Privacy Notice

Last updated 21 October 2026

CHECQR SERVICE PRIVACY NOTICE

Last updated: 21 October 2026

INTRODUCTION
ChecQR operates a service, made available on our website and application at https://checqr.net and it’s subdomains, which is a business-to-business service allowing businesses to digitise record keeping processes (the “ChecQR Service”).
This privacy notice sets out how ChecQR (“we”, “our” or “us”) collect, store, process, transfer, share and use data that identifies or is associated with you ("personal data") when you access and browse the ChecQR Service.
If you have any questions about this privacy notice or how we use your personal data, please contact us using the details in paragraph 2 below.
WHO IS RESPONSIBLE FOR YOUR PERSONAL DATA?
Where ChecQR collects information directly from you, for example when you use the ChecQR website and/or application, ChecQR is the data controller of the personal data that we hold about you and use as set out in this privacy notice. This means that we determine and are responsible for how your personal data is used.
Where ChecQR acts on behalf of and processes the personal data we receive from our business client (the controller), ChecQR is the data processor of the personal data that we hold about you and use as set out in this privacy notice.
If you have any questions, comments and requests regarding this privacy notice or how we use your personal data, please email privacy@checqr.net.
PERSONAL DATA WE COLLECT ABOUT YOU AND HOW WE USE IT
We collect personal data when you use the ChecQR Service. This can include information you provide to us when you make a request on the ChecQR Service, correspond with us by phone, e-mail or otherwise, subscribe for our marketing communications, or use some other feature of the ChecQR Service.
Like all online services, we also collect certain personal data about you automatically when you use the ChecQR Service in order to understand how the ChecQR Service is used and how we can improve it, as well as to tailor the adverts you see online to your interests.
We have set out the categories of personal data we collect and how we use them in detail below.
Personal data you provide to us
We will collect the following information when you communicate with us, or when you set up or update an account on the ChecQR Service. We will indicate to you if the provision of certain personal data is mandatory or optional. If you choose not to provide any personal data marked as mandatory, we may not be able to respond to your queries or provide other services to you or respond to your other requests.
Category of personal data
How we may use it

Legal basis for the processing

Contact information, such as your first name, last name, email address, telephone number. (mandatory)
We use this information to set up and authenticate your account.
The processing is necessary for our legitimate interests, namely facilitating the contract with the data controller (our business client) and delivering the CheckQR Service.
We use this information to send service-related communications.
The processing is necessary for our legitimate interests, namely delivering the CheckQR Service.
We use this information to request feedback from you about the ChecQR Service.
We will only process your personal data in this way to the extent that you have given us your consent to do so.
We use this information to provide updates, news alerts and promotional materials in relation to the ChecQR Service.
We will only process your personal data in this way to the extent that you have given us your consent to do so.
Account information, including account password. (mandatory)
We use this information to authenticate you when using the ChecQR Service and to allow you to log into your account on the website [or application].
The processing is necessary for our legitimate interests, namely delivering the ChecQR Service.
Payment information, including card number, name on card, expiration date of card, CCV number, billing address. (mandatory)
We use this information to process payments required to set up your account in order to use the ChecQR Service.
The processing is necessary for our legitimate interests, namely delivering the ChecQR Service.
We use this information to ensure the security and integrity of the ChecQR Service, including identifying and preventing unlawful, fraudulent, or malicious use of the ChecQR Service.
The processing is necessary for our legitimate interests, namely identifying and mitigating the risk of unlawful behaviour to protect the ChecQR Service, ChecQR and users.
Location information, including GPS coordinates and location address when on-site and uploading records using the ChecQR Service.
We use this information to enhance the ChecQR Service by connecting records uploaded to a specific business location.
This processing is necessary for our legitimate interest, namely delivering the ChecQR Service.
Your preferences, such as preferences set for notifications, marketing communications. (optional)
We use this information to ensure that we only send marketing communications to you in accordance with your preferences.
The processing is necessary to comply with a legal obligation that we are subject to (Privacy and Electronic Communications (EC Directive) Regulations 2003).
Correspondence, comments and feedback, either when you contact us directly, e.g., by email or phone, we will record your comments and opinions, or when we request feedback from you about the ChecQR Service. (optional)
We use this information to respond to your requests, including:
directing your questions to the appropriate team members; and
investigating and addressing any concerns.
The processing is necessary for our legitimate interests, namely, to respond to and appropriately investigate your request.
We use any feedback you provide to us in this way to improve the ChecQR Service.
The processing is necessary for our legitimate interests, namely identifying ways in which we can improve the ChecQR Service.
We may use any feedback you provide to us in this way in advertising on our website and in our marketing materials.
We will only process your personal data in this way to the extent that you have given us your consent to do so.

