General Terms and Conditions for QRGeno by Paperphyte AB
Last updated: 2026-10-22
Definitions
In these Terms, the following terms shall have the meanings set out below: "Agreement" means these Terms including all appendices and the Company's privacy policy and cookie policy as amended from time to time, which form an integral part of the Agreement. "Services" means the digital services provided by the Company, including dynamic QR codes (link, Wi-Fi, voucher and contact types), the QR builder, scan analytics ("impression services"), bulk QR-code management, optional ordering of printed materials on behalf of the Customer, and associated APIs. "Customer" means a legal entity entering into an agreement with the Company. "Customer Data" means all data, including personal data, that the Customer or its end users contribute to the Services. "Personal Data" means data as defined in Regulation (EU) 2016/679 of the European Parliament and of the Council ("GDPR"). "Data Controller" and "Data Processor" shall have the meanings set out in the GDPR. "QRGeno API" means the Company's application programming interface, available on the Enterprise plan. "SLA" means the service level commitments set out in these Terms.
Access to the Services
The Company grants the Customer a non-exclusive, non-transferable and time-limited right to use the Services in accordance with the Agreement. The Company reserves the right to make changes to the Services at any time, provided that such changes do not materially impair the functionality.
Registering a Company
To use the Services, the Customer must register an account. The Customer must be a legal entity (company) with a valid VAT registration number. The Company does not accept private individuals as customers. The Customer is responsible for ensuring that the information provided, including VAT number, is accurate, complete and up to date. The Customer is also responsible for protecting its login credentials.
Payment of Customer Subscription
Fees shall be paid in advance via Mollie in accordance with the current price list. Listed prices are exclusive of VAT. For Swedish customers, 25% Swedish VAT is added at checkout. For other EU customers with a VAT number that the Company has been able to verify against the VIES register, reverse charge applies in accordance with applicable VAT legislation; if the VAT number cannot be verified, checkout is blocked until verification succeeds. In the event of late payment, the Company is entitled to charge late payment interest in accordance with the Swedish Interest Act (räntelagen).
Subscription and payment
The subscription runs on a rolling monthly or annual basis (depending on plan) with automatic renewal at the end of each billing period. The Customer may cancel at any time from the dashboard; the cancellation takes effect at the end of the current billing period and access to the Services remains available until then. After cancellation, the Customer's QR codes, designs, and scan history are retained but scans of the Customer's QR codes will return a 'subscription required' page until the Customer reactivates.
Procurement of Printed Materials on Behalf of the Customer
The Company provides, upon the Customer's express instruction, services relating to the ordering and procurement of printed materials. All such orders are placed exclusively on behalf of the Customer and in accordance with instructions provided by the Customer. The Customer bears full responsibility for ensuring that all specifications provided, including but not limited to material, format, print run and delivery address, are accurate and complete at the time of placing the order. The Company disclaims all liability for errors or deficiencies attributable to incomplete or incorrect instructions furnished by the Customer. All prices for printed materials quoted by the Company are exclusive of value added tax (VAT). Applicable VAT will be added and charged in accordance with the tax legislation in force from time to time.
Use of the Services
The Customer may not: • violate applicable law • attempt to circumvent security mechanisms • use the Services in a manner that causes overloading
Customer's IT environment
The Customer is responsible for the compatibility, security and function of its own IT environment.
Specifically regarding the QRGeno API
API access is included with the Enterprise plan and is made available as part of an enterprise engagement. The Company reserves the right to impose rate limits and other technical restrictions to protect the Service. Misuse may result in immediate suspension.
SLA and availability
The Company strives for high availability but does not guarantee uninterrupted operation. Planned maintenance shall be notified to the extent possible.
Support
Support is provided in accordance with the description published from time to time.
Restriction of access to the Services
The Company may restrict access in the event of a breach of the Agreement or a security risk.
Limitation of liability
The Company is only liable for direct damage. The Company is not liable for: • indirect damage • loss of data • loss of profit Maximum liability is limited to 12 months of fees.
Disclaimer for errors
The Services are provided "as is" without warranties.
Force Majeure
A party is not liable for events beyond its control.
