Privacy Notice

This Privacy Notice provides information on the processing of your personal data on the website at www.qr2sku.com (hereinafter: the Website), in the following chapters:
 

 
1. General provisions
 
1.1. For the purposes of this Privacy Notice, a user or visitor of the Website qualifies as a data subject of the processing. The precise categories of data subjects are specified under each processing activity.

1.2. The Controller: QR2SKU UK LTD Company registration number: 17127302 Registered office: Unit A30 Red Scar Industrial Estate Longridge Road, Ribbleton, Preston, United Kingdom, PR2 5NA Contact: office@qr2sku.com Tax number: 17127302 Telephone: +36309958075 Registered by: Companies House, United Kingdom

"Controller" means the natural or legal person, public authority, agency or any other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may also be laid down by Union or Member State law.

1.3. It is the Controller's objective to ensure, to the fullest possible extent, the protection of the personal data of persons using the Website. This Privacy Notice applies exclusively in respect of the Website and does not apply to websites operated by third parties, even where such websites are directly accessible from the Website.

1.4. The Controller is entitled to amend the content of this Privacy Notice unilaterally at any time, of which it notifies the data subjects by email.

1.5. The Controller carries out its activities with due protection of the personality rights of its visitors and clients, in compliance with the applicable legislation, in particular with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, GDPR).

1.6. The provision of personal data on the Website is voluntary, and the data subject consents to processing based on voluntary consent simultaneously with accepting the terms of this Privacy Notice.

1.7. In the course of its activities, the Controller transfers personal data to processors as recipients solely for the purpose of, and to the extent necessary for, the performance of those activities. "Processor" means a natural or legal person, public authority, agency or any other body which processes personal data on behalf of the controller.

1.8. The personal data processed by us through the Website are stored at our hosting provider, which acts as a processor and is also our web developer: Webinform Consulting Online Produkciós Kft.; www.webinform.hu Activity: hosting services, web development. In the absence of the provision of the data, the Controller is unable to provide its service.

1.9. We use a service provider for payment systems: Name: Barion Payment Zrt. Details: www.barion.hu The cookie notice and privacy notice are available on the above website. Activity: provision of payment services. In the absence of the provision of the data, the Controller is unable to provide its service. This processing is necessary for the performance of the contract and its legal basis is provided by Article 6(1)(b) GDPR. Data transferred: the data requested and provided at payment.

1.10. Where the Controller is contacted by a court, a public prosecutor's office, an investigating authority, an authority acting in petty offence or administrative proceedings — including the authority responsible for personal data matters — or by other bodies authorised by law, with a view to the provision of information or the disclosure or transfer of data, the Controller shall make available to the requesting body those personal data that are strictly necessary for the achievement of the purpose of the request, provided that the requesting body specifies the precise purpose, legal basis and scope of the data, and shall notify the data subject thereof without delay.


2. Processing activities

2.1. Registration, profile, account data

2.1.1. The services associated with the use of the Website may be used only following registration. Registration requires the provision of personal data. In the absence thereof, no contract is concluded between the parties and the Controller is unable to provide its services to the data subject.

2.1.2. In the case of natural person Users, the legal basis of the processing is the performance of the contract, or the processing is necessary in order to take steps at the request of the data subject prior to entering into the contract [processing under Article 6(1)(b) GDPR].

2.1.3. The purpose of the processing is to enable the Controller to provide the services.

2.1.4. Categories of personal data processed: name (first name, surname); email address; password.

2.1.5. Duration of the processing: until deletion of the registered account, provided that we have no other legal basis for further processing as set out below.

2.1.6. We also use the contact details provided (email address, telephone number) to keep in touch with you for the purpose of performing the contract and to send you related notices, information and messages to your email address.

2.2. Data provided voluntarily on the Website

2.2.1. Duration of the processing: until deletion of the personal data (until deletion of the account, until the modification or deletion of the data appearing on the Website, or otherwise until deletion of the support channel or until modification affecting the personal data).

2.3. Invoicing

2.3.1. The Controller stores and processes the personal data appearing on the invoices issued by it.

2.3.2. The purpose of the processing is invoicing and compliance with accounting rules.

2.3.3. The legal basis of the processing is compliance with a legal obligation.

2.3.4. Categories of data processed: name, company name, address, email address, telephone number, tax identification number.

