, is kept on our gateway (§6.1); each certificate is valid for 90 days at most. The gateway technical logs are kept for as long as necessary for the operation and security of the service. Exception: publication of the hostname in the public Certificate Transparency logs is permanent (§2.7); Let's Encrypt also keeps its own logs under its privacy policy (§6.6).
• Inactive Free account (mechanism implemented and active): a Free plan account is considered inactive after 6 months without a login or a scan of any of its QR codes; this period restarts completely from zero at the slightest login or scan. As this period elapses, you are warned by a series of emails: reminders at months 1, 2, 3 and 4 of inactivity, an explicit warning at month 5, then reminders at day -7, -2 and -1 before the 6-month deadline. At the deadline (day 0), we send you a deletion notice together with a recovery link valid for 30 days, and your account enters the "pending permanent deletion" state: your data (account, QR codes, statistics) remains intact but is only accessible via this recovery link. If you do not reactivate your account within this additional 30-day period, it is permanently and irreversibly deleted — account, QR codes and statistics.
• Public website audience measurement data (GA4): detailed data of each visit retained for 2 months; data linked to your browser's identifier retained for 14 months at most; periods set in the configuration of Google Analytics 4, then deletion according to that tool's own mechanism (see §2.4 for details).
• Advertising cookies placed on our domain (§2.8): 90 days at most from when they are placed, then automatically deleted by your browser; deleted immediately if you withdraw your consent to the "Advertising" category. The data Google receives through Google Ads is retained by Google under its own policy (§6.4).
• Membership of a remarketing list (§2.8): 90 days at most after your last corresponding visit for the lists we use for our advertisements, set in their configuration; the list of all visitors that Google Analytics keeps automatically, which we never use for our advertisements, follows the duration set by Google; once you have withdrawn your consent to the "Remarketing" or "Advertising" category, no further visit adds you to a list.
• Your choice in the cookie banner: stored for 6 months in a technical cookie of our website, which only contains your choices. The banner is then shown to you again.
• Technical log of Pro/Entreprise API calls (§2.5): retained on a rolling 12-month basis, with a daily automatic purge of older entries.
• Duplicate-prevention data for API creations (§2.11): taken into account for 24 hours after the creation, then deleted by a daily automatic purge, no later than 72 hours after the creation; in any case deleted along with your account.
• Support requests (§2.9): you can mark a request as resolved at any time (Pro and Entreprise plans); otherwise, a request we have replied to is closed automatically if you have not written in it within 30 days of our last reply. A new message, from you or from us, reopens a closed request. Each request is kept for 24 months after it was last closed, whether by you, by us or automatically (for an open request, including a reopened one, 24 months after it was last modified), then automatically deleted, together with its messages and the internal record of our actions. In any case, it is deleted, together with that record, along with your account.
• Messages sent to contact@qrsuisse.ch (§2.10): kept for 12 months after our last exchange with you, then deleted during our quarterly deletion, i.e. no later than 15 months after that last exchange. They do not depend on the existence of an account and follow this separate period.
• On simple request, at any time (right to erasure, §8): account deletion within a maximum of 30 days of your request. Once your request has been processed by our team, deletion — account, QR codes, statistics, API keys, creation packs, duplicate-prevention data for API creations, custom domain configuration, support requests (with the internal record of our actions), and your Stripe customer record (name, email, address, payment methods) — takes place right away, through the same technical mechanism as the automatic deletion of inactive Free accounts (above); Stripe retains only a technical identifier, without any identifying data. Invoices already issued remain stored independently (see "Invoices and payment history" below), because Stripe fixes the name/email/address on each invoice at the time it is issued — this accounting retention is not affected by the deletion of the customer record. Any remaining Link data, where applicable, continues to be managed under Link's own terms, independently of this deletion. Publication of a custom domain's hostname in the public Certificate Transparency logs, where applicable, cannot be erased (§2.7). Messages exchanged with us at contact@qrsuisse.ch, including your deletion request, follow their own retention period (above).
• Invoices and payment history: retained for 10 years (accounting obligation, Art. 958f CO), with Stripe and in Skyday Sàrl's accounts — even after your account is deleted. They only contain the elements of an invoice (email, plan, amount, date), never card data.
• Transient IP fingerprint for deduplication: a maximum of 5 seconds, never persisted (§2.2).
• Password reset link (§2.1): valid for 60 minutes when you request it yourself via "Forgot your password?" (24 hours when an administrator of your account triggers it for you), and single-use — each new request cancels the previous link. We keep only its cryptographic fingerprint: it is erased as soon as the link is used; otherwise, the link can no longer be used once its validity period has expired, and its fingerprint, now useless, is overwritten by that of any new request or deleted along with the account.
• Address entered in "Forgot your password?" and anti-abuse counters: the address entered is not retained. The non-reversible fingerprints used to limit serial requests are held in the server's memory only, over a 60-minute window, and are never persisted (§2.1).
• Test accounts on the validation environment ("staging"): retained for the duration of the announced test window, then deleted no later than 30 days after that window closes.

