Privacy

The data controller is QR Codes for Good, 5 Millnain Croft, Fodderty, Strathpeffer, IV14 9EA. You can reach us at hello@qrforgood.com about anything on this page.

Last updated: 9 September 2026.

Your email address

Collected so we can send you the files you paid for, and so we can reach you if something goes wrong with the order. Lawful basis: performance of a contract with you.

The destination address for your code

We need it because it is literally what gets encoded into the code. Lawful basis: performance of a contract.

Any logo you upload

Used only to place your mark in the centre of your codes. Lawful basis: performance of a contract.

Your colour choices and, for bulk orders, your labels

Used to generate and name the files. Labels are also printed on the PDF contact sheet we send you.

A charity number, if you enter one

Only used to check eligibility for the 50% charity discount against the relevant public register. Lawful basis: performance of a contract (we cannot apply the discount without checking it). This is public register information, not personal data about you.

Payment information

Handled entirely by Stripe. We never see or store your card number. We receive only a confirmation that payment succeeded, plus the reference Stripe gives the transaction.

• We don't track scans of your codes. We can't — the codes are static, so scanning one never touches our servers.
• We don't add you to a mailing list or send marketing.
• We don't sell, rent or share your data with anyone for their own purposes.
• We don't ask you to create an account, so there is no password to leak.
• We don't run advertising or analytics trackers that profile you across other websites.

These are our processors. Each one is used for exactly one job:

• Stripe — takes the payment. See Stripe's own privacy policy for how they handle card data.
• Vercel — hosts the website, runs the code that generates your files, and stores your uploaded logo while your order is processed and a copy of your finished files for the order page.
• Resend — delivers your files to your inbox.

Some of these operate outside the UK. Where they do, transfers are covered by the UK's international data transfer arrangements, including the UK Addendum to the EU Standard Contractual Clauses.

• Your uploaded logo: deleted automatically as soon as your order has been delivered. It is held only for the short time between you uploading it and your finished code reaching your inbox — usually a few seconds.
• Your list of destinations on a bulk order: stored only while the order is being produced, and deleted with the logo once the pack has been emailed to you.
• Your generated QR files: emailed to you, and a copy is kept on our storage so that your order page can offer a download if the email goes astray. The files contain only the code itself and the destination you gave us. We delete them on request.
• Order records (email, destination, amount, Stripe reference): kept for six years, because HMRC requires business records to be retained for that long.
• Emails you send us: kept while the query is open and for a reasonable period afterwards in case you come back about it.

This site sets no advertising or analytics cookies, which is why you aren't being asked to accept any. Stripe may set cookies necessary for fraud prevention when you are on their checkout page; those are governed by Stripe's policy, not ours.

Under UK GDPR you can ask us to:

• give you a copy of the personal data we hold about you;
• correct anything that's wrong;
• delete it, where we don't have a legal reason to keep it (our tax records being the main exception);
• restrict or object to how we're using it;
• send it to you, or to someone else, in a portable format.

Email hello@qrforgood.com and we'll deal with it within one month. There's no charge.

If you think we've handled your data badly, please tell us first — but you have every right to go straight to the Information Commissioner's Office at ico.org.uk, or on 0303 123 1113.