Privacy Notice

Date: April 1st, 2025

Intro

Readdle Limited (“Readdle” or “we”) welcomes you on our website scannerpro.io (“Website”).

We provide you with our application “Scanner Pro” (“App” or “Scanner Pro”) available on iOS and iPadOS, subject to the terms and conditions of ourTerms of Service and Privacy Notice.

This Privacy Notice describes which of your personal data the Website collects, how stores, processes, and uses it, and what happens when you use the Website.

We understand you care about your privacy, and we appreciate the trust you place in us. To justify that trust, we embed the latest data security standards, improve our awareness of privacy matters, and comply with the General Data Protection Regulation and other privacy laws.

Intro
Table of Contents
About Us
About You
Personal Data
- Sources of Data
- Lawful Basis for Processing
Personal Data on the Website
Data Sharing with Third Parties
Data Transfer Outside the European Economic Area
You can read more detailed measures to protect your personal data here.
Security Measures
Data Subjects Rights
Privacy Notice Updates

About Us

Controller	Readdle Limited Company number: 630281 Glandore Business Centres, 26-27 Fitzwilliam Place, Fitzwilliam Hall, Dublin 2, D02T292, Ireland
Data Protection Officer	Privacity GmbH Neuer Wall 50, 20354 Hamburg, Germany
Email	rdsupport@readdle.com– for general inquiries
Email	dpo@readdle.com– for privacy inquiries

About You

When you visit our Website, you become our user (“User”). Please note that we do not knowingly process the personal data of Users under the age of 18. If you are such a User or you are a legal representative of such a User, please contact us.

Personal Data

Sources of Data

We receive data when you visit our Website and interact with it, depending on your actions on the Website.

We may also, although we do not necessarily do so, receive data from third parties.

Lawful Basis for Processing

To process your personal data, we rely on one of the following lawful bases:

performance of the contract — for the processing of personal data necessary for the negotiating on, conclusion, and performance of a contract with you;
legal obligation — for the processing of data as required by applicable laws or if requested by a law enforcement agency, court, supervisory authority, or another state-authorized public body;
legitimate interest — for the processing necessary for the development of our services and security, taking into consideration your interests, rights, and expectations;
consent — for additional processing for specific purposes.

Personal Data on the Website

Subscription Data

We may collect and process data you provide when subscribing to our waiting list for the web application by Documents.

Data	Reasons for Processing	Lawful Basis	Data Storage
Email	Marketing mailing regarding the release	Consent	Stored until you unsubscribe or up to 2 (two) months after the feature release
Email	Arranging an interview with our team and asking for your feedback	Consent	We process data in this way until you withdraw your consent
Feature you are interested in	Marketing mailing regarding the release	Legitimate interest	Stored until you object or up to 2 (two) months after the feature release

Technical Data

Similar to many other websites, we collect certain data about our Users when you visit our Website.

Data	Reasons for Processing	Lawful Basis	Data Storage
Device info (IP address, device type, locale, country)	Marketing mailing regarding the release	Legitimate interest	Stored until you object or up to 2 (two) months after the feature release

Support Requests Data

When you address your request for support, we collect some information to help you.

Data	Reasons for Processing	Lawful Basis	Data Storage
Name	Assistance with and response to your request	Performance of contract	Stored during communication and for six (6) years after the last communication on the ticket.
Email
The product you have issues with
Subject of the letter
Message
The product you have issues with	Improvement of the Website and our products	Legitimate interest	Stored during communication and for six (6) years after the last communication on the ticket or until you object to the processing
Subject of the letter
Message

Feedback Data

Where we have your email, we may reach out to request your feedback. Your insights are invaluable to us for enhancing the App and improving user experience.

Data	Reasons for Processing	Lawful Basis	Data Storage
Email	To suggest an interview with our team and ask for your feedback	Consent	Stored during communication and for six (6) years after the last communication on the ticket or until you object to the processing

Data Sharing with Third Parties

We may share your personal data with third parties without causing you any harm and in strict compliance with applicable laws. Additionally, we have put in place organizational and technical measures to secure your personal data during its transfer to third parties.

To share your data, we rely on the following lawful bases such as consent, compliance with the law, and performance of a contract, depending on the specific circumstances.