Intellectual property rights
All rights belong to the Company.
Assignment
The Customer may not assign the Agreement without written approval.
Amendments
The Company may amend these Terms, their Appendices, the Privacy Policy and the Cookie Policy at any time. The current version of each document, with its date of last update, is published at qrgeno.com and applies from the date of publication. Material changes that affect the Customer's rights or obligations, including changes to prices, the Data Processing Agreement or the list of sub-processors, are notified by email to the Customer's registered address or in the dashboard at least thirty (30) days before they take effect, except where a shorter period is required by law, by a supervisory authority or to address a security risk. Continued use of the Services after a change has taken effect constitutes acceptance of the amended Terms. A Customer who does not accept a material change may terminate the Agreement before the change takes effect.
Notices
Shall be made in writing via email.
Invalidity
An invalid provision does not affect the remaining provisions.
Processing of personal data
Processing takes place in accordance with the GDPR, privacy policy and cookie policy.
Customer Data
The Customer is responsible for the lawfulness and accuracy of the data. This includes the Customer's choice to switch on storage of visitors' IP addresses for a QR code, which is off by default; the Customer must have a lawful basis for that processing before enabling it.
Storage of Customer Data
Takes place in accordance with the privacy policy and Appendix 1 (deletion and return of Customer Data when the Services end).
Confidentiality
The parties shall maintain confidentiality.
Contract period and termination
The Customer may cancel the subscription at any time from the dashboard. The cancellation takes effect at the end of the current billing period; no further charges will be made. The Company may terminate the Agreement with thirty (30) days' written notice, save in the event of material breach where immediate termination may apply. The Customer's administrator may also permanently delete the account at any time from the dashboard (Profile → Account → "Delete account"). Account deletion cancels any active subscription, anonymises account information, soft-deletes the QR codes owned by the account and deletes the Auth0 identity. Bookkeeping records that the Company is required by law to retain (e.g. under the Swedish Accounting Act) will be kept for the legally required period.
Dispute resolution and applicable law
Disputes shall be finally settled by the Arbitration Institute of the Stockholm Chamber of Commerce (SCC Arbitration Institute). Swedish law applies.
Data Processing Agreement
The Company acts as data processor. (See appendices below)
Appendices
Appendix 1 – Data Processing Instructions (harmonised with the privacy policy) Appendix 2 – Security Measures (ISO/IEC 27001-aligned) Appendix 3 – Sub-processors: • Amazon Web Services • Auth0 • Mollie • CloudPrinter • Sanity.io • Mailgun • Vercel • InnoCraft (Matomo Cloud) • MapTiler (map tiles) • OpenStreetMap Foundation (map tiles and geocoding of geofence addresses) Appendix 4 – Third Country Transfers: EU residency is the default; SCC + TIA apply where US-incorporated providers are involved (Vercel additionally under the EU-U.S. Data Privacy Framework); New Zealand (InnoCraft), Switzerland (MapTiler) and the United Kingdom (OpenStreetMap Foundation) are covered by adequacy decisions; printed materials delivered outside the EU/EEA are produced by a print partner in the destination country.
Order of precedence between documents
In the event of conflict between documents, the following order of precedence shall apply: 1. Data Processing Agreement 2. These Terms 3. Privacy Policy 4. Cookie Policy This Agreement has been drawn up in accordance with Swedish law and practice.
