Privacy Policy

What we collect

Account data (email, password hash, company name), the product data you enter (GTINs, descriptions, e-label content), and payment records processed by Paystack — we never see or store card numbers. Server logs record IP addresses for security and abuse prevention.

What we deliberately don't collect — e-label & scan privacy

E-label pages served for your products carry no tracking, no cookies, no scripts and no analytics — enforced in software, per Regulation (EU) 2021/2117's requirement that no user data be collected or tracked via the e-label. Consumers who scan your products are never profiled by us.

Scan statistics shown to producers are aggregate daily counters only: one number per product per day. We do not store IP addresses, device details, or any per-scan records for analytics — there is nothing to profile, by design.

How data is used

To operate the service: hosting your product pages, resolving your QR codes, billing, and transactional email (verification, password resets, invitations). We do not sell or share personal information with third parties for marketing.

Processing & storage

Data is hosted on our own infrastructure. Payments are processed by Paystack. Transactional email is delivered via our email relay provider. We process personal information in accordance with POPIA (South Africa) and, where applicable, GDPR.

Cookies

The application uses a session cookie to keep you logged in and a CSRF token to protect forms. The public website and e-label pages set no cookies.

Retention

Security and change logs (logins, password changes, product edits) are kept for 12 months. Outbound email records are kept for 90 days. When an account is erased we keep a minimal erasure receipt (a hash of the email address and counts of what was removed — no content) and invoices for 7 years, as South African company and tax law requires. Scan counters are daily totals with no personal data and are kept indefinitely.

Your rights

You can download everything we hold about you (JSON) and delete your account yourself from Account settings; deletion takes effect after a 30-day grace period during which you can cancel. You can also contact support@paqlink.com. Deleting a product removes its resolver record; deleting your account removes your personal information within 30 days, subject to legal retention requirements for billing records.