Justification: unlike the pilot, the subscription-based commercial relationship is no longer time-bound; without an inactivity rule, retention would become unlimited by default, contrary to the principle of proportionality (Art. 6 para. 2-4 nFADP). The 15-month retention of daily statistics and the 6-month inactivity rule (with its cascade of email warnings and its 30-day recovery period) limit this retention; the 10-year retention of invoices is a legal obligation, not a choice. Freezing (rather than deleting) API keys and creation packs — at the end of a paid subscription, or whenever a plan change reduces the number of allowed keys — follows the same principle of reversibility as the Pro→Free grace period, without creating any new data retained indefinitely: the frozen state is only a marker on data that already exists (the key or the pack), and a key's reactivation date is just one more management date on that same key; both, like the frozen balance, remain bounded by the lifetime of the account itself (above). Keeping the custom domain configuration after a paid subscription ends follows the same principle of reversibility; you can end it at any time by removing the domain, and it remains bounded by the lifetime of the account and therefore, for a Free account, by the inactivity rule. Deletion for inactivity of a Free account is now an automated, technically verified mechanism; deletion linked to the end of a pilot remains, to date, an action carried out by Skyday Sàrl.

6. Hosting and processors

6.1 Infomaniak (hosting, Switzerland)

Your account data, your QR codes, your statistics, your API keys, your creation packs, your custom domain configuration, your support requests and the subscription identifiers we keep are hosted exclusively in Switzerland, with Infomaniak:

• Application server (production): Jelastic Cloud, Geneva (DC2).
• Database (production): separate Infomaniak hosting (MariaDB).
• Custom domain gateway (production): separate Infomaniak server, Geneva (DC2). It receives scans addressed to a custom domain, holds the corresponding HTTPS certificates and forwards requests to the application server (§2.7).

Infomaniak acts as a processor within the meaning of Art. 9 nFADP / Art. 28 GDPR. On 29 September 2026, Skyday Sàrl concluded a Data Processing Agreement (DPA) with Infomaniak covering both the nFADP and the GDPR. This agreement applies to all the Infomaniak services that Skyday Sàrl uses for QR Suisse: hosting of the production and validation environments (§6.3), the custom domain gateway, databases, the sending of service emails and the contact@qrsuisse.ch mailbox (see below).

Messaging (service emails). The service emails that our application sends you (in particular: password reset link and password-change notification, invitation to join an account, messages relating to account inactivity, reminder of an unfinished Pro plan choice, notices of replies to your support requests, without their content) are sent via Infomaniak's messaging service (SMTP relay), also hosted in Switzerland. This relay therefore carries the recipient's address and the content of these emails — including, for a password reset, the single-use link — while they are being delivered; Infomaniak acts here too as a processor, under the data processing agreement described above. Subscription-related emails (receipts, invoices, failed payment) are, for their part, sent by Stripe (§2.3). The contact@qrsuisse.ch mailbox, which receives the messages you send us (§2.10) and our support alerts (§2.9), is hosted by Infomaniak's messaging service in Switzerland, under the same data processing agreement.

6.2 Stripe (payment and subscription)

Payment, subscription management (customer portal) and the sending of receipts and invoices are handled by Stripe Payments Europe, Limited, Dublin, Ireland (a company of the Stripe group, whose parent company is based in the United States). Stripe acts in three capacities:

• as a processor for Skyday Sàrl for the management of your subscription (Pro or Entreprise) and your purchases of creation packs, under Stripe's Data Processing Agreement (stripe.com/legal/dpa), incorporated into its terms of service;
• as an independent controller for the payment processing itself — fraud detection, compliance with its legal and regulatory obligations (anti-money laundering, identification), improvement of its services. For this part, Stripe's privacy policy applies: stripe.com/privacy;
• also as an independent controller for Stripe Link (§2.3) — under Link's own terms and privacy policy (stripe.com/legal/link, link.com/privacy).

Stripe uses its own processors and affiliated companies, the list of which is published at stripe.com/legal/service-providers. The resulting transfers outside Switzerland are described in §7.

