Data Processing Agreement (DPA)

Last updated: 10 August 2026 · Version 1.0

This Data Processing Agreement is an annex to the qsy Terms of Service and applies when you use the service to process personal data for which you are the controller in the course of business, organisational or other professional activity. You do not need to sign anything: the agreement is entered into together with the subscription agreement, see section 1. It is written to satisfy Article 28(3) of the General Data Protection Regulation (GDPR).

If you use the service as a private individual for purely personal purposes, you are normally not a controller (the household exemption in GDPR Article 2(2)(c)); in that case the Privacy Policy describes how your data is processed, and this agreement has little practical significance. The agreement is most relevant for Business and API customers, but applies to all paying customers who enter personal data into the service in the course of such activity.

This agreement is a translation of the Norwegian original. In the event of any conflict or inconsistency between the Norwegian version and this English version, the Norwegian version prevails.

1. Parties and how the agreement is entered into

Processor: Jon Marius Nilsson (sole proprietorship), Norwegian organisation number 991 578 307, Schweigaards gate 34, 0191 Oslo, Norway, referred to in this agreement as "qsy" or "we". Contact: the support form at /hjelp (enquiries sent there are answered and documented).

Controller: the customer who has entered into a subscription agreement for qsy, referred to in this agreement as "the customer" or "you".

The agreement is entered into as part of the subscription agreement: by your accepting the terms where the app or checkout flow prompts you to do so, and in any event no later than when you start using the service as a paying customer. It remains in force for as long as the subscription runs, and together with section 5 constitutes the documented instructions under GDPR Article 28.

In the event of conflict between this agreement and the Terms of Service, this agreement prevails on questions concerning the processing of personal data on your behalf, with one exception: the liability provisions in the Terms of Service also apply to claims under this agreement, see section 14.

2. Definitions

The terms "personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "third country" have the same meaning as in GDPR Article 4.

Customer Content means data you yourself enter into the service: destination addresses (URLs, email addresses, telephone numbers), link titles, folder names, QR designs (qr_config) and logo uploads.

Scan Events means the derived data the service records when someone scans a QR code or opens a short link: timestamp, country, city, device class (mobile/tablet/desktop) and source (QR or link).

Edge Mirror means the technical copy of the link (slug, destination address and status) replicated across Cloudflare's global edge network so that redirection works quickly wherever in the world the code is scanned.

Analytics Store means the data store where Scan Events are stored and aggregated into statistics (Tinybird, see Annexes B and C).

3. What the agreement covers, and what it does not

We have built the service to process as little personal data as possible on your behalf. The agreement therefore covers a narrow, precisely defined scope:

We act as processor for:

a) Customer Content. Destination addresses, titles and folder names may contain personal data, for example a mailto: destination containing a person's email address, a telephone number in a tel: destination, or a name in a link title. You decide what is entered; we store and serve it. Destination addresses are checked against Google's Safe Browsing lists on creation and modification, to protect end users against phishing and malware (see Annex C).

b) Transient traffic processing during redirection. When an end user scans your code or opens your short link, we process the IP address and technical request data at the moment of redirection itself, to deliver the redirect and derive coarse geography and device class. The IP address is not stored in the scan statistics and is never linked to them. IP addresses may appear briefly in technical operations and security logs held by us and our sub-processors as part of normal operations; such logs have a limited lifetime, are used only for operations, security and troubleshooting, and are governed by the providers' data processing agreements (see Annex C).

c) Scan Events. The statistics are built without personal identifiers: no IP addresses, no full user-agent strings, no cookies or other tracking of the person scanning. City-level data is shown only when at least five scans lie behind the figure. We nevertheless treat raw Scan Events as pseudonymous personal data under this agreement, as a matter of precaution.

We are not processor for, and the agreement does not cover:

• your own account data (email, login identities, language preferences), for which we are an independent controller, see the Privacy Policy
• security and abuse protection for the service itself (for example rate limiting and cost protection): this is our own purpose, for which we are an independent controller on the basis of legitimate interest, see the Privacy Policy
• support enquiries you send us: independent controllership, see the Privacy Policy
• payment and invoicing data, for which Paddle is the seller (Merchant of Record) and an independent controller

Special categories. The service is not designed for special categories of personal data (GDPR Article 9), data relating to criminal convictions, or data concerning children. You must not enter such data as Customer Content. Nor should you place national identity numbers or other unique identifiers in titles, folder names or destination addresses beyond what is necessary for the link to work.

