Privacy policy for the “qrmacher” app

1) Information on the collection of personal data and contact details of the controller

1.1 We are glad that you are using our application “qrmacher” (hereinafter “app”). Below we inform you about how your personal data is handled when you use our app. Personal data here means all data by which you can be personally identified.

1.2 The controller for data processing in connection with this app within the meaning of the General Data Protection Regulation (GDPR) is Jochen Kächelin, Messelbergstr. 8, 73066 Uhingen, Germany, phone +49 (0)7161 5071373, email info@jochenk.com. The controller for the processing of personal data is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

1.3 The app creates QR codes exclusively on your device. It does not connect to our servers or to third-party servers, requires no user account and contains no analytics, tracking or advertising services. We therefore receive no personal data from you through your use of the app.

2) Downloading and using the app

Downloading the app

When you download our mobile app from an app store, the required information is transferred to the app store. This includes in particular the user name, email address and customer number of your store account, the time of the download, payment information and an individual device identifier. We have no influence on this data collection and are not responsible for it. We only process the data insofar as this is necessary for downloading the mobile app to your mobile device.

Using the app

We do not collect or store any personal data when you use the app. What you enter in the app (for example links, texts, Wi-Fi credentials, contact details or bank details) is processed only on your device in order to generate the QR code from it. Your entries are not transmitted to us or to third parties and are not stored permanently by the app. No log files arise on our side, because the app does not connect to our servers.

Crash reports and statistics from Apple

If you have agreed in your device settings to share analytics data with app developers, Apple provides us with crash reports and usage statistics for the app. Apple collects this data under its own responsibility; we only receive it in aggregated form or without details that identify you personally. You can withdraw your consent at any time in your device settings under “Privacy & Security” → “Analytics & Improvements”.

3) No servers, no disclosure; sharing and links

We do not operate any servers of our own for the app and do not use any hosting or content delivery services. The app does not transfer your data to processors.

Sharing and saving

If you pass on or save a QR code using your device’s share function, you decide yourself where it goes (for example to a messaging app, to “Files” or to “Photos”). We receive no data in the process. Processing by the app you choose is governed by its own privacy terms.

Links to our website

The app contains links to our website qrmacher.de (for example the guide and the legal notice). These open in your browser outside the app. The website is governed by its own privacy policy at https://qrmacher.de/en/datenschutz.

4) Use of your photos

The app accesses your photos in only two cases, and only when you trigger this yourself:

• Adding a logo: You choose an image using your device’s photo picker. The app receives only this one image and no access to the rest of your library; no permission is needed for this. The image is processed only on your device and is not stored permanently.
• Saving to Photos: The first time you save a QR code, your device asks whether the app may add images to your photos. With this permission the app can only add images, not view them. If you do not grant the permission, you can still save the QR code using the share function. You can grant or withdraw the permission at any time in your device settings.

The app does not use your contacts, calendar or reminders.

The legal basis for processing the data is Art. 6(1)(b) GDPR insofar as the processing is necessary for a function you use, otherwise your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. You can withdraw your consent at any time with effect for the future.

5) Contacting us

When you contact us (e.g. by email), personal data is collected. This data is stored and used exclusively for the purpose of answering your enquiry, or for making contact and the associated technical administration. The legal basis for processing this data is our legitimate interest in answering your enquiry pursuant to Art. 6(1)(f) GDPR. If your contact is aimed at concluding a contract, Art. 6(1)(b) GDPR is an additional legal basis. Your data is deleted once your enquiry has been dealt with conclusively. This is the case when it can be inferred from the circumstances that the matter has been finally clarified, provided no statutory retention obligations apply.