6.3 Validation environment ("staging")

In addition to the production environment, Skyday Sàrl may use a second Infomaniak environment, separate but equivalent in nature (Jelastic Cloud Geneva DC2 + separate MariaDB database, same application code, same security measures), to test a feature before it goes into production. This environment is only accessible to the management of Skyday Sàrl and, occasionally and by invitation, to a limited number of account holders taking part in a test ("key users") — never publicly accessible, its address is neither published nor indexed. Stripe operates there in test mode only (no real banking data). If you take part in it, see §2.1 and §5.

6.4 Google (audience measurement and advertising, with consent)

We use two services of Google Ireland Limited (Dublin, Ireland), whose parent company is Google LLC (United States). They only apply to our public website and the registration journey, never to your dashboard once you are logged in, and only to the extent of the categories you have accepted:

• Google Analytics 4 (audience measurement, §2.4). For this service, Google acts as a processor for Skyday Sàrl, under Google's data processing terms (Google Ads Data Processing Terms, which also cover Google Analytics): it processes this data to provide us with the statistics. We have not enabled the sharing of Google Analytics data with Google for its own products and services.
• Google Ads (measurement of advertising conversions and remarketing, §2.8). For the data it receives in this context, including the conversions and, if you have accepted remarketing, the audience lists that Google Analytics passes on to our Google Ads account, Google acts as a controller, under the Google Ads Controller-Controller Data Protection Terms. It also uses this data for its own purposes, in particular to provide, measure, improve and secure its advertising services and to combat fraud, under its privacy policy (policies.google.com/privacy).

Collection on our website: joint controllership. For the collection of advertising data on our website and its transmission to Google, Skyday Sàrl and Google may be regarded as joint controllers. Each is solely responsible for the processing it then carries out on its own behalf. The roles are allocated as follows:

• Skyday Sàrl decides to use Google Ads on its public website and chooses which categories are subject to your consent; informs you (this policy and the cookie banner); obtains your consent, either globally or category by category, records it for each category and communicates it to Google on every visit; technically prevents any transmission to Google Ads without your consent; configures the remarketing lists it uses for its advertisements (pages used, duration of 90 days at most, exclusion of registered people); and remains your point of contact for exercising your rights.
• Google provides the tools, receives the data and alone determines the processing it then carries out on its own behalf (§2.8); it is solely responsible for that processing and informs you about it in its own privacy policy.

You may exercise your rights with Skyday Sàrl as well as with Google, whatever the processing concerned (§8). We handle ourselves what relates to our website and our Google Ads account; if your request concerns processing that Google carries out on its own behalf, we will tell you how to address it to Google.

See §7 for the resulting data transfer.

Apart from these cases, no other provider processes your personal data, except for Gencie (§6.5) and, if you use a custom domain, Let's Encrypt (§6.6). The development of the service relies on software development assistance tools (including an AI assistant), but these tools have no access to any real personal data — they only work on the project's source code and documentation.

6.5 Gencie (Weboard) — read-only access to our audience reports

To view our website's audience statistics (§2.4) in a single dashboard, we use Weboard, a product of Gencie, a Swiss company. Gencie connects in read-only mode to our Google Analytics 4 (and Search Console) account via an official API — it does not place any additional cookie or tracker on this website and does not collect any new data: it only views the data already described in §2.4. Gencie acts as a processor for this processing, under a data processing agreement compliant with the nFADP/GDPR. Weboard's main infrastructure is hosted in Switzerland (Infomaniak).

This description is strictly limited to the reporting module of Weboard, the only module we currently use. Weboard offers other features not activated for this website, including an analysis module relying on third-party artificial intelligence tools based outside Switzerland; this module, should it ever be activated, would involve a data transfer to other countries, which would then be documented here before its activation, with the corresponding safeguard check — not retroactively.

6.6 Let's Encrypt (HTTPS certificates for custom domains)

The HTTPS certificates for custom domains (§2.7) are issued by Let's Encrypt, a certificate authority operated by the Internet Security Research Group (ISRG), a non-profit organisation based in the United States. Let's Encrypt does not act on our instructions: it issues certificates under its own terms and under the rules that apply to every public certificate authority, including the publication of each certificate in the Certificate Transparency logs. It is therefore an independent controller for its processing of the hostname. It only receives the hostname from us, never your other data. Its privacy policy: letsencrypt.org/privacy. See §7 for the resulting transfer.

