Choose country
Choose country

Privacy Policy

QRGATE is built for secure event operations. Below we explain what data is processed, why it is needed, how long it is kept, and what rights you have under GDPR.

1. Data controller and contact

Service: QRGATE.org (QR invitation and check-in SaaS)

Data Controller: Dániel Cser, Sole Proprietor (Hungary), operating QRGATE.org

Contact: support@qrgate.org
Website: https://qrgate.org

For event-specific guest data, the event organizer who invited you typically acts as the data controller. QRGATE acts as a data processor for those data sets.

2. Purposes of processing

  • Account creation and authentication for organizers;
  • Event and guest list management;
  • Sending QR invitations by email (upon organizer action);
  • Recording and auditing check-in events (who checked in and when);
  • Security, fraud prevention, and abuse protection;
  • Optional anonymous analytics (only with consent via cookies).

3. Categories of data

a) Registered users (organizers)

  • Name, email address, password (hashed)
  • Billing details (company name, address, VAT/tax details - if provided)
  • Security logs (e.g., login timestamps, technical security signals)

b) Invitees and attendees

  • Name, email address, optional labels/tags (VIP, press, partner, etc.)
  • Event identifier, QR token (technical code)
  • Check-in timestamps and status (audit trail)

c) Website visitors

We use essential cookies for functionality. Optional analytics cookies are used only with consent. See: Cookie Notice.

4. Legal bases and retention

  • Organizers: performance of a contract (GDPR Art. 6(1)(b)); data is deleted when the account is terminated, subject to compliance needs.
  • Invitees: legitimate interests (GDPR Art. 6(1)(f)) for invitation-based access control and venue security; event-related data is typically deleted or anonymized after a reasonable period set by the organizer and/or tenant policy.
  • Analytics: consent (GDPR Art. 6(1)(a)); retention is aligned with cookie consent settings.

5. Data security

Passwords are stored using strong hashing (e.g., bcrypt). Data in transit is protected with TLS/SSL. Access to event data is restricted by role and tenant boundaries, and is available only to authorized organizer accounts.

6. Data sharing and processors

We do not sell personal data. We may use vetted service providers to operate the platform (e.g., hosting, email delivery, monitoring). These providers act under contractual data protection obligations appropriate to their role.

7. Your rights under GDPR

  • Right of access, rectification, erasure, and restriction;
  • Right to object (where processing is based on legitimate interests);
  • Data portability (where applicable, e.g., organizer account data);
  • Right to withdraw consent at any time (for consent-based processing).

If you are an invitee, please contact the event organizer first for event-specific data requests. QRGATE will support the organizer as needed.

8. QR check-in data processing

The QR code typically contains only a technical token and does not include readable personal data. When scanned, the system verifies the token and records the scan time and result for access control and auditing. Logs are used to prevent misuse and ensure reliable entry operations.

Privacy questions or GDPR requests:

Contact support

Last updated: 20 Feb 2026