This text is a translation of the Privacy Policy from Serbian. The Serbian version prevails. Send questions and requests to kontakt@qrref.net.
Privacy Policy
Version 2026-10-14 · QRREF (qrref.net)
This policy explains which personal data we collect when you use the QRREF platform, why, how long we keep it, who we disclose it to and what your rights are. Processing is carried out in accordance with the Personal Data Protection Act of the Republic of Serbia (“Official Gazette of the RS”, no. 87/2018, hereinafter: ZZPL).
1. Controller
The controller of personal data is QR Referral DOO, Ulica i broj, Beograd, tax ID (PIB) 123456789, company registration number 12345678 (hereinafter: “QRREF”, “we”). For any questions about data processing and to exercise your rights, write to kontakt@qrref.net.
For data about share recipients that a promoter enters themselves (section 3.6), the controller is the promoter, and QRREF processes that data on their behalf, as a processor.
2. Whose data we process
- Guests — people who use a code or QR for a discount. Guests have no account and, unless they register themselves as loyalty members (section 3.7), do not leave a name or contact details.
- Loyalty members — guests who, after several visits to a venue, voluntarily register for that venue’s loyalty membership, or whom the venue adds to its own loyalty list.
- Promoters — people who open an account to recommend venues and earn a fee.
- Venues — owners and staff of venues who use the scanner, reports and settlement.
- Recommenders — people who submit a recommendation of a venue or place (with or without an account).
- Share recipients — people to whom a promoter sends a recommendation, if the promoter enters their contact details.
- Website visitors.
3. Which data, why and on what basis
Legal bases under Article 12, paragraph 1 of the ZZPL: contract (processing necessary for the performance of a contract with you or to take steps at your request before entering into a contract), legal obligation, legitimate interest and consent.
3.1. Promoters
| Data | Purpose | Basis |
|---|---|---|
| Name, email, password (stored only as a one-way hash), language | Account and login, account notifications | Contract |
| Social network profiles, niche, profile picture, public page and its title | Display to venues and guests, public page with recommendations | Contract |
| Codes, scans, campaigns, entry channel, payouts | Fee calculation and payout | Contract; legal obligation (accounting) |
| Tax ID (PIB), address, account number, form (individual / sole trader) | Payout, invoices and tax obligations | Contract; legal obligation |
3.2. Venues (owners and staff)
| Data | Purpose | Basis |
|---|---|---|
| Name, email, password (hash), role, language | Account, login, scanner access | Contract |
| Signatory’s name, time and text of accepted terms, IP address at acceptance | Proof of the concluded contract and the accepted campaign terms | Contract; legitimate interest (proof) |
| Venue contact phone (for a managed partner) | Arranging cooperation | Contract |
3.3. Guests
| Data | Purpose | Basis |
|---|---|---|
| Time and place of code redemption, fee amount | Record of redemption and settlement between the venue, the platform and the promoter | Legitimate interest |
| Anonymous device identifier (cookie), how the code was opened (e.g. QR, Instagram), browser type | Personal code from the sharing chain, preventing double counting, channel statistics | Legitimate interest |
| Answer to the question “did you get the discount”, when a scan is missing | Correct record of discounts and quality of the venue’s service | Legitimate interest |
| Anonymous device identifier, venue, number of different days of visits and date of the last visit (only for venues that enabled membership through scans) | To offer loyalty membership to a guest who returns regularly | Legitimate interest |
From this data we do not establish your identity and we do not build guest profiles, unless you register yourself as a loyalty member (section 3.7).
3.3.1. Location when a code is opened
When a guest opens a code, the browser may ask for permission to share an approximate location. Purpose: control of performance-based payment — a promoter is paid only for redeemed scans, so we check whether the code was opened near the venue. What we store: only the distance from the venue and the accuracy of the measurement; we do not store the guest’s coordinates. Retention: no time limit. Basis: consent (permission in the browser). The permission is optional, and if you do not allow it, the discount you receive stays the same.