Personal data we collect about you automatically
We also automatically collect personal data indirectly about how you access and use the ChecQR Service, and information about the device you use to access the ChecQR Service.
We typically collect this information through a variety of tracking technologies, including cookies and similar technologies. For more information about how we collect personal data using cookies and similar technologies, and how you can control our use of cookies and similar technologies, please refer to our Cookie Notice.
We will collect the following information in this way:
Category of personal data
How we may use it
Legal basis for the processing

Device information, for example IP address, device name, device model, device identifier (UDID, Android Device ID), screen size and resolution, operating system, device region, time zone, country code, battery level/state and (for web access) browser type, version and window size.

We use this information to provide you with the functionalities of the website on your device including ensuring that the ChecQR Service is properly displayed on your device.
The processing is necessary for our legitimate interests, namely facilitating the contract with the data controller (our business client) and delivering the CheckQR Service.
We use this information to ensure the security and integrity of the ChecQR Service, including identifying and preventing unlawful, fraudulent, or malicious use of the ChecQR Service.
Legitimate interests, namely identifying and mitigating the risk of unlawful behaviour to protect the ChecQR Service, ChecQR and users
We use this information to monitor the performance of the ChecQR Service in order to identify and fix errors and identify ways in which we can improve the ChecQR Service.
We will only process your personal data in this way to the extent that you have given us your consent to do so.
Information about how you access and use the ChecQR Service, for example, the date and time you accessed the website, how long you accessed it for, actions you took on the website (pages viewed, length of time on each page).
We use this information to provide you with the functionalities of the website on your device including ensuring that the ChecQR Service is properly displayed on your device.
The processing is necessary for our legitimate interests, namely facilitating the contract with the data controller (our business client) and delivering the CheckQR Service.
We use this information to ensure the security and integrity of the ChecQR Service, including identifying and preventing unlawful, fraudulent, or malicious use of the ChecQR Service.
Legitimate interests, namely identifying and mitigating the risk of unlawful behaviour to protect the ChecQR Service, ChecQR and users
We use this information to monitor the performance of the ChecQR Service in order to identify and fix errors and identify ways in which we can improve the ChecQR Service.
We will only process your personal data in this way to the extent that you have given us your consent to do so.

HOW LONG WE KEEP YOUR PERSONAL DATA
Where ChecQR acts as data controller, we will store the personal data we collect for as long as we require this to provide the ChecQR Service and for a period of 6 years afterwards. Any personal data processed by ChecQR as data processor, will be returned to the data controller or deleted at the end of our contract with the data controller.
[Where you have subscribed to receive marketing correspondence from us, we will keep personal data for as long as you have consented to receiving marketing from us.]
To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and the applicable legal requirements.
RECIPIENTS
As required in accordance with how we use your personal data, we may share your personal data with the following:
Recipient
Why we share it and how they will use it
Lawful basis
Service providers, such as providers of web hosting, logistics service providers, or other technical services such as analytics services, or communication services.

These third-party vendors and other service providers perform services for us or on our behalf.
We may share your: contact information, account information, your preferences and your correspondence, comments and feedback.
These service providers will use your personal data as processors on our instructions.
Advisors, such as legal advisors or accountants.

Our advisors may need to access personal data in order to develop and provide their advice to us or otherwise perform their services.
These recipients will use your personal data in accordance with their own privacy policies, but in a manner consistent with this privacy notice.
The lawful basis we rely on for sharing personal data in this way is that it is necessary for our legitimate interests, namely receiving professional legal, financial and accountancy advice. In some instances sharing personal data in this way may also be necessary to comply with a legal obligation to which we are subject.
Purchasers and third parties in connection with a business transaction. Your personal data may be disclosed to third parties in connection with a transaction, such as a merger, sale of assets or shares, reorganisation, financing, change of control or acquisition of all or a portion of our business.
These recipients will use your personal data to assess the potential transaction with us, and otherwise only as disclosed in this privacy notice.
The lawful basis we rely on for transferring this personal data is that the processing is necessary for our and the third party's legitimate interests, namely assessing and executing a potential transaction with us.

Law enforcement, regulators and other parties for legal reasons. We may share your personal information with third parties as required by law or if we reasonably believe that such action is necessary to (i) comply with the law and the reasonable requests of law enforcement; (ii) detect and investigate illegal activities and breaches of agreements; and/or (iii) exercise or protect the rights, property, or personal safety of ChecQR, its users or others.
These recipients will use your personal data in the performance of their regulatory or law enforcement role, or to advise us in connection with a potential claim or regulatory enforcement action.

The lawful basis we rely on for sharing personal data with these recipients is that the processing is either necessary to comply with a legal obligation to which we are subject or is necessary for our legitimate interests, namely enforcing our rights or complying with requests from regulatory authorities.