Appendix 1 – Data Processing Instructions
1. Purpose of processing The Company shall process personal data to provide the Services, including: • Operation of dynamic QR codes • Collection and management of impression data (scan analytics) • Analysis and statistics • Issuing vouchers and sending voucher emails to recipients designated by the Customer • Optional API functionality (QRGeno API, Enterprise plan) • Optional ordering of printed materials on behalf of the Customer 2. Categories of data subjects • Customer's users (administrators) • End users interacting with QR codes • Voucher recipients (e.g. the Customer's customers or employees) whose details the Customer provides • Recipients of printed materials (where the Customer has provided shipping data) 3. Categories of personal data • Pseudonymous visitor identifier (keyed hash of the end user's IP address and the Customer's account), recorded on every scan and gate submission • IP address — only for QR codes where the Customer has switched on visitor-IP storage; otherwise processed transiently during the scan and not stored • Technical information: the user-agent string as sent by the browser (which reveals browser, operating system and device type), the device category derived from it, the browser's language setting, and referrer • Geographic information derived from the IP address (country, city and region; city and region are shown to the Customer only on paid plans) • Account information for the Customer's administrators (name, email, company, VAT) • Voucher recipient details (name, email address) provided by the Customer • Shipping data for printed materials (where provided by the Customer) • Data that the Customer itself contributes 4. Nature of processing • Collection • Recording • Structuring • Storage • Pseudonymisation • Analysis • Erasure 5. Duration of processing Processing takes place for the duration of the Agreement and in accordance with the privacy policy and applicable law. Cancelling a subscription does not end the Agreement: the account and its Customer Data remain available for reactivation until the Customer deletes the account or the Agreement is otherwise terminated. 6. Instructions Processing takes place only in accordance with: • These instructions • The Customer's documented instructions • Applicable law The per-QR-code setting "Store visitor IP addresses" is a documented instruction from the Customer. Switching it off instructs the Company to erase the IP addresses stored for that QR code, which is carried out when the setting is saved. 7. Sub-processors The Company may engage sub-processors in accordance with Article 28 GDPR. The current list is set out in Appendix 3. 8. Deletion and return of Customer Data when the Services end When the Agreement ends, the Company shall, at the Customer's choice, return Customer Data to the Customer and/or delete it. The Customer can export its QR codes and voucher recipients from the dashboard, and gate submissions on the Enterprise plan; the Company returns other Customer Data in a machine-readable format on request. Unless the Customer instructs earlier deletion, Customer Data is retained for up to twelve (12) months after the Agreement ends, so that the Customer can reactivate or request return, and is then deleted. Deleting the account from the dashboard counts as the Customer's instruction to delete: account information is anonymised and voucher recipient details are erased immediately, and remaining Customer Data (scan data and gate submissions) is deleted within the same twelve (12) months. Data that the Company is required by law to retain, such as bookkeeping records, is kept for the legally required period and for no other purpose. The Company ensures that its sub-processors delete the data correspondingly.
Appendix 2 – Security Measures
1. Access control • Least privilege • Secure authentication (MFA) 2. Encryption • TLS (data in transit) • Encryption at rest where applicable 3. Logging and monitoring • Logging of system access • Monitoring of security events 4. Vulnerability management • Regular security reviews • Patching and scanning 5. Backup and recovery • Regular backups • Disaster recovery processes 6. Incident management • Incident detection • Reporting without undue delay 7. Organisational measures • Internal security policies • Staff training • Confidentiality commitments 8. Pseudonymisation and data minimisation • End users' IP addresses are replaced by a keyed pseudonymous identifier by default; raw addresses are stored only on the Customer's per-QR-code instruction • Stored addresses are erased when the Customer withdraws that instruction Measures are continuously adapted according to risk and standards such as ISO/IEC 27001.