7. Data transfers outside Switzerland

• Account, QR codes, statistics, subscription status, API keys, creation packs, technical log of API calls, duplicate-prevention data for API creations, custom domain configuration, support requests and messages sent to contact@qrsuisse.ch (§2.5, §2.6, §2.7, §2.9, §2.10, §2.11): no transfer — hosting with Infomaniak in Switzerland (production and validation).
• Payment and subscription data entrusted to Stripe (§2.3, §2.6): transferred to Ireland (Stripe Payments Europe Ltd), then, for the purposes of Stripe and its processors, to other countries, including the United States (Stripe, Inc.). Legal bases:
  • Ireland: EU member state, recognised by the Federal Council as ensuring an adequate level of protection (Annex 1 of the Data Protection Ordinance — Art. 16 para. 1 nFADP).
  • United States: Swiss-U.S. Data Privacy Framework, recognised by the Federal Council as ensuring an adequate level of protection for certified US companies, in force since 15 September 2024; Stripe declares its certification to this framework (stripe.com/legal/data-privacy-framework). As an additional safeguard, Stripe's DPA incorporates the standard contractual clauses applicable where this framework does not apply.
  • Other countries of Stripe's processors: contractual safeguards provided for in Stripe's DPA.
• If you use Stripe Link: your data may be transferred and reused under Link's own terms, outside our contractual relationship with Stripe (§2.3, §6.2).
• Data entrusted to Google (§2.4, §2.8), only if you have consented to audience measurement, advertising or remarketing: transferred to Ireland (Google Ireland Limited) and to the United States (Google LLC). Legal bases:
  • Ireland: EU member state, recognised by the Federal Council as ensuring an adequate level of protection (Annex 1 of the Data Protection Ordinance — Art. 16 para. 1 nFADP).
  • United States: Swiss-U.S. Data Privacy Framework, recognised by the Federal Council as ensuring an adequate level of protection for certified US companies. Google LLC's certification to this framework (including its Swiss component) is active, verified on 2026-10-14 in the official register (dataprivacyframework.gov).
• Your custom domain's hostname (§2.7, §6.6), only if you use this feature: transmitted to Let's Encrypt (ISRG) in the United States for the issuance of the certificate, then published in the Certificate Transparency logs, which can be consulted worldwide. This transfer is not based on an adequacy decision but on the exceptions provided by law: it is directly connected with the performance of the contract between us, since the certificate is essential for the custom domain you have chosen to activate to work (Art. 17 para. 1 let. b no. 1 nFADP); in addition, you have yourself already made this hostname accessible to everyone in the public DNS (Art. 17 para. 1 let. e nFADP). Where the GDPR applies: Art. 49(1)(b) GDPR.
• Gencie (§6.5), which views our audience reports in read-only mode, hosts the infrastructure of the reporting module we use in Switzerland (Infomaniak): this does not, for this particular module, involve any additional transfer outside Switzerland.

GDPR: the service is offered through self-service registration to individuals and businesses, mostly based in Switzerland, and our advertising campaigns are only served in Switzerland. The GDPR may nevertheless apply in addition to the nFADP where a person located in the European Union is affected by a processing activity, for example when they visit our public website and accept audience measurement (§2.4) or advertising (§2.8). You then have the rights described in §8. The data processing agreements with Infomaniak (§6.1) and Stripe (§6.2) also cover the GDPR.

8. Your rights

Whether you are an account holder or user, a person who has written to us at contact@qrsuisse.ch, a person appearing on a contact card published by an account holder, a visitor to the public website who has consented to audience measurement (§2.4) or advertising (§2.8), or simply a person whose IP address was transiently processed during a scan (see §2.2 and, for a scan through a custom domain, the gateway technical logs described in §2.7 — in this last case, the absence of any identifying data limits, in practice, the exercise of these rights), you have the following rights, as provided for by the Swiss Federal Act on Data Protection (nFADP) and, where the GDPR applies in addition (see §7), by that regulation:

• Right of access (Art. 25 nFADP): to obtain confirmation that data concerning you is being processed, and a copy of that data.
• Right to rectification (Art. 32 para. 1 nFADP): to have inaccurate data corrected (e.g. email address); if the accuracy of a piece of data cannot be established, you may request that a note of its disputed nature be added to it.
• Right to erasure and to the prohibition of a specific processing activity, through the action for protection of personality rights (Art. 32 para. 2 nFADP, referring to Art. 28, 28a and 28g to 28l of the Swiss Civil Code): you may request the deletion of your account and associated data (see §5 for the timeframes and for the accounting records that the law requires us to retain), the prohibition of a specific processing of your data, or the prohibition of its disclosure to a specific third party. This right cannot apply to the publication of a custom domain's hostname in the public Certificate Transparency logs, which is permanent (§2.7). For audience measurement (§2.4), advertising and remarketing (§2.8), this right is simply exercised by refusing or withdrawing your consent, category by category. Withdrawing your consent to remarketing affects neither audience measurement nor conversion measurement. Withdrawing your consent to advertising also ends remarketing, without affecting audience measurement. Withdrawing your consent to audience measurement ends conversion measurement and remarketing, which rely on Google Analytics (§2.8).
• Right to data portability (Art. 28 nFADP), where the legal conditions are met (automated processing of data you have provided to us, in the context of your consent or the performance of the contract): your QR codes and their statistics may be provided to you, or transmitted to another controller, in a commonly used electronic format, on request.
• Where the GDPR applies (a person residing in the European Union affected by a processing activity, see §7): you additionally have, for that processing, the right to object (Art. 21 GDPR) and the right to restriction of processing (Art. 18 GDPR), as defined by that regulation. Swiss law does not name these two rights separately; their substance — stopping or limiting a specific processing activity — is covered, for all account holders, by the action for protection of personality rights described above.