3.4. Recommenders
| Data | Purpose | Basis |
|---|---|---|
| Recommendation text, name and place of the venue, category, photo (if you send one) | Publishing the recommendation and linking it to the venue | Consent (by sending the recommendation) |
| Contact (email or phone) — optional | Notification when the venue you recommended starts a promotion | Consent (you can withdraw it at any time) |
| Approximate location — only if you allow it in the browser | Finding the venue on the map faster | Consent |
| IP address, device identifier | Protection against abuse (mass submission) | Legitimate interest |
3.5. Security and records
IP addresses of login attempts (protection against password guessing), a record of changes to key data (who changed what and when — for proof and dispute resolution) and technical error reports. Error reports are sent without cookies, IP addresses, form contents and secret tokens. Basis: legitimate interest.
3.6. Share recipients
When a promoter shares a recommendation, they may optionally enter who they are sending it to (description, phone or email). Only that promoter sees this data, can delete it at any time, and must enter it only with the recipient’s consent. Website visitors who share recommendations do not leave data about recipients — only the channel is recorded (e.g. WhatsApp). Whether the link was opened is also recorded, without data about the person who opened it.
3.7. Loyalty membership
Loyalty membership is a loyalty programme run by the venue where you are a member. The controller of the member’s data is that venue; QRREF processes this data on the venue’s behalf, as a processor, and provides the platform (member list, card, scanner).
| Data | Purpose | Basis |
|---|---|---|
| Name, email address and phone number; card code and validity; time and version of consent | Running the loyalty membership, issuing and checking the card, recognising the member at the till and applying the benefits the venue provides for members | Consent (Art. 12, para. 1, item 1 ZZPL) |
| Time of visits when staff scan your card; category message and personal message the staff see on the scanner | Recognising the member and applying benefits | Consent |
| Note, date of birth, and for a visit a comment, bill amount and photo of the bill — only if the venue enters them | The venue running its loyalty programme | Responsibility of the venue as controller |
You give consent with the checkbox in the registration form and can withdraw it at any time, without consequences for the discount you already use; withdrawal does not affect the lawfulness of processing before withdrawal. For members entered in the list by the venue itself, the venue is responsible for the basis of the entry.
Who sees the data: the venue (owner and staff it authorises), QRREF administrators for support and the processors from section 4. The venue receives an email with the new member’s data at its notification address. The card image contains the venue’s name, your name, the code and the validity; anyone who has the card link or code can see it, so do not share it.
Google Wallet: if you choose “Add to Google Wallet” yourself, the card is stored in your Google Wallet. Google then receives the venue name, your name (if entered), the card code and the card’s expiry date, and processes them under its own terms and privacy policy. Until you choose that option, QRREF sends nothing to Google. After that, QRREF also sends Google changes to that card (new code, deactivation, expiry) so the copy in Wallet stays accurate. You can remove the card from Wallet yourself at any time.
Retention: while you are a member, until you withdraw consent or ask for deletion; bill photos are deleted after 90 days. The card is valid until 31 December of the current year. We do not use the data for advertising by third parties and we do not sell it.
Withdrawal, access and deletion: write to kontakt@qrref.net or to the venue where you are a member; we reply within the time stated in section 9.
4. Who we disclose data to
- Venues — data about redemptions of their campaigns (time, code, promoter, amount, channel). A venue does not receive data about guests, except data of members who registered themselves (section 3.7).
- Promoters — data about redemptions of their codes and payment, without data about guests.
- The public — published recommendations (without the recommender’s contact) and promoters’ public pages, if the promoter enables them.
- Processors that provide technical services for us: hosting and database (Railway), sending emails (Resend), error reports (Sentry, EU region), maps and place data (Google — only the name and place from the recommendation), automatic checking of recommendation content (Anthropic — only the recommendation text). We have contracts or accepted contractual terms with processors that oblige them to protect data.
- State authorities — when required by law.
We do not sell data and we do not use it for advertising by third parties.
5. Transfers of data abroad
Some processors have servers outside the Republic of Serbia (European Union and United States of America). Transfers are made in accordance with Articles 63–65 of the ZZPL: to countries with an adequate level of protection, or with appropriate safeguards (standard contractual clauses).
