--- title: "What is GDPR and how does Linkbreakers handle it?" description: "A plain explanation of GDPR for QR code and link campaigns: what counts as personal data, who is responsible, which rights visitors have, and which tools Linkbreakers gives you to handle them." canonical: "https://linkbreakers.com/help/article/what-is-gdpr-and-how-does-linkbreakers-handle-it" last-updated: 2026-10-24 --- # What is GDPR and how does Linkbreakers handle it? > A plain explanation of GDPR for QR code and link campaigns: what counts as personal data, who is responsible, which rights visitors have, and which tools Linkbreakers gives you to handle them. ## Short answer The General Data Protection Regulation (GDPR) is the EU law on personal data. It applies to you whenever your QR codes or links are scanned by people in the European Economic Area, even if your business is based elsewhere. When you use Linkbreakers, you are the controller of your visitors' data and Linkbreakers is your processor: you decide what is collected and why, and Linkbreakers gives you the settings and tools to limit collection and to delete, correct and export visitor data. Linkbreakers does not make your campaigns compliant for you. ## Quick summary - GDPR covers any information about an identifiable person, including IP addresses and cookie identifiers, not only names and emails. - Every processing needs a lawful basis, such as consent or legitimate interest, which you choose as the controller. - Linkbreakers lets you choose a data collection level per workspace or link: None, Basic or Advanced. - Visitors have rights of access, rectification, erasure, restriction, objection and portability. You answer these requests with the dashboard and API tools described below. - Linkbreakers hosts data in the United States and relies on safeguards such as Standard Contractual Clauses for transfers. ## How it works ### Key GDPR principles for QR code campaigns - **Lawful basis:** every processing must rely on one of the bases in Article 6, such as consent, contract or legitimate interest. - **Transparency:** people must be told who processes their data, why, and how to exercise their rights, usually through your privacy notice. - **Data minimization:** collect only what you need for your purpose. - **Storage limitation:** do not keep personal data longer than needed. - **Security and accountability:** protect the data and be able to show how you comply. ### What counts as personal data in a scan - **Data visitors give you:** answers to your forms, such as an email address, phone number or name. - **Technical data:** the IP address, the `linkbreakers.browser` cookie and the device identifier derived from it, and device details. These can identify a person when combined with other information, so GDPR treats them as personal data. ### Roles | Data | Controller | Linkbreakers' role | |---|---|---| | Your visitors (scans, form answers) | You | Processor | | Your account and workspace members | Linkbreakers | Controller | | Visitors of linkbreakers.com | Linkbreakers | Controller | ### What Linkbreakers collects for you You choose the level for the workspace or for each link. A workspace with no setting uses None. | Data | None | Basic | Advanced | |---|---|---|---| | Scan time, link, destination, workflow steps | Yes | Yes | Yes | | `linkbreakers.browser` cookie (first-party, HttpOnly, 1 year) | Yes | Yes | Yes | | IP address (stored in full) | No | Yes | Yes | | User agent, device type, brand and model | No | Yes | Yes | | Browser, operating system and their versions | No | Yes | Yes | | Language and timezone | No | Yes | Yes | | Country, region, city, ISP and ASN (from the IP address) | No | Yes | Yes | | Screen size, graphics card, memory, processor cores, touch support, network information | No | No | Yes | Location comes from a local MaxMind GeoLite2 database, so IP addresses are not sent to MaxMind. No GPS position, latitude and longitude or postcode is collected. Answers to your forms are stored as visitor attributes and may be summarized by OpenAI. For the full field list, see [what data you can collect from QR code scans](https://linkbreakers.com/help/article/what-data-you-can-collect-from-qr-code-scans-location-device-behavior). ### Handling visitors' rights | Right | How to handle it in Linkbreakers | |---|---| | Access and portability | Export events and visitors as CSV. | | Rectification | Edit the visitor's attributes in the dashboard or through the API. | | Erasure | Delete the visitor profile in the dashboard or through the API. Scan events and devices are kept, unlinked from the profile. | | Objection and restriction | Lower the data collection level. This applies to future scans only. | If a visitor writes to Linkbreakers instead of you, we forward the request to the business that created the link. ### What you remain responsible for - Choosing and documenting a lawful basis for your campaigns. - Informing visitors, for example with a privacy notice linked from your form or landing page. - Collecting consent yourself when your use requires it. Linkbreakers has no consent management feature for links. - Deciding how long you keep data and deleting it. Linkbreakers has no automated retention periods. - Checking the tools you send data to through integrations, such as your CRM or webhooks. ## Limits and caveats - Deleting a visitor profile does not delete the related scan events and devices, which can include the IP address. - Data is kept as long as your workspace exists. Deleting the workspace deletes its links, media, members, events and visitors (after the subscription ends if there is one). Expiring links delete the link and its analytics. - All data is hosted in the United States. There is no EU data residency option. - Linkbreakers does not offer consent management or automated retention periods. - This article is general information, not legal advice. Your obligations depend on your use and your visitors' countries. ## Frequently asked questions ### Does GDPR apply if my business is not in Europe? Yes, if you target or monitor people in the European Economic Area, for example by placing QR codes there and analyzing who scans them. ### Do I need consent for every scan? Not always. Some processing can rely on legitimate interest, but cookies and device information can also fall under the ePrivacy rules in your visitors' countries. Assess your use, and use the None level if you only need basic counts. ### What happens if someone asks me to delete their data? Delete their visitor profile in the dashboard or through the API. The profile and its attributes are removed, but scan events and devices stay in your analytics, unlinked from the profile. ### Can I send visitor data to my CRM? Yes, through integrations or webhooks. You are responsible for having a lawful basis and for the tool you send it to. ### Where is my visitors' data stored? In the United States. The hosting providers and other service providers are listed in the [Privacy Statement](https://linkbreakers.com/privacy). ### Who do I contact with data protection questions? Write to [support@linkbreakers.com](mailto:support@linkbreakers.com). The supervisory authority for Linkbreakers in France is the CNIL. ## Sources - [Regulation (EU) 2016/679 (GDPR), official text on EUR-Lex](https://eur-lex.europa.eu/eli/reg/2016/679/oj) - [CNIL: the GDPR explained](https://www.cnil.fr/en/understanding-gdpr) - [European Data Protection Board: guidelines on controller and processor](https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-072020-concepts-controller-and-processor-gdpr_en) - [Linkbreakers Privacy Statement](https://linkbreakers.com/privacy) ## Last reviewed October 24, 2026.