QRprofessionals
Privacy policy
Last updated: 12 October 2026
Controller
Using QRprofessionals involves processing some personal data: this policy explains which data, why and on what legal basis, under the GDPR. You can delete your account and all its content yourself, from your dashboard, at any time. Controller for accounts and the site: Arturo Carrasco. Contact, including to exercise your rights: hola@qrprofessionals.com.
What data we process
Account: your Google email when you sign in. Websites: the text and photos each professional publishes. Form messages: name, email and, if the professional asks for them, phone, the service of interest and preferred reply, plus the message itself; and the notes, statuses and follow-up dates the professional adds in their dashboard. Our own analytics: usage events with a random local identifier, with no third-party cookies. Google Analytics (only if you accept the cookie notice): pseudonymous identifiers and technical usage data.
If you contact a professional
When you fill in the form on a professional's website, that professional is the controller of your data: they use it to reply to you and handle your request. QRprofessionals stores it on their behalf as a processor: only they see it in their dashboard and we don't use it for anything else. To exercise your rights over it, contact the professional; if they don't reply, write to us at hola@qrprofessionals.com. Please don't include health information in your message: the form isn't meant for it.
Legal basis and purposes
Performance of the service (creating and showing websites and delivering form messages), consent (given by whoever sends the form when they send it; and Google Analytics, only if you accept it, revocable at any time) and legitimate interest (our own analytics that identify nobody, and the security of the service, including limits on mass sending).
Processors and recipients
We use providers acting as processors: Supabase (database and authentication, EU region in Paris), Cloudflare (hosting, web delivery and notification email) and Google (sign-in and, if you accept the cookie notice, audience measurement with Google Analytics). We don't sell data or share it with third parties for advertising.
Retention
Messages are kept for as long as the professional keeps them in their dashboard, where they can delete them one by one at any time. Deleting a website immediately removes the website and all its messages; deleting the account removes the account, its website and its messages.
Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction and portability in the most direct way: from your dashboard you can view and correct your data, and deleting the account immediately and permanently removes all your content. You can also complain to the Spanish Data Protection Agency (aepd.es).
International transfers
Some processors (Cloudflare and Google) may process data outside the European Economic Area. In those cases, the transfer relies on adequacy decisions or on the European Commission's standard contractual clauses, which guarantee an equivalent level of protection.
Measurement with Google Analytics (only if you accept it)
If you accept the cookie notice, we load Google Analytics 4 to learn which pages are visited and through which channel people arrive, with pseudonymous identifiers; we don't use it for advertising or build commercial profiles, and advertising signals are always off (Consent Mode). The legal basis is your consent, which you can withdraw at any time by clearing this site's data in your browser: the tool stops loading and the notice asks you again. The provider is Google Ireland Limited (Gordon House, Barrow Street, Dublin, Ireland), which may transfer data to Google LLC in the United States under the EU-US Data Privacy Framework. The identifiers last at most two years in your browser.