6. How long we keep data
| Data | Period |
|---|---|
| Promoter and venue account | While the account exists; after the account is deleted, at most 30 days, except the data in the next row |
| Redemptions, settlement, payments, payouts, invoices and accepted terms | For the periods prescribed by the Accounting Act and tax regulations (at least 10 years for accounting documents), or while a dispute may arise |
| IP addresses and technical data on code openings | 12 months (then deleted or anonymised automatically) |
| Distance from the venue and accuracy of the measurement when a code is opened | No time limit |
| Loyalty member data (name, email, phone, visits) | While you are a member, until you withdraw consent or ask for deletion |
| Device visit counter before registering for membership | 24 months after the last visit (then deleted automatically) |
| Bill photos for a loyalty visit | 90 days |
| Login attempts | 30 days |
| Published recommendations | While they are published or until you ask for deletion |
| Recommender’s contact | Until consent is withdrawn |
| Data about share recipients | Until the promoter deletes it or their account is closed |
| Record of changes | As long as the data it relates to |
7. Cookies
| Cookie | Purpose | Duration |
|---|---|---|
| Session | Account login and security (necessary) | Until logout, at most 30 days |
| Language | Remembering the chosen language | 1 year |
| qr_uredjaj | Anonymous device identifier: your personal code in the sharing chain, preventing double counting of openings and linking a redemption to a channel, counting visits to offer loyalty membership | 2 years |
We use marketing cookies and the Meta Pixel only with your consent, given in the banner on the page; we have no other advertising cookies or third-party tracking cookies. On pages with an embedded Google map, Google may set its own cookies under its privacy policy. You can delete cookies in your browser settings; the personal code from the chain will then no longer be recognised on that device.
Meta (Facebook, Instagram). With your consent we load the Meta Pixel and send Meta Platforms Ireland Ltd. events about collecting a code and about redeeming an offer at a venue (category, venue, campaign, value), together with device identifiers (_fbp, _fbc, IP address, browser) and, if you gave them with a separate consent, a hashed (SHA-256) email or phone number. Meta uses them to measure ads and to show our offers; QRREF also uses redemption data for its own offers from other partners. You can withdraw consent at any time through the “Cookie settings” link at the bottom of the page; we then delete the stored Meta signal of your device and stop sending events. We keep the signal for at most 180 days. Legal basis: consent. We keep a contact (email, phone) left with separate consent for at most 12 months; an email we send a code to without that consent is not stored.
8. Automated processing
The text of a recommendation is automatically checked by an artificial intelligence system (whether the recommendation is positive and free of insults and personal data), which may correct spelling and suggest publication. Unclear recommendations are reviewed by a person. On your request, an administrator reviews the decision on the recommendation. We do not make other automated decisions with legal effect about you.
9. Your rights
Under the ZZPL you have the right to: information and access to data (Art. 26), rectification and completion (Art. 29), erasure (Art. 30), restriction of processing (Art. 31), portability (Art. 36), objection to processing based on legitimate interest (Art. 37) and withdrawal of consent at any time, without affecting the lawfulness of earlier processing.
Send your request to kontakt@qrref.net. We reply without delay and at the latest within 30 days (the period may exceptionally be extended in accordance with the ZZPL). For your protection, we may ask for proof of identity.
You have the right to lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection, Bulevar kralja Aleksandra 15, 11000 Belgrade, www.poverenik.rs.
10. Minors
Only adults can open a promoter or venue account. Persons under 15 should not send recommendations with their contact details without the consent of a parent or guardian. Loyalty membership is not intended for persons under 15 without the consent of a parent or guardian.
11. Data security
All traffic is encrypted (HTTPS); we store passwords only as one-way hashes; login is temporarily blocked after several failed attempts; access to data is restricted by roles; every change to key data is recorded; we make regular backups; the test environment contains no real personal data. In the event of a data breach we act in accordance with Articles 52–53 of the ZZPL.
12. Changes to this policy
We notify users with an account of material changes by email or an in-app notice. The version and date are shown at the top of this page.