← All notes

What a business must watch when QR carries a campaign

The matrix holds an address, while the business answers for the destination, the data collected there and how any promotion is labelled. Use the list below as practical guidance. It does not replace advice from a lawyer.

Handling personal data

When a scan gathers identifiers, contact details or behaviour events, you may need a lawful basis, a privacy notice and consent where the statute asks for it. Keep forms short and keep sensitive values out of the URL. The privacy article walks through ethical collection patterns.

Limits on promotion

A QR promotion follows the same advertising rules as any other channel: say that it is an ad, honour category limits and keep the offer honest. If the pack leads to a promotion, the terms should be reachable without burying them behind a long chain of clicks.

Who answers for the page

The campaign owner is responsible for a destination that stays safe and current. A static print locks the URL. A dynamic code on QRcode Global can be pointed elsewhere if the landing breaks or a risk shows up. Recheck links so they do not land on phishing or an expired offer.

Records you can show later

Note URL changes, print dates and the person who owned each version. Those records help an incident review and show due diligence. Teams running many campaigns can keep a central cabinet on QRcode Global and an internal changelog beside it.