EMAIL MARKETING
From time to time we may contact you with information about our products and services, including sending you marketing messages and asking for your feedback on our products and services.
Our marketing messages will be sent by email. For some marketing messages, we may use personal data we collect about you to help us determine the most relevant marketing information to share with you.
We will only send you marketing messages if you have given us your consent to do so. You can withdraw your consent at a later date by clicking on the unsubscribe link in the footer of our marketing emails or by contacting us at [●]. We make every effort to promptly process all unsubscribe requests. You may not opt out of service-related communications (e.g., account verification, transactional communications, technical and security notices).]
STORING AND TRANSFERRING YOUR PERSONAL DATA
Security. We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, change or damage. All personal data we collect will be stored on our secure servers. We will never send you unsolicited emails or contact you by phone requesting your account ID, password, credit or debit card information or national identification numbers.
International Transfers of your personal data. The personal data we collect may be transferred to and stored in countries outside of the jurisdiction you are in where we and our third-party service providers have operations. If you are located in the UK, your personal data may be processed outside of the UK. These international transfers of your personal data will be made pursuant to appropriate safeguards, including:
ensuring that the personal data is transferred to countries recognised by the UK Secretary of State as offering an equivalent level of protection; or
ensuring that such transfer is to a third party who uses appropriate safeguards in respect of the processing in question, including but not limited to the UK standard contractual clauses, which are recognised as offering adequate protection for the rights and freedoms of data subjects, as determined by the UK Secretary of State (as applicable).
We may transfer your personal data to, or store your personal data in, the following countries:
Country / territory
Appropriate Safeguard
[●]
[●]
[●]
[●]

We will take appropriate steps to ensure that your personal data is treated securely and in accordance with applicable law and this privacy notice regardless of where it is processed.
If you wish to enquire further about the safeguards we use, please contact us using the details set out at the end of this privacy notice.
YOUR RIGHTS IN RESPECT OF YOUR PERSONAL DATA
In accordance with applicable privacy laws, you have the following rights in respect of your personal data that we hold:
Right of access. You have the right to obtain:
confirmation of whether, and where, we are processing your personal data;
information about the categories of personal data we are processing, the purposes for which we process your personal data and information as to how we determine applicable retention periods;
information about the categories of recipients with whom we may share your personal data; and
a copy of the personal data we hold about you.
Right of portability. You have the right, in certain circumstances, to receive a copy of the personal data you have provided to us in a structured, commonly used, machine-readable format that supports re-use, or to request the transfer of your personal data to another person.
Right to rectification. You have the right to obtain rectification of any inaccurate or incomplete personal data we hold about you without undue delay.
Right to erasure. You have the right, in some circumstances, to require us to erase your personal data without undue delay if the continued processing of that personal data is not justified.
Right to restriction. You have the right, in some circumstances, to require us to limit the purposes for which we process your personal data if the continued processing of the personal data in this way is not justified, such as where the accuracy of the personal data is contested by you.
Right to withdraw consent. Where we rely on your consent for processing your personal information, you have the right to withdraw your consent. Withdrawal of your consent will not affect the lawfulness of the processing of your personal information before you withdrew your consent.
You have a right to object to any processing based on our legitimate interests. There may, depending on the particular circumstances, be compelling reasons for continuing to process your personal data despite your objection, and we will assess and inform you if that is the case. You can object to marketing activities for any reason.
If you wish to exercise one of these rights, please contact us using the contact details at the end of this privacy notice.
We will not charge you a fee for complying with your request to exercise one of these rights, other than where the request is manifestly unfounded or excessive (such as if you submit a number of repeated requests), in which case we may charge you a reasonable fee to cover our administrative costs.
You also have the right to lodge a complaint to your local data protection authority. Information about how to contact the Information Commissioner's Office is available here.
LINKS TO THIRD PARTY SITES
The ChecQR Service may, from time to time, contain links to and from third party websites, including those of our partners, advertisers, news publications, social media platforms and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for their policies. Please check the individual policies before you submit any information to those websites.
OUR POLICY TOWARDS CHILDREN
The ChecQR Service is not directed at persons under 18 and we do not knowingly collect personal data from children under 18. If you become aware that your child has provided us with personal data, without your consent, then please contact us using the details below so that we can take steps to remove such information as quickly as possible.
CHANGES TO THIS NOTICE
We may update this privacy notice from time to time and so you should review this page periodically. When we change this privacy notice in a material way, we will update the "last modified" date at the end of this privacy notice. Changes to this privacy notice are effective when they are posted on this page.
NOTICE TO YOU
If we need to provide you with information about something, whether for legal, marketing or other business-related purposes, we will select what we believe is the best way to get in contact with you. We will usually do this through email or by placing a notice on the ChecQR Service.