Privacy Policy
1. Controller
Harald Kofler, Missianerweg 40, 39057 Missian (BZ), Italy, email: info.barvalid@gmail.com. Responsible for data processing on this website.
2. Hosting & processing when visiting the website
When you access the website, technically necessary data (e.g. IP address, time, page requested) is processed by the hosting server to enable delivery and ensure security.
This website and the associated server services are hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Processing takes place on servers within the EU on the basis of a data processing agreement pursuant to Art. 28 GDPR. The legal basis is our legitimate interest in the secure and reliable provision of the website (Art. 6(1)(f) GDPR).
Server and application logs (time, resource requested and, for account operations, the email address) are kept solely for troubleshooting and abuse prevention, are retained for a maximum of 30 days and are deleted automatically afterwards.
3. Cookies & consent
We only set statistics cookies if you have explicitly agreed via the cookie banner. Without consent no analytics services are loaded and no corresponding cookies are set. Your choice is stored locally in your browser and can be reset at any time.
4. Google Analytics
After your consent we use Google Analytics 4 for anonymized audience measurement (IP anonymization active). Provider: Google Ireland Ltd. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw consent at any time with effect for the future.
For this purpose Google Analytics sets cookies (incl. _ga and _ga_<container ID>) with a storage period of up to 24 months. The usage data collected is deleted automatically once the retention period configured in Google Analytics (14 months by default) has elapsed.
5. Contact form (enterprise)
If you submit an enquiry via the volume-licensing form, we process the data you provide (company, name, email, message, etc.) solely to handle your request. Technical measures (incl. spam protection) are used to prevent abuse.
Your details are deleted once your enquiry has been fully handled and no statutory retention obligations apply. If a contract is subsequently concluded, the commercial and tax-law retention periods apply (typically 6 to 10 years).
6. Email delivery via Google Mail
For sending emails (e.g. replies to enquiries, license-related messages) we use Google Mail (Gmail), provided by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. The data required for email delivery (recipient address, message content, time) is processed via Google's servers. A transfer to third countries (incl. the USA) cannot be ruled out; Google is certified under the EU-US Data Privacy Framework. The legal basis is our legitimate interest in reliable communication (Art. 6(1)(f) GDPR) or the initiation or performance of a contract (Art. 6(1)(b) GDPR).
Messages sent and received in the course of this correspondence remain in the mailbox for traceability and are deleted once they are no longer required for the purpose and no statutory retention periods apply.
7. App privacy and user account
Scanning and validating barcodes works without an account; the scans stay on the device. A barValid account is only needed for barValid satellite and the license dashboard. For it we process your name, email address and password (stored as a hash only) as well as the code structures you store on the server. The legal basis is the performance of the user relationship (Art. 6(1)(b) GDPR).
You can delete your account at any time yourself — in the app under “Satellite → Delete account” or by email request. Which data is deleted and which is kept for legal reasons, and for how long, is set out on the Delete account page.
Further privacy information for the barValid app is available in the Google Play Store and within the app itself.
8. GS1 Digital Link — requests to external resolvers
When a barcode contains a GS1 Digital Link, the app can, at your explicit request, fetch the web address held in the code in order to show the references behind it (e.g. patient information leaflet, instructions for use, product page) or to check the resolver's behaviour against the standard. Decoding and validating the code itself happens entirely on the device and without an internet connection.
The request goes directly to the operator of the address in the code, not through our servers. That operator receives the usual technical connection data (including IP address, time, and the address requested and therefore the scanned code) and is itself responsible for that processing; we have no influence over it.
The request never happens automatically, only when you trigger and confirm it in the app. You decide whether the permission applies just once, is stored for that one address, or applies generally. Stored permissions remain solely on your device and can be deleted individually or entirely in the app settings under “GS1 Digital Link”. The legal basis is your consent (Art. 6(1)(a) GDPR).
9. Your rights
- Access, rectification, erasure and restriction of processing
- Withdrawal of consent
- Data portability and objection
- Complaint to a supervisory authority
Contact for data protection matters: info.barvalid@gmail.com
10. Minors
This service is not directed at children. We do not knowingly process personal data of persons under the age of 16. Should such data have been transmitted to us without the consent of a parent or guardian, we will delete it once we become aware. You can notify us at any time using the contact address above.
Last updated: August 2026