To exercise any of these rights, contact contact@qrsuisse.ch. We respond within the timeframes provided for by the nFADP and, where applicable, the GDPR. If you have sent a support request, you can read it at any time in "My requests" (§2.9); if your login has been deactivated, write to us at the same address to obtain your requests. For data that Stripe processes on its own behalf (§6.2), including for Link, you may also contact Stripe (or Link) directly, in accordance with their respective privacy policies. For data that Google processes on its own behalf, in particular through Google Ads (§2.8, §6.4), you may also contact Google directly, in accordance with its own privacy policy; for the collection carried out on our website, you may contact either us or Google (§6.4).

You also have the right to lodge a complaint with the competent supervisory authority — in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC), https://www.edoeb.admin.ch; if the GDPR applies to your situation (§7), also the competent supervisory authority of your state of residence in the European Union.

9. Security of your data

Technical and organisational measures are in place to protect your data: password hashing (bcrypt, cost factor 12), encrypted sessions, limiting of login attempts and of password reset requests, HTTPS/HSTS, strict validation of submitted data, HTTP security headers (including a strict Content Security Policy). For password reset: a single-use, time-limited link (60 minutes) of which only the fingerprint is stored; an identical response whether or not the account exists; closing of open sessions and a notification email after any change; the link's address is passed neither to the audience measurement tool nor to third-party websites (no measurement on these pages, "Referer" header disabled). For payment: no card data passes through our servers; the notifications sent by Stripe to our application are signed and verified; our application's access to Stripe uses a key with restricted permissions. For audience measurement (§2.4), advertising and remarketing (§2.8): no Google tool loads and no request is sent to Google before your explicit consent (basic Consent Mode); the "Advertising" and "Remarketing" categories are refused by default; as long as "Advertising" has not been accepted, Google Analytics is instructed not to place any advertising cookie and not to transmit any data to Google Ads; as long as "Advertising" and "Remarketing" have not both been accepted, it is instructed not to use your visits for personalised advertising; no Google tool loads outside the public website and the registration journey; a refusal or withdrawal is immediately and symmetrically respected; the IP address is anonymised before any storage in Google Analytics; form abandonment tracking never captures the value entered in a field. For the technical log of Pro/Entreprise API calls (§2.5): it contains no secret or authentication fingerprint, no IP address is recorded in it, not even hashed, and the logged resource identifier is not enumerable. For the API creation packs (§2.6): the purchase is entrusted to Stripe under the same safeguards as the subscription (no card data passes through our servers), and a technical mechanism guarantees that the same payment can never create the same pack twice. For the custom domain (§2.7): our gateway only obtains a first certificate for a domain with the authorisation of our application, which only grants it to verified domains of accounts on a paid plan; a domain is only verified after a double DNS verification carried out by our servers (a CNAME record and a random TXT token proving control of the domain), which prevents a third party from claiming a name it does not control; the same hostname can only be attached to one account; a custom domain only serves the QR codes of the account it is attached to. For support requests (§2.9): within the account, each request is only accessible to the user who sent it; notification and alert emails contain neither the subject nor the text of requests; an erased passage is replaced in our database, not merely hidden on screen. For protection against duplicate creations (§2.11): only fingerprints computed with a secret key are kept, never the header value or the content of the request; recognition is limited to the API key that created the QR code; the creation, the deduction from the quota and the duplicate-prevention record form a single operation, carried out in full or not at all. These measures apply identically on the production environment and on the validation environment (same code deployed), except for the custom domain gateway, which only exists in production. In the event of a data breach affecting you, a data breach management procedure applies.

10. Changes to this policy

This policy may be updated if the service evolves (a new feature processing personal data, a change of hosting or payment provider, etc.). Any substantial change will be communicated to account holders. The version in effect is always the one published in the application.