Privacy Data Request

Use this form to request access, deletion, or correction of your personal data under applicable privacy laws.

Your Privacy Rights

Access Your Data

Request a copy of all personal data we have collected about you, including how it's used and shared.

Delete Your Data

Request permanent deletion of your personal data from our systems, subject to legal requirements.

Correct Your Data

Request updates to inaccurate or incomplete personal information we have about you.

Withdraw Consent

Withdraw your consent for data processing activities where consent is the legal basis.

Submit Your Request

What to Expect

  • • We'll respond to your request within 30 days
  • • You may need to provide additional verification
  • • Some requests may be subject to legal limitations
  • • We'll notify you if we need more time to process your request

Compliance Overview

QRTRAC processes personal data in compliance with the General Data Protection Regulation (GDPR) for users in the European Economic Area and the California Consumer Privacy Act and its amendment (CCPA/CPRA) for California residents. Below is a summary of your rights under each framework.

EU/UK GDPR Rights

  • Right to Access (Art. 15): Request a copy of all personal data we hold about you and information on how it is processed.
  • Right to Erasure (Art. 17): Request deletion of your personal data where there is no overriding legal basis for continued processing.
  • Right to Rectification (Art. 16): Request correction of inaccurate or incomplete personal data.
  • Right to Portability (Art. 20): Receive your personal data in a structured, machine-readable format (JSON/CSV) for transfer to another service.
  • Right to Object (Art. 21): Object to processing based on legitimate interests, including profiling and direct marketing.
  • Right to Restrict Processing (Art. 18): Request that we limit how we use your data while a dispute is being resolved.

CA CCPA / CPRA Rights

  • Right to Know: Request disclosure of the categories and specific pieces of personal information collected, the business purpose, and third parties with whom it is shared.
  • Right to Delete: Request deletion of personal information, subject to exceptions for completing transactions or legal compliance.
  • Right to Correct: Request correction of inaccurate personal information maintained about you.
  • Right to Opt-Out of Sale/Sharing: Direct us not to sell or share your personal information with third parties for cross-context behavioral advertising.
  • Right to Limit Sensitive PI Use: Restrict use of sensitive personal information to necessary business purposes only.
  • Right to Non-Discrimination: We will not deny services, charge different prices, or provide a different level of service if you exercise your privacy rights.

Data Retention & Processing Policy

QRTRAC retains personal data only for as long as necessary to fulfil the purposes for which it was collected, comply with legal obligations, or resolve disputes. Here is how different categories of data are handled:

Data Category Retention Period Processing Basis
Account & Profile Data Duration of account + 30 days post-deletion Contract performance
QR Scan Analytics 24 months rolling window Legitimate interest / Contract
Payment & Billing Records 7 years (tax & legal compliance) Legal obligation
IP Address Logs (Security) 90 days Legitimate interest (security)
GPS / Precise Location Aggregated only; raw coordinates not stored Explicit consent
Support & Communications 3 years from last interaction Legitimate interest
Encryption & Anonymisation: All personal data at rest is encrypted using AES-256. Scan analytics are pseudonymised by hashing IP addresses before storage. Raw GPS coordinates, when collected under user consent, are converted to city-level aggregate data within 24 hours and the raw coordinates are discarded. Data is never sold to third-party advertisers.

Identity Verification & Response Timeline

To protect your data from fraudulent access or deletion requests, QRTRAC follows a multi-step identity verification process before fulfilling any data request.

1

Submit the Request Form

Use the form above to describe your request type (access, deletion, correction, or opt-out) and provide the email address associated with your QRTRAC account. Unverified requestors without an associated account must provide their name and a description of how they interacted with our service.

2

Email Verification (within 48 hours)

We will send a verification link to the email address provided. Clicking this link confirms that you control the inbox associated with the request. This step prevents third parties from submitting fraudulent deletion requests on your behalf.

3

Additional Verification for Sensitive Requests

For account deletion or data portability requests, we may require you to log in to your QRTRAC account to confirm ownership, or provide the last four digits of the billing card on file. Enterprise accounts with SAML SSO will be verified through their IdP session.

4

Fulfilment (within 30 days)

Once verification is complete, we will fulfil your request within 30 calendar days (as required by GDPR) or 45 calendar days (as required by CCPA). For complex requests we may extend by an additional 30–45 days and will notify you in writing. Access and portability responses will be delivered as a downloadable JSON or CSV file via a secure link.

Need immediate assistance? Contact our privacy team

Contact Support