2.3.5. Duration of the processing: the statutory retention period, in principle 7 years.

2.4. Cookies

2.4.1. For the purpose of monitoring the Website, the Controller uses analytical tools ("cookies"), which generate a data flow and track how visitors use the web pages. When a page is viewed, the system generates a cookie and installs it on the visitor's computer in order to record information relating to the visit (the pages visited, the time spent on the Controller's pages, browsing data, etc.); these data, however, cannot be linked to the person of the visitor. This tool contributes to improving and developing the ergonomic design of the website and the online experience of visitors by creating a user-friendly website, and to preventing data loss. Cookies recognise the visitor's computer and process its IP address.

2.4.2. Most internet browsers accept cookies; visitors, however, have the option to delete them or to reject or allow them automatically. The visitor has the option to refuse the installation of cookies. As every browser is different, visitors may determine cookie settings individually using the browser's toolbar. Users may be unable to use certain functions of the Website if they choose not to accept cookies.

2.4.3. Through the use of cookies, the websites viewed by the visitor and the visitor's internet usage habits may be monitored. Only upon a repeated visit to the Website, and only by the service provider concerned, can these data be linked to the person of the visitor. The retention period of such data depends on the type of cookie. Session cookies delete the data upon closing the Website, whereas Flash cookies store the data until one year of inactivity.

2.4.4. In accordance with Article 6(1)(a) GDPR, the legal basis of the processing is the voluntary consent of the data subject (the visitor).

2.4.5. Categories of data processed: browsing history, identification number, date and time of the visit.

2.4.6. Purpose of the processing: improving the data subject's experience, storing the data of the current session, preventing data loss, identifying and tracking data subjects, web analytics.

2.4.7. The "Help" function found in the menu bar of most browsers provides information on how the data subject can disable cookies in their own browser, how they can accept new cookies, how they can instruct their browser to set a new cookie, and how they can switch off other cookies.

2.4.8. The Controller uses the following cookies:

Necessary cookies

These cookies are essential for the proper functioning of the website and therefore cannot be switched off.

ba_test Provider: pixel.barion.com Expiry: end of session Purpose: supporting secure payment transactions.

ba_vid Provider: pixel.barion.com Expiry: 18 months Purpose: supporting the payment process and fraud prevention.

CookieConsent Provider: qr2sku.com Expiry: 1 year Purpose: storing the user's cookie consent settings.

PHPSESSID Provider: qr2sku.com Expiry: end of session Purpose: identifying and maintaining the user session.

a.gif Provider: pixel.barion.com Expiry: end of session Purpose: technical/pixel cookie currently pending classification.

Statistical cookies

These cookies help us understand, in an anonymous manner, how visitors use the website.

_ga Provider: Google Analytics Expiry: 2 years Purpose: analysing visitor statistics and behaviour.

ga# Provider: Google Analytics Expiry: 2 years Purpose: collecting page usage and event tracking data.

Google Analytics cookies may transfer data to the United States.

Marketing and third-party cookies

The website may use embedded YouTube videos, which may place marketing and interaction-tracking cookies.

__Secure-BUCKET Provider: youtube.com Expiry: 180 days Purpose: supporting the operation of the YouTube service.

__Secure-ROLLOUT_TOKEN Provider: youtube.com Expiry: 180 days Purpose: managing YouTube features.

__Secure-YEC Provider: youtube.com Expiry: end of session Purpose: storing video player preferences.

__Secure-YNID Provider: youtube.com Expiry: 180 days Purpose: YouTube user identification.

LAST_RESULT_ENTRY_KEY Provider: youtube.com Expiry: end of session Purpose: tracking user interaction.

LogsDatabaseV2:V#||LogsRequestsStore Provider: youtube.com Expiry: persistent Purpose: usage statistics for embedded videos.

TESTCOOKIESENABLED Provider: youtube.com Expiry: 1 day Purpose: checking browser cookie support.

VISITOR_INFO1_LIVE Provider: youtube.com Expiry: 180 days Purpose: video viewing preferences and statistics.

YSC Provider: youtube.com Expiry: end of session Purpose: managing the video viewing session.

yt-icons-last-purged Provider: youtube.com Expiry: persistent Purpose: supporting the operation of the YouTube interface.

ytidb::LAST_RESULT_ENTRY_KEY Provider: youtube.com Expiry: persistent Purpose: video interaction tracking.

YtIdbMeta#databases Provider: youtube.com Expiry: persistent Purpose: YouTube database management.

