GDPR — General Data Protection Regulation

This page explains, in one place, how Roman Sadoev (operator of WebQR.io, the "Service") complies with the EU General Data Protection Regulation (GDPR) when processing personal data of users located in the European Union, the European Economic Area and the United Kingdom. It complements, and does not replace, our full Privacy Policy.

1. Data Controller

Roman Sadoev acts as the data controller for personal data processed through the Service. You can contact us regarding any data protection matter at [email protected].

2. Legal Bases for Processing

We only process personal data when we have a valid legal basis under Article 6 GDPR:

• Contract — to create your account, generate QR codes and provide the features of your plan.
• Consent — for analytics and advertising cookies, which are off by default for EU/EEA/UK visitors until you actively opt in via the cookie banner or preference center.
• Legitimate interest — for essential security, fraud prevention and service-reliability processing that does not rely on non-essential cookies.
• Legal obligation — for tax, accounting and law-enforcement requests.

3. Your Rights as a Data Subject

Under the GDPR, you have the following rights over your personal data:

• Right of access — to receive a copy of your personal data.
• Right to rectification — to request correction of inaccurate data.
• Right to erasure — to request deletion of data ("right to be forgotten").
• Right to restriction of processing — to limit how your data is used.
• Right to data portability — to receive your data in a machine-readable format.
• Right to object — to object to processing based on legitimate interests, including direct marketing.
• Right to withdraw consent — at any time, without affecting the lawfulness of processing prior to withdrawal.
• Right to lodge a complaint — with the data protection supervisory authority in your country.

To exercise any of these rights, contact us at [email protected]. We respond within 30 days. You can also export your account data at any time from your account settings, in JSON format.

4. Data Protection by Design and by Default

We built our consent management platform in-house rather than relying on a default "accept all" pattern: for visitors from the EU/EEA/UK, analytics and advertising cookies stay off until you actively consent (opt-in by design); we collect basic cookieless web statistics on public pages regardless of consent; we detect the Global Privacy Control (GPC) signal and automatically treat it as an opt-out request for advertising; and every consent decision is logged on our servers (region, categories, method and timestamp) as evidence of compliance.

5. International Data Transfers

Roman Sadoev is based in Georgia. Where personal data of EU/EEA/UK residents is transferred outside the EU/EEA/UK, we rely on one of the following safeguards:

• Standard Contractual Clauses (SCCs) approved by the European Commission, where applicable to a given processor.
• Adequacy decisions, where the destination country is recognised by the European Commission as providing an adequate level of data protection.
• Service providers who process data solely on our instructions and are contractually bound to protect it to GDPR standards.

For full details on the specific third parties we use and the data we collect, see our Privacy Policy.

6. Data Breach Notification

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, and inform affected users without undue delay, in accordance with Articles 33–34 GDPR.

7. Supervisory Authority and Contact

If you believe we have not addressed your concerns adequately, you have the right to lodge a complaint with the data protection supervisory authority in your country of residence within the EU/EEA/UK. For any GDPR-related question, please contact us first so we can try to resolve it directly:

• Email: [email protected]