Third Party	Description
Analytics tools	We use analytics tools to understand and promote our business.
Contractors	We cooperate with contractors to operate, develop, and improve the features and functionality of the Website, fulfill your support requests, etc. We sign data processing agreements with them and impose various security measures to ensure your data is safe.
Services our team uses	We use CRM systems, messengers, and other services in our organization to provide you with our services.
State authorities, courts, law enforcement agencies, etc	We may be obliged to transfer some of your data to tax authorities, courts, law enforcement agencies, and other governmental bodies: to comply with a government request, court order, or applicable law; to prevent unlawful use of the Website; to protect against claims of third parties; to help prevent or investigate fraud.
To get a detailed list of the third-party recipients of your personal data, contact us

Data Transfer Outside the European Economic Area

The personal data we collect is stored on the US servers, which participate in the Data Privacy Framework, and European Economic Area (“EEA”) servers, which fall under the General Data Protection Regulation.

We may share personal data with the recipients in the USA and other countries, including non-EEA ones, ensuring that your data is protected and processed in accordance with the General Data Protection Regulation.

To share the data outside the EEA, we rely on the adequacy decision by the European Commission or the Data Privacy Framework participation of the recipient. If the recipient does not participate in the Data Privacy Framework and its country is not deemed to provide an adequate level of protection for your personal data, we adopt Standard Contractual Clauses based on legislation assessments for data protection during transfer and storage.

You can read more detailed measures to protect your personal data here.

Security Measures

We routinely conduct Data Protection Impact Assessments to guarantee the implementation of adequate technical and organizational measures. These measures aim to prevent accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed.

To enhance the protection of your personal data, we employ HTTPS and encryption, establish segmented group and individual access (as necessary), conduct monitoring security audits, implement a corporate VPN, and adhere to formally approved internal policies, including those for password management and physical access.

Furthermore, we consistently monitor the state of the art of our technologies and diligently maintain backups. In case of the data deletion, the data are deleted from the backups within fourteen (14) days. Additionally, all our contractors are bound by contractual obligations that comply with GDPR requirements.

You can contact us in case of any questions regarding security issues.

Here you can find information about the specific steps we mentioned above:

Physical Measures
Limited Access to Premises
Organizational Measures
Policies and Instructions Password policy Monitoring and physical access policy Contractual obligations and corporate VPN Internal security policy Access control policy	Transfer Protection Data Transfer Agreements Standard Contractual Clauses Data Privacy Framework
Contractor and Staff Training	Agreements Non-disclosure Agreements Data Processing Agreements
Regular Access and Policy Review	Privacy Protection: Privacy by design and by default. Internal procedures for GDPR compliance
Code Review
Technical Measures
Encryption technologies: Encryption in transit and at rest Backup encryption	Backup Regular backup of the entire system Redundant operation of the critical services in multiple data centers controlled by a high-availability system
Multi-factor Authentication	Stress-tests
Static Code Analysis	Quality Assurance
Vulnerability Management	Dependency and Supply Chain Vulnerability Check

Data Subjects Rights

As a data subject, you have the right to access, manage, and control your data either directly or by submitting a request to us. This section outlines these rights and explains how you can exercise them based on your place of residence.

European Economic Area and United Kingdom Residents

Right	Description
Right to access	You can request an explanation of the processing of your personal data.
Right to rectification	You can change the data if it is inaccurate or incomplete.
Right to erasure	You can send us a request to delete your personal data from our systems. We will remove them unless otherwise provided by law.
Right to restrict the processing	You may partially or completely prohibit us from processing your personal data.
Right to data portability	You can request all the data you provided to us and request to transfer data to another controller.
Right to object	You may object to the processing of your personal data.
Right to withdraw consent	You can withdraw your consent at any time.
Right to file a complaint	If your request was not satisfied, you could file a complaint to the regulatory body.
To exercise your rights, contact us.
For EEA residents: We will answer your request within one (1) month. If your request is not satisfied, you can submit a complaint to your local Data Protection Authority. You may find it here.
For UK residents: We will answer your request within one (1) month. If your request is not satisfied, you can submit a complaint at the Information Commissioner’s Office via number 0303-123-1113 or go online at www.ico.org.uk/concerns.

