Data processing agreement Version: 2026-10-16 (en) This DPA forms part of the terms of use and applies where QRinio processes personal data on your behalf. Accepted at registration At registration you accept the terms of use including this DPA and its subprocessor annex. No separate signature or email is required. Your accepted contract copy and acceptance date are available in account settings. Existing accounts without recorded acceptance accept it once there. Processor BundS GmbH, Marburger Str. 17, 57223 Kreuztal, Germany. info@qrinio.com Controller The person or organisation identified by name or organisation name and account email at acceptance. Acceptance is linked to the account; the account email is the contact for instructions and privacy matters. Anyone acting for an organisation confirms their authority to represent it. 1. Subject matter and duration BundS GmbH processes customer data to provide the agreed QRinio features for the duration of their use and subsequent return or deletion. The customer determines purposes, content and permissions and is responsible for lawful grounds and informing data subjects. QRinio’s own processing, such as account administration, is described in the privacy notice. 2. Processing and data Processing covers storing, editing, serving, publishing, transmitting, analysing and deleting content selected by the customer: QR codes, short links, contact and link pages, files and associated visit statistics. Depending on use, this includes names, professional contact details, images, content and connection data relating to employees, customers, business contacts and visitors. The precise scope follows from the functions used and instructions given by the customer. Data under Articles 9 or 10 GDPR is covered only by a separate agreement. 3. Instructions and confidentiality We process data only on documented customer instructions, including for transfers to third countries. Instructions arise from this agreement, the selected settings and messages from the named contact to info@qrinio.com. If Union or national law requires processing, we inform the customer beforehand where legally permitted. We promptly flag instructions we consider unlawful and suspend their execution pending clarification. Persons with access are bound by confidentiality. 4. Technical and organisational measures We maintain measures appropriate to risk under Article 32 GDPR. The following measures form part of the agreement; subsequent improvements must not reduce the level of protection: - Encrypted transmission and administrative access restricted to authorised persons. - Protected passwords, separate accounts and role-based access rights. - Regular backups on separate storage with encrypted transmission, restricted access and restore tests. - Limited logging and retention periods, review of security-related changes and updates, and regular checks of the measures’ effectiveness. - Documented handling of instructions, data subject requests and security incidents; physical access controls at hosting providers’ data centres. 5. Sub-processors The customer gives general authorisation for the service provider list in the attached contractual annex. We give at least 30 days’ email notice of additions or replacements and allow reasoned data protection objections before engagement. If an objection cannot be resolved, the customer may end the affected service before the change. We impose equivalent data protection obligations and remain responsible for their performance. Transfers outside the EEA take place only on documented instructions and in compliance with Chapter V GDPR; the basis is stated for each provider. 6. Assistance and personal data breaches Taking account of the processing and information available to us, we assist the customer with data subject rights and obligations under Articles 32 to 36 GDPR, including impact assessments and consultation with authorities. We promptly forward data subject requests and respond only on instructions or a legal obligation. We notify the customer of breaches affecting customer data without undue delay after becoming aware, providing available information about their nature, consequences, measures and contact details, and supplying missing information subsequently. 7. Evidence and audits We provide all information needed to demonstrate compliance with Article 28 GDPR and allow and assist audits, including inspections, by the customer or an appointed auditor. Arrangements are coordinated while protecting other customers’ confidentiality; this does not prevent urgent or legally required inspections. 8. Return and deletion When the service ends, we return or delete customer data and existing copies at the customer’s choice, unless storage is required by law. Return is arranged before deletion. Backup copies are restricted until the retention period agreed in the annex expires and are then deleted; previous deletion instructions are reapplied after a restore. Data retained by law remains restricted to that purpose. We confirm deletion on request. Annex: service providers and retention The list attached when concluding the agreement forms part of it. Listed providers are sub-processors insofar as they process data on the customer’s behalf. - Connection logs: No general access logs. - Backups: The latest 30 backups are retained; new backups replace the oldest ones. Hosting · Oracle Cloud Infrastructure Servers in Frankfurt, Germany. Support and operations may also involve processing outside the EEA. Transfers use the linked contractual safeguards. Contact us for a copy and information about supplementary protection. Privacy: https://www.oracle.com/legal/privacy/services-privacy-policy/ Transfer safeguards: https://www.oracle.com/contracts/cloud-services/ Transactional email · Resend (Plus Five Five, Inc.) Email is sent from Ireland; storage and further processing take place in the United States. Transfers use the linked contractual safeguards. Contact us for a copy and information about supplementary protection. Privacy: https://resend.com/legal/privacy-policy Transfer safeguards: https://resend.com/legal/dpa Backups · Cloudflare R2 (Cloudflare, Inc.) Selected storage region: Western Europe. Processing outside the EEA, particularly in the United States, is possible. Transfers use the linked contractual safeguards. Contact us for a copy and information about supplementary protection. Privacy: https://www.cloudflare.com/privacypolicy/ Transfer safeguards: https://www.cloudflare.com/cloudflare-customer-dpa/