QR4Events

Privacy policy

Last updated: 19 October 2026

This policy explains how Derham Productions Ltd ("we", "us") handles personal data for QR4Events at qr4events.co.uk. We're a company registered in England and Wales (company number 12548980), at Unit 5 - Pole Position, London Road, Bassets Pole, Sutton Coldfield, West Midlands B75 5SA. Contact us about privacy at hello@derhamproductions.com.

The service handles data about two groups of people:

  • Customers: the people and organisations who create an account and make QR codes. For their data, we are the controller.
  • People who scan a code: we keep as little as possible about them, and we never store their IP address.

What we collect

Customers

  • Account details: name, email address and a securely hashed password.
  • Billing details you give us for invoices: name, company, billing address, country and VAT or tax number. For an EU VAT number, we also keep the result of checking it with the EU's VIES service (whether it was valid, the business name VIES returned, and when we checked).
  • Your codes: their names, events, notes, destinations, design, logos you upload, and scheduled changes.
  • Plans, payments and invoices: what you bought, when, how much you paid and the payment reference. We never see or store your card details; card payments are handled by Stripe.
  • Basic technical records, such as when you confirmed your email address, sign-in times, and our web server's logs (IP address, browser, pages requested).

People who scan a code

When someone scans a code, we record:

  • the time of the scan and which code was scanned;
  • the type of device (phone, tablet or computer) and its operating system, worked out from the browser's description of itself;
  • the website that linked to the code, if there was one (only its domain name);
  • an anonymous visitor reference: a one-way scrambled value made from the IP address, browser and date, used only to count unique visitors. It changes every day, can't be turned back into an IP address and can't be used to follow someone across days.

We don't store IP addresses, names, locations or any other identifiers for people who scan, and we don't use cookies on the short links. Our web server's logs do record IP addresses for security, and are deleted within 90 days.

People who use our contact form

  • Your name, email address, organisation (if you give it) and your message. The form emails these to us; the website doesn't keep a copy.

Why we use it, and our legal basis

  • To provide the service: your account, codes, scan statistics, shared stats links and invoices. Basis: performance of our contract with you.
  • To count scans for our customers: the scan records above. Basis: our and our customers' legitimate interests in knowing how their printed materials are used, balanced by collecting as little as possible and nothing that identifies the person scanning.
  • To take payment and keep accounting records, including VAT invoices. Basis: legal obligation, and our contract with you.
  • To keep the service secure and prevent misuse (including codes pointing to harmful content): server logs, limits on how often scans are counted. Basis: our legitimate interests in running a safe, reliable service.
  • To email you about your plan: receipts, reminders before your plan ends, and changes to the service or these policies. Basis: our contract with you, and legitimate interests.
  • To answer messages sent through our contact form. Basis: our legitimate interests in replying to enquiries.

We don't sell personal data, use it for advertising, or send marketing without your consent.

Who we share it with

We use these service providers, who process data for us under contract:

  • IONOS SE: hosting. The website and its data are on a server in IONOS's UK data centre, which we run ourselves.
  • Stripe (Stripe Payments UK Ltd, and Stripe, Inc. in the US): card payments and subscriptions.
  • Microsoft: email (receipts, reminders and messages are sent through Microsoft 365).
  • The European Commission's VIES service: if you're a business in the EU, we send your VAT number (not your name or address) to VIES to check it's valid, as evidence for not charging UK VAT.

If you create a shared stats link, anyone you give it to can see the statistics for that code or event (counts, devices and systems - nothing that identifies the people who scanned). You can switch a link off at any time.

We may also share data where the law requires it, or with professional advisers (such as our accountants). Some providers may process data outside the UK; where they do, we rely on the safeguards UK data protection law requires, such as adequacy regulations or standard contractual clauses.

How long we keep it

  • Your codes, their scan statistics, logos and shared links: while your account has a plan, and for 12 months after your plan ends (so you can bring the same codes back), then deleted with your account.
  • The per-scan log (each individual scan): 24 months, then only the daily totals are kept.
  • Accounts whose email address is never confirmed: deleted 7 days after sign-up.
  • Free-trial accounts that never buy a plan: deleted 90 days after the trial ends.
  • Unfinished checkouts: deleted after 30 days.
  • Invoices and payment records: 6 years from the end of the financial year they relate to, as required for UK tax and company records.
  • Contact form messages: not stored on the website. The email lands in our mailbox, and we keep it for up to 2 years after our last reply.
  • Logs and copies of emails we've sent: up to 90 days.

This happens automatically. You can also ask us to close your account at any time; we'll delete your data except what we have to keep by law.

Cookies

We only use cookies that are strictly necessary for the site to work: a session cookie that keeps you signed in and protects forms from misuse, and (if you tick "Remember me") a cookie that keeps you signed in for longer. The short links in your QR codes set no cookies. We don't use analytics, advertising or tracking cookies, so we don't ask for cookie consent.

Your rights

Under UK data protection law you can ask us to:

  • give you a copy of your personal data;
  • correct it if it's wrong;
  • delete it, or restrict how we use it;
  • object to how we use it (where we rely on legitimate interests);
  • give it to you in a portable format.

Email hello@derhamproductions.com. We'll reply within one month. Much of your data can also be seen and changed in your account, and you can download your scan data as CSV at any time.

If you're unhappy with how we've handled your data, please tell us first. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk, 0303 123 1113.

Changes

We'll update this policy if what we do with personal data changes. The date at the top shows when it last changed; if a change affects you significantly, we'll tell you by email.