Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between DynamiHost (“Processor”) and the customer (“Controller”) and applies whenever the Processor handles personal data on the Controller’s behalf through the DynamiHost service.

1. Subject matter, nature, purpose and duration

The Processor provides a hosted dynamic QR code platform: QR code creation and hosting, scan redirects, scan analytics, hosted pages, hosted files, webhooks, a support helpdesk and related features. Personal data is processed only to provide, secure and support the service, for the duration of the customer’s account plus a reasonable wind-down period for deletion.

2. Types of personal data and data subjects

• Account data: names, email addresses, authentication credentials (stored hashed), team roles and activity logs of the Controller’s users.
• Scanner data: IP addresses (truncated when the Controller enables IP anonymization), coarse device, operating system and browser details, and country and city derived from IP.
• Support data: messages and file attachments the Controller’s users send through support tickets. Attachments are stored in object storage and are accessible only to the Controller’s users and the Processor’s support staff, through authenticated downloads.
• Data subjects: the Controller’s employees and collaborators, and individuals who scan the Controller’s QR codes.

3. Processor obligations

• Process personal data only on the Controller's documented instructions, including transfers, unless required by law (in which case the Processor informs the Controller beforehand where permitted).
• Ensure persons authorized to process the data are bound by confidentiality.
• Not sell personal data and not use it for advertising or profiling.
• Delete or return all personal data at the end of the service as described in section 10.

4. Sub-processors

The Controller gives general authorization for the following sub-processors:

• Hetzner: server hosting and S3-compatible object storage, located in the EU (Germany) (hetzner.com/legal/privacy-policy).
• Paddle: payment processing as merchant of record (paddle.com/legal/privacy).
• DynamiHost mail server: transactional email delivery, self-hosted on Hetzner infrastructure (no third-party email processor).
• Cloudflare: content delivery, DDoS protection and edge security (cloudflare.com/privacypolicy).

The Processor will inform the Controller before engaging a new sub-processor, giving the Controller a reasonable opportunity to object on data protection grounds. Each sub-processor is bound by data protection obligations at least as protective as this DPA.

5. Assistance with data subject rights

The Processor assists the Controller in fulfilling requests from data subjects (access, rectification, erasure, portability, objection and restriction), including through self-service tools in the dashboard (data export and workspace deletion under Settings, Privacy and data) and, where needed, manual assistance within a reasonable time.

6. Security measures

• Encryption in transit (HTTPS with HSTS) for all traffic.
• Passwords stored as bcrypt hashes; optional TOTP two-factor authentication with backup codes.
• Service credentials encrypted at rest (AES-256-GCM); separate least-privilege database credentials for client and staff data.
• Edge protection and bot filtering via Cloudflare; server firewall limited to SSH/HTTP/HTTPS.
• Automated nightly backups of databases and hosted files, kept on the server and replicated to EU object storage (newest 14 sets, plus monthly anchor sets for up to 90 days), and database-only backups every 6 hours kept on the server for 7 days.
• Scan events automatically pruned after the configured retention window; audit logging of administrative actions.

7. Personal data breach notification

The Processor will notify the Controller without undue delay, and where feasible within 72 hours of becoming aware of a personal data breach, describing the nature of the breach, the categories and approximate number of data subjects concerned, likely consequences and measures taken or proposed.

8. International transfers

Primary hosting is in the EU. Where sub-processors transfer personal data outside the EEA (for example to the United States), transfers rely on an EU adequacy decision, the EU-US Data Privacy Framework where applicable, or Standard Contractual Clauses incorporated into the sub-processor’s terms.

9. Audit rights

The Controller may, on reasonable notice and no more than once per year, audit the Processor’s compliance with this DPA through a mutually agreed independent auditor, at the Controller’s expense and subject to confidentiality.

10. Return and deletion

On termination, or at any time via the dashboard’s self-service workspace deletion, the Processor deletes the Controller’s personal data, including QR codes, scan data, uploaded files, team information and support tickets including their attachments. Closed support tickets are also purged automatically, together with their attachment objects, once the retention period configured for their category has passed. Residual copies held in backups are purged as the sets roll: database-only sets within 7 days, nightly full sets within about 14 days, and monthly anchor sets within 90 days of deletion. Aggregated, anonymized statistics that cannot identify individuals may be retained.

11. Liability

Each party’s liability under this DPA is subject to the limitations and exclusions in the Terms of Service. Nothing in this DPA limits liability that cannot be limited by law.

12. Term and precedence

This DPA takes effect when the customer accepts the Terms of Service and remains in force while the Processor handles the Controller’s personal data. In case of conflict between this DPA and the Terms of Service on data protection matters, this DPA prevails.

13. Contact

Data protection questions: [email protected]