Privacy Policy

QRGATE is built for secure event operations. Below we explain what data is processed, why it is needed, how long it is kept, and what rights you have under GDPR.

1. Data controller and contact

Service: QRGATE.org (QR invitation and check-in SaaS)

Data Controller: Dániel Cser, Sole Proprietor (Hungary), operating QRGATE.org

Contact: support@qrgate.org
Website: https://qrgate.org

For event-specific guest data, the event organizer who invited you typically acts as the data controller. QRGATE acts as a data processor for those data sets.

2. Purposes of processing

Account creation and authentication for organizers;
Event and guest list management;
Sending QR invitations by email (upon organizer action);
Recording and auditing check-in events (who checked in and when);
Security, fraud prevention, and abuse protection;
Optional anonymous analytics (only with consent via cookies).

3. Categories of data

a) Registered users (organizers)

Name, email address, password (hashed)
Billing details (company name, address, VAT/tax details - if provided)
Security logs (e.g., login timestamps, technical security signals)

b) Invitees and attendees

Name, email address, optional labels/tags (VIP, press, partner, etc.)
Event identifier, QR token (technical code)
Check-in timestamps and status (audit trail)

c) Website visitors

We use essential cookies for functionality. Optional analytics cookies are used only with consent. See: Cookie Notice.

4. Legal bases and retention

Organizers: performance of a contract (GDPR Art. 6(1)(b)); data is deleted when the account is terminated, subject to compliance needs.
Invitees: legitimate interests (GDPR Art. 6(1)(f)) for invitation-based access control and venue security; event-related data is typically deleted or anonymized after a reasonable period set by the organizer and/or tenant policy.
Analytics: consent (GDPR Art. 6(1)(a)); retention is aligned with cookie consent settings.

Event data anonymization and retention layers

After an Event has been closed, an authorized organizer may initiate irreversible anonymization of Event-scoped guest personal data. This covers guest names and contact details, uploaded XLS/XLSX guest-list files, registration and RSVP personal data, person-linked check-in and accreditation information, and QR-ticket mappings. Only anonymous statistics that do not identify attendees may remain.

The operation is not automatic, does not delete the organizer account, and does not erase billing records or business data that QRGATE must retain. The organizer remains the controller for Event guest data and QRGATE acts as processor. Anonymization does not immediately erase copies held in backups or external systems.

QRGATE European production runs in the AWS Frankfurt region. The currently configured retention period for Amazon RDS automated database backups is 7 days; AWS backup lifecycle processing applies, and this does not mean that every backup is physically destroyed exactly on day seven or that the same period applies to manual snapshots or other files. Transactional Event email is delivered through Postmark. The current QRGATE Production Activity Retention is 45 days for message content and related activity data; aggregated statistics and abuse-prevention records may follow different periods, and Postmark messages are not automatically deleted when QRGATE Event data is anonymized.

5. Data security

Passwords are stored using strong hashing (e.g., bcrypt). Data in transit is protected with TLS/SSL. Access to event data is restricted by role and tenant boundaries, and is available only to authorized organizer accounts.

6. Data sharing and processors

We do not sell personal data. We may use vetted service providers to operate the platform (e.g., hosting, email delivery, monitoring). These providers act under contractual data protection obligations appropriate to their role.

7. Your rights under GDPR

Right of access, rectification, erasure, and restriction;
Right to object (where processing is based on legitimate interests);
Data portability (where applicable, e.g., organizer account data);
Right to withdraw consent at any time (for consent-based processing).

If you are an invitee, please contact the event organizer first for event-specific data requests. QRGATE will support the organizer as needed.

8. QR check-in data processing

The QR code typically contains only a technical token and does not include readable personal data. When scanned, the system verifies the token and records the scan time and result for access control and auditing. Logs are used to prevent misuse and ensure reliable entry operations.

Privacy questions or GDPR requests:

Contact support

Last updated: 2026-10-29

Choose country Choose country