United States Residents

Your rights may vary depending on the state of your residency, as indicated below.

Right	Description	Area
Right to access	You can request an explanation of the processing of your personal data.	California Colorado Connecticut Indiana Iowa	Montana Tennessee Texas Utah Virginia
Right to correct	You can change the data if it is inaccurate or incomplete.	California Colorado Connecticut Indiana	Montana Tennessee Texas Virginia
Right to delete	You can send us a request to delete your personal data from our systems.	California Colorado Connecticut Indiana Iowa	Montana Tennessee Texas Utah Virginia
Right to portability	You can request all the data you provided to us and request to transfer data to another controller.	California Colorado Connecticut Indiana Iowa	Montana Tennessee Texas Utah Virginia
Right to opt out of sales	The right to opt out of the sale of personal data to third parties.	California Colorado Connecticut Indiana Iowa	Montana Tennessee Texas Utah Virginia
Right to opt out of certain purposes	The right to opt out of processing for profiling/targeted advertising purposes.	Colorado Connecticut Indiana Montana	Tennessee Texas Utah Virginia
Right to opt out of the processing of sensitive data	The right to opt out of the processing of sensitive data.	California
Right to opt in for sensitive data processing	The right to opt in before the processing of sensitive data.	Colorado Connecticut Indiana Montana	Tennessee Texas Virginia
Right against automated decision-making	A prohibition against a business making decisions about a consumer based solely on an automated process without human input.	California Colorado Connecticut Indiana Iowa	Montana Tennessee Texas Virginia
Right to lodge a complaint	If your request is not satisfied, you can file a complaint to the regulatory body.	by default
To exercise your rights, contact us
We will answer your request within thirty (30) to sixty (60) days, depending on the state and legislative requirements. If your complaint is not satisfied, you can submit a complaint with the Federal Trade Commission.
Please note! Some states do not have privacy laws. The rights of residents of such states are governed by U.S. federal law. If your state is not on the list, please contact us.

Do Not Sell My Personal Information

California residents, under the California Consumer Privacy Act (CCPA), possess the right to opt out of the sale of their personal information by entities governed by the CCPA.

We do not sell your personal information to anyone, nor do we use your data as a business model. Ensuring your privacy is our utmost priority, and we are dedicated to safeguarding it.

We adhere to the CCPA by providing California residents the option to opt out of any potential future sale of their personal information. If you wish to register your preference that we do not sell your data in the future, please contact us at dpo@readdle.com

Do-Not-Track Requests

California residents visiting our Website have the option to request that we do not automatically collect and track information related to their online browsing activities across the Internet.

These requests can usually be made via web browser settings that manage signals or other mechanisms, enabling consumers to express their preferences concerning the collection of personal data about their online activities over time and across third-party websites or online services.

We currently do not have the ability to honor these requests. However, we may update this Privacy Notice as our capabilities evolve.

Canada Residents

Right	Description
Right to access	You can request an explanation of the processing of your personal data.
Right to rectification	You can change the data if it is inaccurate or incomplete.
Right to delete	You can send us a request to delete your personal data from our systems. We will remove all data except of what we are obliged to store in compliance with the law requirements.
Right to data portability	You can request all the data you provided to us and request to transfer data to another controller.
Right to object opt-out	You may object to the processing of your personal data.
Right to withdraw consent	You can withdraw your consent at any time.
Right not to be subject to automated decision-making	You can object to being subject to automated-based processing to know if there are consequences concerning them due to such processing.
Right to lodge a complaint	If your request is not satisfied, you can file a complaint to the regulatory body.
To exercise your rights, contact us.
We will answer your request within 30 days. If your complaint is not satisfied, you can submit a complaint to theOffice of the Privacy Commissioner of Canada.

Privacy Notice Updates

The Privacy Notice and the relationships falling under its effect are regulated by the General Data Protection Regulation. Please note that the laws and requirements for processing personal data can evolve. In the event of changes, we will release an updated version of the Privacy Notice on our Website to reflect these modifications.

If we make substantial changes to the Privacy Notice or the Website that affect your data privacy rights, we will notify you by email or display information on the Website and ask you to read it. You will be notified in advance, and if you continue to use the Website after these changes take effect, it will be considered that you have consented to and accepted the revised Privacy Notice.