EU GDPR Compliance & Data Privacy Architecture

1. Scope & Legal Framework

This GDPR Compliance Statement outlines how TRUSTQR LTD (registered in the United Kingdom under Company No. 17272910, hereinafter "TrustQR", "we", "us", or "our") fulfills the requirements of the General Data Protection Regulation (Regulation (EU) 2016/679), the UK GDPR / Data Protection Act 2018, and relevant national member state privacy laws such as the German Bundesdatenschutzgesetz (BDSG).

This policy applies to all operations across our public website, customer management dashboards, serialized QR verification endpoints, and cloud analytics services. For our overarching privacy terms, please consult our primary Privacy Policy and Terms of Service.

2. Data Minimization: How Consumer Product Scans Work

Under Article 5(1)(c) of the GDPR, personal data must be "adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed".

When a consumer points their smartphone camera at a serialized TrustQR code to conduct instant product verification:

• No Mobile Application Required: Scans resolve instantly in standard mobile web browsers (Safari, Chrome, Firefox) without prompting the user to install third-party tracking apps.
• Zero Account Creation: End consumers are never asked to enter their name, email address, physical address, or phone number to verify authenticity.
• No Device Identifier Harvest: We do not collect advertising identifiers (IDFA, GAID), contacts, device serial numbers, or biometric information.
• No Exact GPS Tracking: We never request precise device GPS location coordinates from the user's mobile browser.

This guarantees that consumers can verify pharmaceuticals, baby nutrition, cosmetics, and luxury apparel with total peace of mind and complete anonymity.

3. Duplicate Scan Detection & Lawful Basis (Art. 6(1)(f) GDPR)

To prevent counterfeiters from cloning genuine packaging and distributing millions of fake copies across retail channels, TrustQR operates an active Anti-Counterfeit System featuring duplicate scan tripwires.

Our lawful basis for processing technical verification telemetry is Legitimate Interests pursuant to Article 6(1)(f) GDPR:

• Fraud Prevention & Public Safety: Protecting consumers from hazardous counterfeit pharmaceuticals, expired supplements, and fake automotive components is a recognized legitimate interest under Recital 47 of the GDPR.
• Brand Protection: Enabling brand manufacturers to uncover supply chain diversion and illicit packaging replication through our Brand Protection Platform.

How Technical Telemetry Is Protected

To satisfy the balancing test under Article 6(1)(f), we employ rigorous safeguards:

• IP Pseudonymization & Salting: Raw IP addresses captured during verification are salted with rotating secret keys and converted into one-way cryptographic hashes. The raw IP address is discarded.
• Coarse Regional Telemetry Only: IP addresses are mapped strictly to broad regional zones (city/country level) to detect geo-velocity anomalies (e.g., the same serial code scanned simultaneously in Munich and Singapore).
• Zero Profiling: We do not stitch scan events together to construct individual consumer behavioral profiles, interest maps, or tracking cookies.
• Zero Sale of Data: TrustQR does not sell, license, lease, or trade scan telemetry to third-party data brokers, marketing agencies, or advertising platforms.

4. Controller and Processor Roles under GDPR

Depending on your relationship with TrustQR, our roles under GDPR are defined as follows:

TrustQR as Data Processor (Article 28 GDPR)

For enterprise brands, packaging printers, and pharmaceutical manufacturers deploying our Product Verification System, TrustQR acts as a Data Processor. The brand owner acts as the Data Controller who determines product batch parameters and lifecycle rules.

We offer a comprehensive Data Processing Agreement (DPA) incorporating the European Commission's Standard Contractual Clauses (SCCs) to govern data processing obligations, technical safeguards, and sub-processor management.

TrustQR as Data Controller (Article 4(7) GDPR)

TrustQR acts as a Data Controller for:

• Business customers who create accounts on our platform to purchase QR code plans on our Pricing Page.
• Individuals who submit inquiries via our Contact Form or email our support desk.
• Direct visitors browsing trustqr.org marketing pages.

5. Technical and Organisational Measures (TOMs - Art. 32 GDPR)

TrustQR enforces enterprise-grade security controls to safeguard data integrity and prevent unauthorized access:

• Encryption in Transit: All HTTP traffic is enforced over TLS 1.3 with modern cryptographic cipher suites and HSTS preloading.
• Encryption at Rest: Database records, serialized code vaults, and audit logs are encrypted using AES-256.
• Role-Based Access Control (RBAC): Access to cloud dashboards is protected with least-privilege permissions, mandatory multi-factor authentication (MFA), and session timeouts.
• Immutable Audit Trails: Sensitive administrative actions, batch exports, and API key generations are logged in tamper-evident audit logs.
• Regular Vulnerability Management: Routine penetration testing, code auditing, and automated container scanning are conducted to maintain zero known vulnerabilities.

6. International Data Transfers & Server Locations

TrustQR cloud infrastructure is hosted in premier, ISO 27001, SOC 1/2/3, and PCI-DSS certified European data centers. Where cross-border data transfers occur between the UK, the European Economic Area (EEA), and partner entities:

• Transfers between the UK and EEA rely on the European Commission's formal UK Adequacy Decision.
• For all other international third-party transfers, we execute the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) accompanied by Transfer Impact Assessments (TIAs).

7. Data Subject Rights (Chapter III GDPR)

The GDPR guarantees individuals specific legal rights regarding their personal data. TrustQR fully upholds these rights:

• Right of Access (Art. 15): You have the right to request confirmation of whether personal data concerning you is processed and obtain a copy.
• Right to Rectification (Art. 16): You may request immediate correction of inaccurate or incomplete information.
• Right to Erasure ("Right to be Forgotten" - Art. 17): You may request deletion of personal data when it is no longer necessary for its original purpose or where consent has been withdrawn.
• Right to Restriction of Processing (Art. 18): You may request that we suspend processing while accuracy or lawful basis is verified.
• Right to Data Portability (Art. 20): Business account holders can export their account details, product records, and batch configurations in machine-readable JSON or CSV format.
• Right to Object (Art. 21): You have the right to object at any time to processing based on legitimate interests (Art. 6(1)(f)).
• Rights related to Automated Decision-Making (Art. 22): TrustQR verification algorithms detect duplicate scan anomalies to flag packaging clones, but they do not produce legal or similarly significant effects on human individuals.

How to Exercise Your Rights

To submit a Data Subject Access Request (DSAR) or exercise any statutory right, contact our Data Protection Team at privacy@trustqr.org or info@trustqr.org. We respond to all verified requests within 30 days without charging administrative fees, in accordance with Art. 12(3) GDPR.

8. Data Retention & Automatic Purging

We retain data strictly for the minimal timeframe required to satisfy our contractual, legal, and fraud-detection obligations:

• Verification Telemetry: Transient scan logs are maintained in active memory for duplicate anomaly detection, then aggregated into non-reversible statistical counters after 90 days.
• B2B Account Information: Stored for the duration of the active subscription plus required statutory commercial retention periods under tax and corporate law.
• Support Messages: Communications submitted via our Contact Page are archived for 24 months to maintain quality assurance, after which they are purged.

9. Contact Our Data Protection Officer (DPO) & Supervisory Authorities

If you have questions regarding this GDPR Compliance Statement, data privacy governance, or wish to execute a Data Processing Agreement (DPA) for your company, please reach out to:

If you are an EU resident and believe that our processing of your personal data infringes the GDPR, you have the statutory right to lodge a complaint with a supervisory authority in your EU Member State of habitual residence, place of work, or place of the alleged infringement (for example, the Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI) in Germany or the Information Commissioner's Office (ICO) in the UK).