Your responsibility for Customer Content. You warrant that you have a valid legal basis for the personal data you enter as Customer Content, and you shall indemnify and hold qsy harmless against third-party claims arising from your breach of this provision. We may suspend or delete Customer Content that manifestly breaches this provision or the acceptable-use rules in the Terms of Service; in that case we will notify you, with reasons, to the extent the law permits.

Publicly accessible logos. Logo uploads are publicly accessible as part of the QR code: this is necessary for the logo to be displayed. The files are hosted at addresses with randomly generated identifiers that cannot be guessed. Do not upload images containing personal data you do not wish to make public, such as portrait photographs.

4. Nature, purpose and duration of the processing

Material changes to the nature, purpose or data types of the processing are notified under the same procedure as for sub-processors (section 8): at least 30 days' notice by email, with a right to object and to terminate. Ordinary further development of features within the boundaries above is not such a change.

5. Instructions

We process personal data only on your documented instructions. The instructions are: this agreement, the Terms of Service, and the choices you make in the app and the API (creating, editing, moving, disabling and deleting links, folders and designs). We do not process the data for our own purposes, with one exception: security and abuse protection for the service, for which we are an independent controller (see section 3 and the Privacy Policy).

Exception: we may process the data where EU/EEA law or Norwegian law requires it. In that case we will notify you before processing, unless the law prohibits such notification.

If we consider that an instruction from you infringes the GDPR or other data protection legislation, we will inform you without undue delay. We may then suspend execution of the instruction until the matter is resolved.

6. Confidentiality

Only persons who need access in order to deliver the service have access to the data. Everyone with access is bound by a duty of confidentiality regarding Customer Content and scan data. If assistants are engaged, they are placed under a written duty of confidentiality before being granted access. The duty of confidentiality survives termination of this agreement.

7. Security

We implement technical and organisational measures providing a level of security appropriate to the risk, cf. GDPR Article 32. The measures are described in Annex B. We may change and improve the measures over time, provided the level of security at all times remains appropriate to the risk under GDPR Article 32.

8. Sub-processors

You grant a general prior authorisation for our use of sub-processors. The list of approved sub-processors is set out in Annex C.

Changes. If we intend to add or replace a sub-processor, we will notify you at least 30 days before the change takes effect, to the email address associated with your account. You may object in writing within 14 days of the notice, with reasoned grounds relating to data protection. If we cannot find a solution you can accept, you may terminate the subscription with effect from the date of the change, at no cost beyond the subscription period already accrued.

Responsibility. We impose on each sub-processor, by contract with the provider, data protection obligations providing the same level of protection as this agreement for the processing activities the provider actually performs, cf. GDPR Article 28(4). We remain liable to you for the sub-processors' performance of the work in the same manner and subject to the same limitations as for our own performance, cf. section 14.

9. Transfers to third countries

Primary storage of Customer Content and Scan Events takes place in the EU/EEA: the database and file storage are located in the EU/EEA with Supabase, and the Analytics Store runs in the EU (Frankfurt) with Tinybird, see Annexes B and C. We will ensure this remains the case; if it changes, we will follow the notification procedure in section 8.

In addition, the following processing may take place wholly or partly outside the EU/EEA, and we want to be precise about it:

• Cloudflare (edge redirection). Redirection takes place on Cloudflare's global network, on the server closest to the person scanning, including outside the EU/EEA when the scanner is located there. The IP address is then processed transiently and locally and is not stored in qsy's data sets; Cloudflare's own operations and security logging is governed by Cloudflare's data processing agreement. The Edge Mirror (slug, destination address, status) is replicated globally across Cloudflare's edge network so the code works quickly everywhere. This constitutes storage of Customer Content outside the EU/EEA, and relies on Cloudflare's certification under the EU-US Data Privacy Framework (DPF), with the European Commission's Standard Contractual Clauses (SCCs) as a fallback.
• Vercel (app hosting). The studio and API run on Vercel and process Customer Content in operation. Vercel does not store Customer Content persistently, but processing may take place on servers outside the EU/EEA. Vercel is certified under the EU-US Data Privacy Framework.
• Google (Safe Browsing). On creation and modification of links, the destination address is sent to Google's Safe Browsing service for checking against known phishing and malware lists. Google is certified under the EU-US Data Privacy Framework.

Transfers to third countries take place only with a valid transfer mechanism under Chapter V of the GDPR (adequacy decision, DPF certification or SCCs), as specified per provider in Annex C. If a mechanism changes, we will update the annex and notify you pursuant to section 8.

