dpp24.org
Sign inCreate QR Workspace

Privacy policy

Last updated: 7 October 2026

This privacy policy explains how personal data is processed when you use dpp24.org, including its passport pages under dpp24.org/info, the QR codes managed through it and the services offered there. It applies worldwide, wherever our visitors and customers are located. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG).

1. Controller

Mag. Werner Braun
Rudolfstrasse 231
8047 Graz
Austria
Email: office@dpp24.org

We have not appointed a data protection officer because we are not required to do so. For all data protection questions, write to the email address above.

2. Overview

  • We do not use analytics, advertising, tracking pixels, social media plugins or scan statistics.
  • We do not sell personal data and do not use it for profiling.
  • Fonts and scripts are served from our own server. No third-party content is loaded when you visit dpp24.org.
  • Free QR codes are generated in your browser. What you type into the free QR tool is not sent to us.

3. Hosting and server logs

dpp24.org is hosted by Namecheap, Inc., 4600 East Washington Street, Suite 300, Phoenix, AZ 85034, USA, which acts as our processor.

Each time a page, a file or a QR code address is requested, the server processes technical information:

  • IP address;
  • date and time of the request;
  • requested address, including the QR code identifier;
  • HTTP status code and amount of data transferred;
  • referrer, where your browser sends it;
  • browser type and operating system (user agent).

We need this information to deliver the requested content, to carry out QR code forwarding, to find errors and to protect the service against misuse and attacks. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of the service.

Server logs are deleted after no more than 30 days, unless a specific log entry is needed to investigate a security incident. In that case it is kept until the incident is resolved.

4. Scanning a QR code and viewing passport pages

When someone scans a dynamic QR code (for example dpp24.org/ABC/01/7), our server looks up where the code should lead and forwards the request. If the code belongs to a Hosted DPP set, the request is forwarded to a passport page under dpp24.org/info.

Only the technical request information described in section 3 is processed. We do not set cookies when a code is scanned or a passport page is viewed, and we do not count, analyse or attribute scans to persons.

The destination a code leads to is chosen by our customer. Once you are forwarded to a website outside dpp24.org, the privacy policy of that website applies.

Passport documents shown under dpp24.org/info are provided by the manufacturer or distributor named on the page. For questions about their content, please contact that company.

5. Free QR tool

The free QR tool at dpp24.org/qr-world creates QR codes and ZIP files directly in your browser. The text, addresses and CSV files you enter or choose are not uploaded to our server.

If you choose "Make this code editable", the address of your code is passed to the registration page so that your workspace can be set up with it.

6. Member accounts

When you create a workspace or are added as a member, we process:

  • company name and three-letter prefix;
  • your name (if given) and work email address;
  • your password, stored only as a secure hash;
  • your role and account status;
  • the QR sets, forwards, labels, destination addresses and passport files you create;
  • a change history recording which member changed what and when.

We process this data to provide the workspace you requested (Article 6(1)(b) GDPR). The change history also serves our customers' and our legitimate interest in traceable, tamper-evident records (Article 6(1)(f) GDPR).

Account data is kept for as long as the account exists. After the end of the contract, including any archive period, it is deleted or anonymised within 90 days, unless we must keep it for legal reasons (section 9).

7. Customer content processed on behalf of our customers

Labels, destination addresses, product names and passport files uploaded by customers may contain personal data, for example the name of a contact person in a declaration of performance. We process this content only on behalf of the customer and according to their instructions. For this content the customer is the controller and we are a processor under Article 28 GDPR. The details are set out in our data processing agreement.

8. Plans, orders and invoicing

When you request a plan, start a trial or receive invoices, we process the company name, invoice address, VAT identification number, order reference, invoice email address, chosen plan, billing period and payment status.