Appendix 3 – Sub-processors
Suppliers • Amazon Web Services EMEA SARL (AWS) – Infrastructure, application hosting, database and file storage. Region: eu-north-1 (Stockholm); backups and server logs remain in the region. AWS CloudFront terminates API and QR-scan traffic at edge locations in Europe, North America and Israel without retaining access logs. • Auth0, Inc. (Okta group) – Authentication and identity. EU region (Germany, with failover in Ireland). • Mollie B.V. – Payment processing. Headquartered in the Netherlands (EU). • Cloudprinter.com B.V. – Print production and fulfilment for printed materials ordered through the Services. Registered in Barendrecht, the Netherlands (EU), no. 63851636. Each order is routed to a print partner in or near the delivery country, which receives the delivery name and address and the print file. • Sanity.io – Content delivery for marketing pages, legal pages, and the product catalog. EU region (Belgium). • Mailgun (Sinch Email) – Transactional email for account messages, the contact form and voucher emails sent to recipients designated by the Customer. EU region (Mailgun EU API). Personal data processed: recipient name and email address. • Vercel Inc. – Hosting and global edge delivery for the public website and web app. Headquartered in the United States; pages are served from regional edge locations including the EU, and request logs are processed in the United States. Covered by Vercel's Data Processing Addendum (2021 SCC) and its EU-U.S. Data Privacy Framework certification. No Customer Data is stored on Vercel. • InnoCraft Ltd (Matomo Cloud) – Privacy-friendly web analytics for the public website, hosted on servers in Germany (EU). Incorporated in New Zealand, which is covered by a European Commission adequacy decision. Loaded only with the visitor's consent and never on QR-code (impression) pages. Personal data processed: anonymised IP address, pages viewed, referrer, device/browser type. • MapTiler AG – Map tiles for the landing page of location (geo) QR codes and the QR builder's map picker. Incorporated in Switzerland (adequacy decision); personal data processed in France and Ireland, tiles served from a global CDN. Personal data processed: visitor IP address and User-Agent on tile fetch. • OpenStreetMap Foundation – Map tiles for the same pages, loaded by the visitor's browser (tile servers in the United Kingdom and the EU), and the Nominatim geocoding service, which converts the address a Customer enters in a geofence rule into coordinates (sent from the Company's server). Incorporated in the United Kingdom, which is covered by a European Commission adequacy decision. Personal data processed: visitor IP address and User-Agent on tile fetch; the address text of a geofence rule. Terms • All sub-processors are bound by Article 28 GDPR data processing agreements. • The Company is responsible for compliance. Changes The Company may update the list and will inform the Customer of material changes.
Appendix 4 – Transfer to Third Countries (EU – USA)
1. Legal basis • Standard Contractual Clauses (SCC) where applicable • Adequacy decisions where applicable 2. Default residency The Company configures all sub-processors to use EU regions wherever offered (AWS eu-north-1, Auth0 EU region, Mollie NL, CloudPrinter EU, Sanity EU/Belgium, Mailgun EU, Matomo Cloud on servers in Germany). Customer Data is stored and processed within the EU/EEA under normal operation; backups and server logs remain in the same region. Two exceptions follow from how the Services are delivered: (a) API and QR-scan traffic from visitors outside Europe is terminated at AWS CloudFront edge locations in North America or Israel before reaching Stockholm, without any data being retained there; and (b) printed materials delivered outside the EU/EEA are produced by a CloudPrinter print partner in or near the destination country, which receives the delivery details for that order. The public website is delivered via Vercel's global edge network; visitors are served from the nearest edge location and Vercel processes request logs in the United States (see section 4). 3. Safeguards • Encryption at rest and in transit • Restricted access (least privilege) • Technical and organisational controls 4. Sub-processors with US presence Where a sub-processor's parent company is incorporated in the United States (e.g. AWS, Auth0/Okta, Vercel Inc.), data residency in the EU is contractually required wherever offered and the SCC plus a Transfer Impact Assessment (TIA) apply. Vercel Inc. serves the public website from regional edge locations and processes request metadata (IP address, requested URL, browser type) in the United States under its Data Processing Addendum, which incorporates the 2021 SCC, and its certification under the EU-U.S. Data Privacy Framework; user content (account, QR codes, scan logs) is not stored on Vercel. Fonts are served from the Company's own domain; no personal data is transferred to Google LLC. 5. Sub-processors in adequacy countries InnoCraft Ltd (Matomo Cloud) is incorporated in New Zealand, MapTiler AG in Switzerland and the OpenStreetMap Foundation in the United Kingdom; all three countries benefit from a European Commission adequacy decision under Article 45 GDPR, so transfers do not require SCC. Matomo Cloud data is in any case hosted in Germany, and Matomo is loaded only with the visitor's consent. MapTiler processes personal data in France and Ireland. The OpenStreetMap Foundation receives the visitor's IP address when map tiles are loaded and the address text of a geofence rule when it is geocoded. 6. Protection of data subjects The Company ensures that the rights of data subjects under the GDPR are upheld. Final provision These appendices form an integral part of the Data Processing Agreement and thereby of the General Terms and Conditions for Paperphyte AB.