Privacy Policy

1. Controller

The controller responsible for data processing is:

Minh Huynh

Sole proprietorship

Germany

Email: info@mioseg-qr.com

2. General information on data processing

We process users’ personal data only to the extent necessary to provide a functional app, web platform, and our related services.

Processing is carried out in accordance with applicable data protection law, in particular the GDPR.

3. Registration and user account

During registration, the following data is processed in particular:

– email address

– password in encrypted form

The purpose of processing is to create and manage the user account and authenticate the user.

4. App usage and Mioseg QR functions

When using the app, the following data may be processed in particular:

– created Mioseg QR content

– saved and managed QR codes

– timestamps, updates, and technical metadata

– content in standard Mioseg QR and Business-QR

The purpose is to provide, manage, and operate the app and web platform features.

5. Uploaded content and media

Users can upload, save, and manage their own content, in particular:

– images

– videos such as MP4 files

– audio files such as MP3 files

– other supported media and content

These contents are stored and processed in order to provide the app’s functionality.

6. Location data

The app may process location data if the user actively grants permission.

This may occur in particular when scanning a QR code or creating a Mioseg QR.

Location data is only processed or stored if the user consents in the respective action.

The purpose may include documenting scan locations or managing location-based Mioseg QR content.

7. Server and log data

When using the app and web platform, technical data may be processed automatically, in particular:

– IP address

– device type

– operating system

– time of access

– technical error and log data

The purpose is security, stability, error analysis, and abuse prevention.

8. Payment processing and in-app purchases

Credit purchases on the web platform may be processed through Stripe. Stripe processes the payment and transaction data required for payment under its own or contractually defined data protection responsibilities.

Digital purchases in the mobile app are processed through the Apple App Store or Google Play. RevenueCat is used for the technical management and validation of in-app purchases.

mioseg qr generally receives only the transaction, product and status information required to allocate and book the purchase; full credit card or bank details are not stored by mioseg qr.

9. Service providers used

We use in particular the following service providers: Supabase for backend, database and authentication; Cloudflare for R2 media storage, delivery through Worker/CDN and security/traffic protection; Vercel for hosting and delivery of the web platform; Stripe for web payments; RevenueCat for management and validation of mobile in-app purchases; and Resend for transactional emails.

Depending on the function, account and user identifiers, IP and connection data, technical metadata, uploaded media, transaction status, email address and other data required for the respective service may be transferred to these providers.

Where providers process data outside the European Economic Area, transfers take place only in accordance with applicable data protection requirements, in particular on the basis of an adequacy decision or appropriate safeguards such as EU Standard Contractual Clauses where required.

9a. Legal bases for processing

Depending on the processing activity, processing is based in particular on Art. 6(1)(b) GDPR for performance of the user relationship and requested functions, Art. 6(1)(c) GDPR for legal obligations, Art. 6(1)(f) GDPR for security, abuse prevention, error analysis and stable operation, and Art. 6(1)(a) GDPR where consent is required.

Consent may be withdrawn at any time with effect for the future. Processing carried out before withdrawal remains lawful.

10. Storage period

Personal data is only stored for as long as necessary for the respective purposes.

Users can request deletion of their account or use available account deletion features where provided.

Statutory retention obligations remain unaffected.

11. Rights of data subjects

Users have in particular the following rights:

– right of access

– right to rectification

– right to erasure

– right to restriction of processing

– right to data portability

– right to withdraw a granted consent

– right to lodge a complaint with a data protection authority

12. Data security

We implement technical and organizational measures to protect personal data as far as possible against loss, manipulation, and unauthorized access.

Despite all due care, complete security of digital data transmission and storage cannot be guaranteed.

13. Changes to this privacy policy

We reserve the right to update this privacy policy if this becomes necessary due to legal, technical, or business developments.

The current version will be provided in the app and on the web platform.

14. Contact

For privacy-related questions: info@mioseg-qr.com

15. Business Succession and Potential Change of Controller

The operation of mioseg qr may in future be transferred to another legal entity as part of incorporation, restructuring or business succession, including a GmbH founded or controlled by the current provider.

This may require transferring personal data to the future operator, including account and contact data, stored Mioseg QR, uploaded content, permissions, credit balances and transaction information, to the extent necessary to continue the services.

Any processing or transfer will take place only on an appropriate legal basis under Article 6(1) GDPR and in compliance with other applicable requirements. Depending on the circumstances, contractual necessity (Article 6(1)(b)) or legitimate interests (Article 6(1)(f)) may apply; the relevant basis will be assessed before any transfer.

If the data controller actually changes, affected individuals will receive information about the identity and contact details of the new controller and other relevant changes as required by the GDPR. Statutory data subject rights remain unaffected.

This notice is neither blanket consent to future data transfers nor permission to process data for new purposes incompatible with the original purposes.