The legal basis is Article 6(1)(b) GDPR (contract) and, for accounting and tax records, Article 6(1)(c) GDPR together with § 132 of the Austrian Federal Fiscal Code (BAO) and § 212 of the Austrian Commercial Code (UGB). Accounting records are kept for seven years from the end of the calendar year in which they were created, and longer where they are needed for ongoing proceedings.

9. Emails and contact requests

If you contact us by email, we process your name, company, email address and message to answer your request. Where your request concerns a contract, the legal basis is Article 6(1)(b) GDPR. Otherwise it is Article 6(1)(f) GDPR, our legitimate interest in answering business enquiries. We keep such correspondence for as long as needed to handle the matter and for up to three years afterwards, unless longer retention is legally required.

We send service emails, for example confirmations of a plan change or a reminder before a trial ends, through the mail server of our hosting provider. We do not send newsletters or advertising emails without your consent.

10. Cookies and browser storage

We use one cookie on dpp24.org, named "dpp24". It keeps you signed in and protects forms against misuse. It is technically necessary, contains no personal profile, is only sent over secure connections and expires when you close your browser or sign out. The legal basis is § 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021) and Article 6(1)(b) and (f) GDPR. No consent is required for this cookie.

The member area uses your browser's local storage for small interface settings, for example to remember that you dismissed a hint. This information stays in your browser and is not sent to us.

If we ever introduce technologies that require consent, we will ask for it first and update this policy.

11. Recipients

Personal data is only disclosed where this is necessary to provide the service, to fulfil a contract or to comply with legal obligations. Recipients are:

  • Namecheap, Inc. (hosting, domains and email delivery), as our processor;
  • our tax advisor or accountant, for invoices and accounting records;
  • banks and payment service providers, for processing payments;
  • authorities and courts, where we are legally required to disclose data.

If we add further service providers, for example a payment provider for online card payments, we will update this policy before they are used.

12. Transfers to countries outside the EU

Our hosting provider is based in the USA. Personal data may therefore be transferred to, or accessed from, the USA. Such transfers are based on the EU-U.S. Data Privacy Framework adequacy decision (Article 45 GDPR) where the recipient is certified under it, and otherwise on the EU Standard Contractual Clauses (Article 46(2)(c) GDPR), which are part of Namecheap's data processing addendum.

13. Security

All connections to dpp24.org are encrypted (HTTPS). Passwords are stored only as hashes. Uploaded passport files are stored outside the publicly accessible web directory and are only delivered through the passport pages the customer has published.

14. Automated decisions

We do not make decisions based solely on automated processing, including profiling, within the meaning of Article 22 GDPR.

15. Your rights

You have the right to:

  • access the personal data we hold about you (Article 15 GDPR);
  • have inaccurate data corrected (Article 16 GDPR);
  • have your data erased (Article 17 GDPR);
  • restrict processing (Article 18 GDPR);
  • receive your data in a portable format (Article 20 GDPR);
  • withdraw any consent you have given, with effect for the future (Article 7(3) GDPR).

Right to object (Article 21 GDPR): Where we process your data on the basis of our legitimate interests (Article 6(1)(f) GDPR), you can object at any time for reasons arising from your particular situation. We will then stop the processing unless we can demonstrate compelling legitimate grounds, or the processing serves the establishment, exercise or defence of legal claims.

To exercise your rights, write to office@dpp24.org. If your request concerns passport content or a destination address of one of our customers, we will forward it to that customer, who is responsible for it.

16. Right to lodge a complaint

If you believe that the processing of your data violates data protection law, you can lodge a complaint with a supervisory authority, in particular in the EU member state of your residence, your place of work or the place of the alleged infringement. In Austria, this is:

Österreichische Datenschutzbehörde (Austrian Data Protection Authority)
Barichgasse 40–42, 1030 Vienna, Austria
Email: dsb@dsb.gv.at
Web: dsb.gv.at

17. Changes to this policy

We will update this policy when our services, our service providers or the legal requirements change. The current version is always available at dpp24.org/privacy.