YouTube cookies may transfer data to the United States.

2.5. Newsletters

2.5.1. The data subject may subscribe to the newsletter by way of an express, voluntary and affirmative declaration.

2.5.2. The purpose of the processing is to inform the data subject about the Controller's services and products and changes to them, and to provide information about news and events.

2.5.3. In accordance with Article 6(1)(a) GDPR, the legal basis of the processing is the voluntary consent of the data subject.
 
Categories of data processed:
 

2.5.4. Duration of the processing: until the data subject initiates the deletion of the subscription.

2.6. Contacting us

2.6.1. Where a person contacts the Controller for the first time (e.g. by email or telephone) using its contact details, without any other processing taking place, the Controller processes personal data.

2.6.2. The purpose of the processing is to maintain contact between the data subjects and the Controller.

2.6.3. The legal basis of the processing is the voluntary consent of the data subject [processing under Article 6(1)(a) GDPR].

2.6.4. Duration of the processing: 60 days following the conclusion of the communication, or until the legal basis changes (e.g. conclusion of a contract).

2.6.5. The provision of the data is not a condition of concluding a contract; in the absence thereof, however, contact cannot be maintained.

2.6.6. Categories of personal data processed: the personal data provided voluntarily by the data subject when making contact, in particular their name, email address, telephone number, position and title.

2.6.7. The recipient of the processing is the member of staff responsible for client relations, the addressee of the message sent by the data subject, or the colleague dealing with the query.

2.7. Personal data of contractual partners

2.7.1. In respect of its contractual partners, the Controller processes the data of natural person partners and of the contact persons of non-natural person partners (partners' names and home addresses, email addresses, telephone numbers; contact persons' names, telephone numbers, email addresses, titles and job roles) for the purposes of maintaining contact and performing the contracts.

2.7.2. In the case of natural person partners, the legal basis of the processing is the performance of the contract [processing under Article 6(1)(b) GDPR]. As regards the data of contact persons of non-natural person partners, the legal basis of the processing is the legitimate interest of the partner and of the Controller in the performance of the contract existing between them [processing under Article 6(1)(f) GDPR].

2.7.3. Duration of the processing: 5 years, in accordance with the rules on limitation under civil law.

2.7.4. The Controller stores and processes the personal data appearing on invoices and accounting documents (including contracts). The purpose of the processing is invoicing and compliance with accounting rules. The legal basis of the processing is compliance with a legal obligation [processing under Article 6(1)(c) GDPR]. The data subjects are the natural persons appearing on the accounting document. Duration of the processing: 7 years. The data appearing on accounting documents are transferred to our processor providing bookkeeping services.

2.8. Demonstrating consent

2.8.1. Where processing is based on consent, the controller must be able to demonstrate that the data subject has consented to the processing of their personal data. To this end, the Controller stores the personal data of the data subject and, where necessary, uses them before the acting authority or court.

2.8.2. The data subject is the person giving the consent.

2.8.3. This obligation is laid down in Article 7(1) GDPR [processing under Article 6(1)(c) GDPR].

2.8.4. Categories of data processed: the time at which consent was given, IP address, and the data necessary for identification, namely the email address and the surname and first name.

2.8.5. Duration of the processing: the statutory limitation period.


3. Rights of data subjects in relation to the processing, and the exercise of those rights

The data subject may exercise their rights using the Controller's contact details set out above.

3.1. Right to information, right of access

3.1.1. The Controller provides the data subject with information on the processing of their personal data, covering the scope specified in Articles 13 and 14 GDPR, in a concise, transparent, intelligible and easily accessible form, using clear and plain language.

3.1.2. A request for information may be made in writing using the Controller's contact details set out above. At the data subject's request, information may also be provided orally, provided that the data subject proves their identity.

3.1.3. The data subject has the right to obtain from the Controller confirmation as to whether or not their personal data are being processed, and, where that is the case, to obtain access to the personal data and to the following information: the purposes of the processing; the categories of personal data concerned; the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations; the envisaged period for which the personal data will be stored; the right to rectification, erasure or restriction of processing and the right to object; the right to lodge a complaint with a supervisory authority; information about the sources of the data; the existence of automated decision-making, including profiling, together with meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject. Where personal data are transferred to a third country or to an international organisation, the data subject has the right to be informed of the appropriate safeguards relating to the transfer.

