Data processing addendum

Parties and scope

This data processing addendum ("DPA") forms part of the agreement between ScanMosaic, United Kingdom ("we", the processor) and the business customer that uses ScanMosaic ("you", the controller), made up of our terms of service and this DPA. It applies when we process personal data for you as your processor under the UK GDPR, the EU GDPR or similar laws. It doesn't apply to the data we process as a controller for our own purposes, described in our privacy policy, such as your account and billing details.

You accept this DPA by using a paid plan for business purposes, or by asking us for a signed copy at [email protected].

Subject matter, duration, nature and purpose

We host your QR codes, short links, hosted pages and files, redirect people who scan or click them, count those visits, and provide the dashboard, reports and API. We process personal data only for as long as you use the service and for the deletion periods below.

Personal data and data subjects

• People who scan your codes or click your links: time, country and city (from the network, not GPS), device type, operating system, browser, language, referring site and a visitor key that changes every day. We don't store IP addresses or set cookies.
• People who fill in your hosted forms or feedback pages: whatever your form asks for.
• People named in your content: for example contact details in a digital business card, or files you upload.
• Your team: email addresses and roles of workspace members, and the activity log of their changes.

You must not use the service to collect special category data (such as health data) through hosted forms unless you have a lawful basis and have told us in writing.

Our obligations

• We process personal data only on your documented instructions: these terms, your settings and your use of the service. We tell you if we believe an instruction breaks data protection law.
• Everyone who can access your personal data is bound by confidentiality.
• We help you answer requests from people exercising their rights. Most can be handled in the dashboard: export, edit and delete codes, links, form responses and scan records.
• We help you with data protection impact assessments and consultations with supervisory authorities where they concern our service.

Security measures

• All traffic uses HTTPS (TLS). Data is stored with our hosting provider, which encrypts it at rest.
• No IP addresses are stored with scan records; rate limits and unique-visitor counts use keyed one-way hashes that can't be reversed.
• Passwordless sign-in with one-time codes; sessions are stored as one-way hashes and can be ended on every device.
• Role-based access in every workspace (owner, admin, editor, viewer), checked on the server for every request. API keys are workspace-scoped and stored hashed.
• Third-party secrets you give us, such as integration API secrets, are encrypted and never shown again.
• Destinations are checked against Google Web Risk; pages that show your users' content use a strict content security policy.
• Access to production systems is limited to the people who run the service.

Subprocessors

You authorise us to use the subprocessors listed on our subprocessors page. We bind each one by contract to data protection obligations at least as protective as this DPA, and remain responsible for them. We give at least 30 days' notice of a new subprocessor by email to the workspace owner. If you object on reasonable data protection grounds and we can't resolve it, you can end the affected service and we refund any prepaid fees for the remaining period.

International transfers

Some subprocessors process data outside the UK and the EEA. Where that happens we rely on an adequacy decision (including the EU-US Data Privacy Framework and the UK extension where the recipient is certified), or on the EU standard contractual clauses with the UK International Data Transfer Addendum, together with supplementary measures where needed.

Personal data breaches

We notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting your data. We tell you what happened, the data and people likely affected, the likely consequences and what we're doing about it, and update you as we learn more. We send the notice to the workspace owner's email address.

Deletion and return

You can download your data at any time from Privacy & data in the dashboard, and delete codes, links, files and responses whenever you like. Scan records are deleted automatically after 13 months. When you delete your account or workspace, or 30 days after your agreement ends, we delete your personal data from the live service, unless the law requires us to keep it. Backups held by our hosting provider are overwritten within 30 days after that.

Audits and information

We make available the information needed to show we comply with this DPA, including answers to reasonable security questionnaires once a year. Where that isn't enough, you may audit our compliance, once a year with at least 30 days' notice, during business hours, at your cost, under confidentiality, and without access to other customers' data. Audits of our subprocessors are covered by their own certifications and reports.

Liability and order of precedence

Each party's liability under this DPA is subject to the limits in our terms of service, except where the law doesn't allow it. If this DPA conflicts with the terms of service about personal data, this DPA applies. If the standard contractual clauses apply, they take precedence.

Contact

Questions about this DPA, or requests for a signed copy: [email protected].