1. Roles
1.1 For scan statistics and any personal data contained in code destinations or labels, you are the controller and Leading Logic Ltd is the processor.
1.2 For your account details and orders, we are an independent controller, as described in our privacy notice.
2. Subject matter and duration
2.1 Processing redirects for your codes and producing scan statistics, for as long as your account exists.
3. Nature of the data
3.1 Scan statistics are aggregated by day, country and device type. They contain no IP addresses and no identifiers of the people who scan.
3.2 Destinations and labels are whatever you enter. Please don’t put personal data in them unless you need to.
4. Our obligations
We will:
- process personal data only on your documented instructions, which are these terms and your use of the Service;
- ensure staff with access are bound by confidentiality;
- apply appropriate technical and organisational security measures, including encryption in transit and at rest, least-privilege access and audit logging;
- help you respond to data subject requests and meet your security and breach-notification obligations;
- notify you without undue delay after becoming aware of a personal data breach;
- delete or return personal data at the end of the Service, except code identifiers, which are kept to prevent reuse;
- make available the information needed to demonstrate compliance.
5. Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Amazon Web Services | Hosting and content delivery | [regions to be confirmed] |
| Google (Web Risk) | Destination safety checks (destination addresses only) | [to be confirmed] |
| Stripe / Onelink, LLC | Payments (for orders, as independent controllers) | [to be confirmed] |
We will tell you before adding or replacing a sub-processor, and you may object.
6. International transfers
[Transfer mechanisms (UK IDTA / EU SCCs) to be confirmed by our lawyers.]