3.1.4. The Controller provides the data subject with a copy of the personal data undergoing processing. For any further copies requested by the data subject, the Controller may charge a reasonable fee based on administrative costs. Where the data subject has made the request by electronic means, the information shall be provided in a commonly used electronic form, unless otherwise requested by the data subject.

3.1.5. The Controller provides the information within one month of the submission of the request at the latest.

3.2. Right to rectification

3.2.1. The data subject may request the rectification of inaccurate personal data concerning them processed by the Controller, and the completion of incomplete data.

3.3. Right to erasure ("right to be forgotten")

3.3.1. The data subject has the right to obtain from the Controller the erasure of personal data concerning them without undue delay where one of the following grounds applies:
 

3.3.2. Erasure of the data may not be initiated where the processing is necessary: for exercising the right of freedom of expression and information; for compliance with an obligation under Union or Member State law to which the Controller is subject which requires processing, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller; for reasons of public interest in the area of public health, or for archiving purposes, scientific and historical research purposes or statistical purposes; or for the establishment, exercise or defence of legal claims.

3.4. Right to restriction of processing

3.4.1. At the data subject's request, the Controller restricts the processing where one of the following applies:
 

3.4.2. Where processing is subject to restriction, the personal data may, with the exception of storage, be processed only with the data subject's consent, or for the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or of a Member State.

3.4.3. The Controller informs the data subject in advance of the lifting of the restriction of processing.

3.5. Right to data portability

3.5.1. The data subject has the right to receive the personal data concerning them which they have provided to the Controller in a structured, commonly used and machine-readable format, and to transmit those data to another controller.

3.6. Right to object

3.6.1. The data subject has the right to object at any time, on grounds relating to their particular situation, to processing of personal data concerning them which is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller, or which is necessary for the purposes of the legitimate interests pursued by the Controller or by a third party, including profiling based on those provisions. In the event of an objection, the Controller may no longer process the personal data unless it demonstrates compelling legitimate grounds which override the interests, rights and freedoms of the data subject, or which relate to the establishment, exercise or defence of legal claims.

3.6.2. Where personal data are processed for direct marketing purposes, the data subject has the right to object at any time to the processing of personal data concerning them for such purposes, including profiling to the extent that it is related to direct marketing. Where an objection is raised to the processing of personal data for direct marketing purposes, the data may no longer be processed for such purposes.

3.7. Right not to be subject to automated decision-making

3.7.1. The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them. This right does not apply where the processing is necessary for entering into, or performance of, a contract between the data subject and the Controller; or is authorised by Union or Member State law to which the Controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests; or is based on the data subject's explicit consent.

3.8. Right to withdraw consent

3.8.1. The data subject has the right to withdraw their consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

3.9. Procedural rules for exercising rights

3.9.1. Time limit for handling requests: The Controller informs the data subject of the measures taken in response to requests under this Chapter III without undue delay and in any event within one month of receipt of the request. Where necessary, taking into account the complexity and number of the requests, that period may be extended by a further two months. The Controller informs the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay. Where the data subject has submitted the request by electronic means, the information is provided by electronic means, unless otherwise requested by the data subject.

3.9.2. Where the Controller does not take action in response to the data subject's request, it informs the data subject without delay and at the latest within one month of receipt of the request of the reasons for not taking action and of the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.

3.9.3. The Controller provides the requested information free of charge. Where the data subject's request is manifestly unfounded or excessive, in particular because of its repetitive character, the Controller may, taking into account the administrative costs of providing the information or communication or taking the action requested, charge a reasonable fee, or refuse to act on the request.

3.9.4. The Controller communicates any rectification, erasure or restriction of processing carried out by it to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort.


4. Remedies

4.1. Every data subject has the right to lodge a complaint with a supervisory authority — in particular in the Member State of their habitual residence, place of work or place of the alleged infringement — if the data subject considers that the processing of personal data relating to them infringes the GDPR.

4.2. Every data subject has the right to an effective judicial remedy where they consider that their rights under the GDPR have been infringed as a result of the processing of their personal data in non-compliance with the GDPR. Proceedings against a controller or a processor shall be brought before the courts of the Member State where the controller or processor has an establishment. Such proceedings may also be brought before the courts of the Member State where the data subject has their habitual residence. Any person who has suffered material or non-material damage as a result of an infringement of the GDPR has the right to receive compensation from the controller or processor for the damage suffered.