_SC.svg)
This Privacy Policy describes how Shop Circle Holdings Ltd, trading as 506 ("506", "we", "us", "our"), of One Kingdom Street, Paddington Central, London W2 6BD, United Kingdom, collects, uses and shares information in connection with the 506 EasyLink: GS1 QR & DPP application for Shopify ("EasyLink", the "App") and the 506.link resolver service (the "Resolver"). We may update this policy from time to time; the current version will always be available at this address.
EasyLink serves two distinct groups of people, and we describe each separately below: (a) merchants who install the App on their Shopify store, and (b) consumers and other members of the public who scan a GS1 Digital Link QR code that resolves through 506.link.
1. INFORMATION WE COLLECT — MERCHANTS
When you install and use the App we collect:
Information from the Shopify platform. Your store's myshopify.com domain, your product catalogue data as needed to provide the service (product and variant titles, SKUs, barcodes/GTINs, product identifiers, prices at the time you print labels, and product page URLs), and your app subscription plan.
Information you provide directly. Configuration you enter in the App, such as link destinations, batch/lot, serial and expiry values you encode into codes, and any correspondence you send us.
Information collected automatically. Standard technical logs generated when you use the App (such as request logs held briefly by our hosting provider for security and reliability).
We do not collect, store or process your customers' personal information. The App does not request access to customer data from Shopify, and order and customer records never pass through our systems.
2. INFORMATION WE COLLECT — PEOPLE WHO SCAN CODES
When anyone scans an EasyLink QR code (or otherwise visits a 506.link address), the Resolver processes the request in order to redirect the visitor to the destination chosen by the merchant. For each scan we record only: the product identifier (GTIN) scanned, the date and time, the outcome of the request, and the country from which the request was made (derived from the network request and stored as a two-letter country code only).
We do not store IP addresses, precise location, device identifiers or names in scan records, and the Resolver does not set cookies or use tracking technologies. Scan records are aggregated into daily per-product counts for the relevant merchant and the underlying event records are then deleted (and expire automatically after at most 90 days in any case).
3. HOW WE USE INFORMATION
We use the information described above to: provide, operate and improve the App and the Resolver; generate GS1 Digital Link codes and label documents at your request; show merchants analytics about scans of their own codes; communicate with merchants about the service; enforce our terms and prevent fraud or abuse; and comply with legal obligations.
4. LEGAL BASES FOR PROCESSING
Where UK or EU data protection law applies, we process personal information on the following bases: performance of our contract with the merchant; our legitimate interests in operating, securing and improving the service; consent, where required; and compliance with legal obligations.
For store data processed on a merchant's behalf, the merchant is the data controller and we act as processor. For scan analytics and our own service and usage records, we act as an independent controller.
5. HOW WE SHARE INFORMATION
We do not sell personal information. We share information only with: service providers who host and operate our infrastructure (see Section 6); Shopify, as necessary to operate an app on its platform; professional advisers, regulators or authorities where required by law; a successor entity in connection with a merger, acquisition or sale of assets; and otherwise with your consent.
6. SERVICE PROVIDERS AND HOSTING
The App and the Resolver are hosted on Cloudflare, Inc. infrastructure (including Cloudflare Workers, D1 and Workers KV), which operates a global network. The App is distributed through the Shopify platform, and billing for paid plans is handled entirely by Shopify — we never receive your payment details. Links from the App to external websites (for example GS1 licensing resources) are governed by those sites' own privacy policies.
7. INTERNATIONAL TRANSFERS
Our service providers may process information in the United States and other countries outside the UK and EEA. Where personal information is transferred out of the UK or EEA, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum.
8. DATA RETENTION
We retain merchant information for as long as the App is installed and as needed to provide the service. If you uninstall the App, we delete or anonymise the information we hold about your store within 30 days of receiving Shopify's data-erasure notice, except where retention is required by law. Published resolver records are removed as part of this process, after which codes that resolve through 506.link will no longer redirect. Raw scan event records are deleted on aggregation and expire automatically after at most 90 days; aggregated, per-product daily scan counts are retained as part of the merchant's analytics for the life of the installation.
Please note that QR codes you have printed are physical artefacts outside our control; removing your data from EasyLink stops them resolving but does not remove them from your packaging or labels.
9. YOUR RIGHTS
Depending on your location, you may have the right to request access to, correction of, or deletion of your personal information; to object to or restrict processing; to data portability; and to withdraw consent where processing is based on consent. To exercise these rights, contact us at support@506.io. Merchants can also uninstall the App at any time, which triggers the deletion process described in Section 8.
10. CHILDREN'S PRIVACY
The App and the Resolver are not directed to individuals under 18, and we do not knowingly collect personal information from children.
11. RIGHT TO COMPLAIN
If you are in the UK, you may lodge a complaint with the Information Commissioner's Office (ico.org.uk). If you are in the EU/EEA, you may complain to your local data protection authority.
12. SECURITY
We maintain technical and organisational measures designed to protect the information we hold, including encryption in transit, scoped access credentials and least-privilege infrastructure permissions. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
13. CHANGES TO THIS POLICY
We may update this Privacy Policy from time to time. Material changes will be reflected by an updated effective date at the top of this page, and, where appropriate, notified to merchants through the App.
14. GOVERNING LAW
This policy and any dispute arising out of it are governed by the laws of England and Wales, subject to the non-exclusive jurisdiction of the English courts and without prejudice to any mandatory rights you have under the data protection laws of your place of residence.
15. CONTACT US
Shop Circle Holdings Ltd (trading as 506)
One Kingdom Street, Paddington Central
London W2 6BD, United Kingdom
support@506.io