10. Assistance to you

Data subject rights. The design of the service means you can usually respond to data subjects yourself: you can view, edit and delete Customer Content directly in the studio and via the API, and the scan statistics contain no personal identifiers to which access could be given. If you need assistance beyond this, we will help you without undue delay, insofar as this is possible given the nature of the processing.

If we receive a request from a data subject concerning processing we carry out on your behalf, we will forward it to you and will not respond ourselves, unless the law requires us to respond.

Articles 32-36. We assist you in fulfilling your obligations regarding security, breach handling, data protection impact assessments (DPIAs) and prior consultation with Datatilsynet (the Norwegian Data Protection Authority), taking into account the nature of the processing and the information available to us. For assistance beyond what can reasonably be expected of a standard product, we may require reimbursement at documented cost. We will inform you of the expected cost before the work begins.

11. Personal data breaches

If we become aware of a personal data breach concerning data we process on your behalf, we will notify you without undue delay at the account's email address, and additionally via an in-app notice if the email channel itself may be affected by the breach. The notification will contain the information you need for your assessment under GDPR Articles 33 and 34, insofar as it is known: what has happened, which categories of data and approximately how many data subjects are affected, the likely consequences, and the measures taken. If information is missing from the initial notification, we will provide it as soon as it becomes available.

Where you are the controller, it is you who assesses and, where applicable, notifies the breach to Datatilsynet (the Norwegian Data Protection Authority) and the data subjects; we do not notify on your behalf without agreement, but we will give you the basis you need. (For processing where we are ourselves the controller, see section 3, we notify directly.)

12. Deletion and return of data on termination

On termination, you choose whether the data is to be deleted or returned:

Return (export). You can export your links as CSV from the studio at any time. If you additionally want an export of the associated scan statistics or logo files, request it via /hjelp before deletion: we will then provide the data in a commonly used machine-readable format within a reasonable time and free of charge. Once deletion has been carried out, data cannot be recovered.

Deletion during the term and on termination:

• Account deletion (self-service at /konto) deletes links, folders, QR designs and logo uploads from the database, the Edge Mirror and file storage without undue delay.
• Deletion of individual links during the term removes the link from the database and the Edge Mirror without undue delay.
• Scan Events relating to deleted links and accounts immediately cease to be available in the statistics and the API, and are removed from the Analytics Store through the deletion routine within 30 days at the latest.
• Automatic expiry: all raw Scan Events are in any event deleted automatically no later than 2 years after they arose.
• Aggregated statistics relating to your links are deleted together with the Scan Events. Fully anonymous service-wide totals that cannot be linked to you, your links or any data subject may be retained: they are not personal data.

Time limits where the subscription ends without you deleting the data yourself: the links stop redirecting upon termination (see section 12 of the Terms of Service). The data is then retained for 12 months, so that you can resume the subscription without data loss or request an export. Customer Content and scan data are deleted automatically and permanently 12 months after termination. We will notify you at the account's email address before final deletion.

We do not retain copies, with two exceptions:

1. documentation we are legally required to retain (for example accounting records under bokføringsloven (the Norwegian Bookkeeping Act), 5 years): such documentation concerns the customer relationship, not the Customer Content, and is processed with us as controller, and
2. the fully anonymous totals described above, which are not personal data.

13. Documentation and audits

We make available to you the information necessary to demonstrate compliance with the obligations laid down in GDPR Article 28, and allow for and contribute to audits, including inspections, cf. Article 28(3)(h).

Audits are conducted in stages, reflecting the fact that qsy is a small business:

1. Documentation first. Written questions, this agreement with its annexes, the sub-processors' audit reports and certifications (for example SOC 2 / ISO 27001 where the provider offers them) and written answers to specific questions cover most needs.
2. On-site or extended audits may be requested with at least 30 days' written notice. They are conducted during ordinary business hours without undue disruption to operations, at most once per twelve-month period (unless a security breach or an order from a supervisory authority gives grounds for more) and at your expense. The auditor must be bound by a duty of confidentiality and is not given access to other customers' data. For the sub-processors, the audit right is satisfied primarily through their audit reports and certifications, which we obtain and present; if these do not provide a sufficient answer, we will assist in follow-up towards the provider within the audit arrangements the provider's agreement allows.

Supervisory authorities in any event have the access the law grants them.

