QRLoom

Data Processing Terms

Last updated: 5 October 2026

These terms apply when you (the “Business”) use QRLoom to collect personal data from your customers. They form part of our Terms of Service. Under Thailand’s Personal Data Protection Act B.E. 2562 (“PDPA”), you are the data controller and QRLoom is your data processor.

1. What we process for you

  • Data subjects: your customers and visitors who submit a lead form, join a stamp card, claim a coupon, or scan your dynamic QR codes.
  • Data: the form fields you choose (e.g. name, phone, email, LINE ID, message); for stamp cards and coupons a keyed hash of the phone number, its last four digits, an optional nickname, stamps, rewards and coupon codes; consent records (the exact notice shown, a version hash, time, marketing choice); keyed hashes of IP addresses; scan logs (time, approximate location from IP, device, browser, referrer).
  • Purpose: only to provide the features you use — storing and showing you the data, sending the notifications you switch on (email, LINE), exports, and keeping the service secure.
  • Duration: until you delete the data, the page or code, or your account (see Section 5).

2. Our commitments as processor

  • We process this data only on your documented instructions — your settings in QRLoom are those instructions.
  • We never sell it, use it for our own marketing, or use it to train AI models.
  • People who can access it are bound by confidentiality, and access is limited to what is needed to run the service.
  • We keep appropriate security measures: encryption in transit, row-level security so only your account can read your data, server-only writes, and hashing of phone numbers and IP addresses.
  • We use the sub-processors listed in our Privacy Policy (Section 6), bound by data protection terms, and will update that list before adding new ones.
  • Some sub-processors are outside Thailand; transfers rely on the safeguards the PDPA allows (Privacy Policy, Section 7).
  • We help you answer your customers’ requests (access, correction, deletion, objection). Requests sent to us by your customers will be forwarded to you.
  • If we become aware of a personal data breach affecting your data, we will tell you without undue delay with the information you need to notify the PDPC and affected people.

3. Your responsibilities as controller

  • Fill in the privacy notice in the editor accurately (your name, purpose, retention, contact). QRLoom shows it to customers before they submit and stores the exact text they agreed to.
  • Collect only what you need, and have a lawful basis for it.
  • Send marketing only to customers who ticked the separate, optional marketing box.
  • Respond to your customers’ PDPA requests; you can delete a response or member at any time in the dashboard.
  • Keep exported files and notification emails / LINE messages secure.
  • Don’t use QRLoom to collect sensitive data (health, religion, biometrics, criminal records, etc.).

4. Built-in PDPA tools

Forms, stamp cards and coupons can’t be published without a complete privacy notice; marketing consent is a separate, unticked box; every submission keeps a consent record; phone numbers are stored only as keyed hashes plus last four digits; and you can export or erase records yourself.

5. Deletion

When you delete a response, member, page or code, the related data is removed from our active database. When your account is deleted, all data we process for you is deleted with it. Backups are overwritten on a rolling basis.

6. Contact

Questions about these terms or a customer request you need help with: shop.mellotopup@gmail.com.