Privacy Policy

1. Purpose

This policy describes how QrGuest collects, uses, and protects users' personal data in accordance with the General Data Protection Regulation (GDPR).

2. Data Controller

Horizon Telecom SARL
Email: privacy@qrguest.fr
Data Protection Officer (DPO): dpd@qrguest.fr

3. Data Collected

• First name, last name, email address
• Phone number
• Data related to events created
• Guest data entered by event organizers
• Login and usage data
• Payment information (processed exclusively by Stripe and GeniusPay, never stored by QrGuest)

4. Purposes of Processing

• Account creation and management
• Provision of event management services
• Communications related to your account
• Billing and payment
• Service improvement
• Compliance with legal obligations

5. Retention Period

Your data is retained for the duration of your account plus 3 years from the date it is closed. Billing data is retained for 10 years in accordance with accounting law.

6. Your GDPR Rights

You have the following rights:

• Right of access: obtain a copy of your data
• Right to rectification: correct inaccurate data
• Right to erasure: request deletion of your account
• Right to data portability: retrieve your data in a structured format
• Right to object: object to the processing of your data
• Right to restriction: request the suspension of processing

You can exercise these rights directly from your dashboard or by email.

7. Sub-processors

Your data is processed by the following sub-processors:

• Vercel: platform hosting
• Railway: database
• Cloudinary: storage and processing of photos and videos shared by your guests
• Resend: email delivery
• Stripe: card payment processing
• GeniusPay (CinetPay): Mobile Money payment processing in French-speaking Africa
• PostHog: audience measurement and usage statistics
• Meta (Facebook): tracking pixel for our advertising campaigns
• Cloudflare: bot protection (Turnstile) on our forms
• Upstash: limiting login attempts, to prevent brute-force attacks

8. Security

We implement appropriate technical and organizational measures to protect your data against unauthorized access. All communications are encrypted using TLS 1.3.

9. Cookies

We use cookies that are strictly necessary for the service to function, as well as audience-measurement and advertising-tracking cookies subject to your consent. You can accept, refuse or change these preferences at any time via the cookie banner shown on the site.

10. Complaints

If you believe that the processing of your data does not comply with the GDPR, you may lodge a complaint with the relevant supervisory authority.