14. Liability

Liability under this agreement follows the liability provisions of the Terms of Service, including caps and exclusions, as they apply to business customers and consumers respectively. The limitation of liability in the Terms of Service also applies to claims under this agreement, notwithstanding the order-of-precedence rule in section 1.

Nothing in this agreement limits data subjects' rights directly under the GDPR, the allocation of liability between controller and processor under GDPR Article 82, or mandatory rights under consumer protection legislation.

15. Amendments, term, governing law and jurisdiction

Amendments to the agreement. This agreement is versioned (version number and date at the top). If we amend the agreement, we will notify you at the account's email address at least 30 days before the new version takes effect, stating the effective date. Amendments that weaken your rights under the agreement give you the same right to object and to terminate as changes of sub-processors (section 8). Mere clarifications and updates to Annex C follow the procedure in section 8.

Term. The agreement applies from the time it is entered into (section 1) and for as long as we process personal data on your behalf, that is, also during the period until final deletion pursuant to section 12. The provisions on confidentiality (6) and documentation (13) continue to apply for as long as they remain relevant.

Governing law and jurisdiction. This agreement is governed by Norwegian law. For business customers, the venue is Oslo tingrett (Oslo District Court). If you are a consumer, you retain your home venue and the mandatory protections of the country in which you reside.

Annex A: Categories of data subjects and personal data

Data subjects

Personal data

Special categories (GDPR Article 9) are not processed and must not be entered, see section 3.

Annex B: Technical and organisational security measures

The measures describe what we do as of the version date at the top of the agreement. We do not promise more than we deliver. The measures may be changed pursuant to section 7: the level of security must at all times be appropriate to the risk under GDPR Article 32.

Encryption

• All traffic runs over TLS (HTTPS), both towards end users and between the systems.
• Data is encrypted at rest with the storage providers (provider standard, AES-based).

Access control

• Row Level Security in the database: each customer can access only their own rows, enforced in the database itself, not merely in the application code.
• Administrative access is limited to as few persons as possible, with strong authentication at each provider.
• API keys are never stored in plaintext: only as a SHA-256 hash with a prefix for identification.
• Secrets (keys, tokens) in the production environments reside in the providers' secret management; automated checks prevent secrets from being committed to the codebase.

Data minimisation by design

• Scan statistics without personal identifiers: no IP addresses or full user-agent strings are stored in the statistics, and no cookies are set for the person scanning.
• City-level data in the statistics is shown only when at least five scans lie behind the figure (k-anonymity).
• Raw Scan Events are deleted automatically no later than 2 years after recording.

Data storage and residency

• Primary storage of Customer Content (database and file storage, Supabase) takes place in the EU/EEA. We will ensure this remains the case, cf. section 9.
• The Analytics Store (Scan Events, Tinybird) runs in the EU: AWS eu-central-1, Frankfurt.
• The Edge Mirror of the link is replicated globally across Cloudflare's edge network (section 9); the IP is processed transiently during redirection and is not stored in qsy's data sets.
• In the event of failure of the event queue, raw Scan Events may be buffered in a temporary archive store at Cloudflare, solely to prevent data loss; the archive is subject to the same deletion deadlines as the Analytics Store (no later than 2 years, and upon deletion pursuant to section 12).

Resilience and recovery

• The service runs on managed cloud platforms with redundancy and automatic provider-level backups. Backups reside with the same provider and in the same region as the primary storage, and expire automatically according to the provider's cycles.
• Deletion is carried out across all stores (database, Edge Mirror, Analytics Store and file storage) via a unified deletion routine, within the deadlines in section 12.

Organisational

• Small organisation with documented procedures for deployment, deletion and breach handling; duty of confidentiality pursuant to section 6.
• Code changes are reviewed and tested before release to production, with particular attention to security-relevant flows (authentication, deletion, access).

Logos: logo uploads are publicly accessible as part of the QR code (necessary for display), via addresses with randomly generated identifiers that cannot be guessed. This is disclosed in section 3, and the customer must not upload personal data in logos.

Annex C: Sub-processors

Part 1: Sub-processors under this agreement

These process Customer Content and/or scan data on our behalf:

Part 2: Other providers (outside this agreement)

These process data for which qsy or Paddle is an independent controller (the customer's account data, support, payment, abuse protection): they are not sub-processors for Customer Content, but are listed here for transparency. Details are set out in the Privacy Policy:

Notification of changes to Part 1: see section 8: at least 30 days' notice by email, a 14-day right to object, and a right to terminate if we cannot find a solution.