6) Rights of the data subject

6.1 Applicable data protection law grants you comprehensive data subject rights (rights to information and intervention) vis-à-vis the controller with regard to the processing of your personal data, about which we inform you below:

• Right of access pursuant to Art. 15 GDPR: In particular, you have the right to information about your personal data processed by us, the purposes of processing, the categories of personal data processed, the recipients or categories of recipients to whom your data has been or will be disclosed, the planned storage period or the criteria for determining the storage period, the existence of a right to rectification, erasure, restriction of processing or objection to processing, the right to lodge a complaint with a supervisory authority, the origin of your data if it was not collected from you by us, the existence of automated decision-making including profiling and, where applicable, meaningful information about the logic involved and the scope and intended effects of such processing concerning you, as well as your right to be informed about the safeguards pursuant to Art. 46 GDPR when your data is transferred to third countries;
• Right to rectification pursuant to Art. 16 GDPR: You have the right to the immediate rectification of incorrect data concerning you and/or the completion of incomplete data stored by us;
• Right to erasure pursuant to Art. 17 GDPR: You have the right to request the erasure of your personal data if the conditions of Art. 17(1) GDPR are met. However, this right does not apply in particular if the processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defence of legal claims;
• Right to restriction of processing pursuant to Art. 18 GDPR: You have the right to request the restriction of the processing of your personal data for as long as the accuracy of your data, which you contest, is being verified; if you refuse the erasure of your data because of unlawful processing and request the restriction of its processing instead; if you need your data for the establishment, exercise or defence of legal claims after we no longer need it once the purpose has been achieved; or if you have objected on grounds relating to your particular situation, as long as it has not yet been determined whether our legitimate grounds prevail;
• Right to notification pursuant to Art. 19 GDPR: If you have asserted the right to rectification, erasure or restriction of processing against the controller, the controller is obliged to notify all recipients to whom the personal data concerning you has been disclosed of this rectification or erasure of the data or restriction of processing, unless this proves impossible or involves disproportionate effort. You have the right to be informed about these recipients.
• Right to data portability pursuant to Art. 20 GDPR: You have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format, or to request its transmission to another controller, insofar as this is technically feasible;
• Right to withdraw consent given pursuant to Art. 7(3) GDPR: You have the right to withdraw consent to the processing of data once given at any time with effect for the future. In the event of withdrawal, we will delete the data concerned without delay, unless further processing can be based on a legal basis for processing without consent. The withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of the consent until its withdrawal;
• Right to lodge a complaint pursuant to Art. 77 GDPR: If you consider that the processing of personal data concerning you infringes the GDPR, you have, without prejudice to any other administrative or judicial remedy, the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement.

6.2 Right to object

If, in the context of a balancing of interests, we process your personal data on the basis of our overriding legitimate interest, you have the right at any time to object to this processing with effect for the future on grounds relating to your particular situation.

If you exercise your right to object, we will end the processing of the data concerned. Further processing remains reserved, however, if we can demonstrate compelling legitimate grounds for the processing which override your interests, fundamental rights and freedoms, or if the processing serves the establishment, exercise or defence of legal claims.

If your personal data is processed by us for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for the purpose of such advertising. You may exercise the objection as described above.

If you exercise your right to object, we will end the processing of the data concerned for direct marketing purposes.

7) Duration of storage of personal data

The duration of storage of personal data is determined by the respective legal basis, the purpose of processing and, where relevant, additionally by the respective statutory retention period (e.g. retention periods under commercial and tax law).

Where personal data is processed on the basis of express consent pursuant to Art. 6(1)(a) GDPR, the data concerned is stored until you withdraw your consent.

Where statutory retention periods exist for data processed in the context of legal or quasi-legal obligations on the basis of Art. 6(1)(b) GDPR, this data is routinely deleted once the retention periods have expired, provided it is no longer required for the performance or initiation of a contract and/or we no longer have a legitimate interest in continuing to store it.

Where personal data is processed on the basis of Art. 6(1)(f) GDPR, this data is stored until you exercise your right to object under Art. 21(1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Where personal data is processed for direct marketing purposes on the basis of Art. 6(1)(f) GDPR, this data is stored until you exercise your right to object under Art. 21(2) GDPR.

Unless otherwise stated in the other information in this policy about specific processing situations, stored personal data is otherwise deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.