Question 1

Is there a GDPR-compliant QR code generator?

Accepted Answer

No product is compliant by itself, because compliance depends on your purposes and lawful basis. What you can look for is a platform that minimises collection, stores data in the EU, publishes its sub-processors and will sign a DPA. Scanduro records six fields per scan, stores them in Amsterdam, discards the IP address after a local country lookup, sets no cookie on the redirect path, and provides a DPA.

Question 2

Do QR code scans need cookie consent?

Accepted Answer

It depends on what the platform does when the code is scanned. If it sets a cookie or assigns an identifier, you are into consent territory under the ePrivacy rules as implemented in your country. Scanduro's redirect path sets no cookies and uses no browser storage.

Question 3

Where is scan data stored?

Accepted Answer

Hosting and the managed database run in the Amsterdam (AMS3) region, so account data and scan events are stored in the EU.

Question 4

Is the IP address of a scanner stored?

Accepted Answer

No. It is matched against a country database on our own servers to derive a country, then discarded. It is not written into the scan event and not sent to any third party. IP addresses are hashed where needed for velocity capping and de-duplication.

Question 5

Are you the controller or the processor?

Accepted Answer

Both, in different respects. Processor for the codes and destinations you configure. Controller in our own right for scan analytics, because we reuse scan events for abuse prevention, destination screening and service integrity, which are purposes we determine.

Question 6

Are you ISO 27001 or SOC 2 certified?

Accepted Answer

No. We hold no certifications and publish no third-party audit reports. What we publish instead is our architecture, our sub-processor list, our retention periods and our technical and organisational measures.

Question 7

How long do you keep scan data?

Accepted Answer

Scan events are retained for 12 months on Free and Starter and 24 months on Pro and above. Slug-to-destination mappings are kept while the redirect exists, because keeping printed codes working is the service. Billing records are kept for 7 years under Netherlands tax law.

QR codes and GDPR: EU hosting, no scan cookies