Customer agreement templates
Download the agreement that fits your use case, fill in your organisation's details, sign electronically, and email the executed copy back to info@qrcodekey.com. We will counter-sign within five business days, subject to review, and you can begin processing the relevant data after counter-signature.
These templates are professional starting drafts intended as a baseline for negotiation. They have not been reviewed by attorneys licensed in your jurisdiction. By downloading or using these templates, you acknowledge that:
- QRCodeKey / JAL Technology LLC provides these templates "AS IS" without any warranty of legal sufficiency, completeness, or fitness for a particular purpose.
- These templates are NOT legal advice and do not create an attorney-client relationship.
- You are solely responsible for having qualified counsel review and adapt these templates to your specific circumstances, jurisdiction, and applicable laws.
- QRCodeKey is not liable for any loss, damage, regulatory penalty, or claim arising from your use of these templates.
- Execution of any agreement based on these templates is at your own risk and discretion.
For substantive negotiation or execution, we strongly recommend each party engage independent legal counsel licensed in the relevant jurisdiction(s) (US state law, EU Member State, UK, India, etc.).
Unless expressly negotiated otherwise in a signed amendment, the following standard provisions apply to all three template agreements:
- Limitation of Liability: Each party's aggregate liability under the agreement is capped at the total fees paid by Customer to QRCodeKey in the twelve (12) months immediately preceding the event giving rise to the claim. Neither party is liable for indirect, incidental, consequential, special, punitive, or exemplary damages.
- Mutual Indemnification: Each party will indemnify the other for third-party claims arising from its own breach, gross negligence, or wilful misconduct.
- Governing Law: Illinois, USA (without regard to its conflict-of-laws principles). For EU/UK customers, GDPR Standard Contractual Clauses and local data-protection law also apply where required.
- Dispute Resolution: Good-faith negotiation first; then binding arbitration under AAA Commercial Rules in Cook County, Illinois. Each party may seek injunctive relief in any court of competent jurisdiction.
- Insurance: Coverage requirements (if any) will be specified during onboarding; not a condition of executing the template.
- Force Majeure: Neither party is liable for delay or failure caused by events beyond reasonable control (natural disasters, war, government action, internet outage, etc.).
- Severability: If any provision is held unenforceable, the remainder remains in effect.
- Counterparts & Electronic Signatures: The agreement may be executed in counterparts and electronically (e.g., DocuSign, Adobe Sign) — each constitutes a binding original.
These protective terms exist for the benefit of both parties and are deemed incorporated into the template by reference, unless the executed agreement expressly states otherwise.
Execution of a HIPAA BAA, FERPA School Data Addendum, or GDPR Article 28 DPA is reserved for Customers on an annual paid plan with a minimum annual commitment of USD $1,200 (equivalent to Business plan annual). For lower-volume Customers, processing of regulated data (PHI, education records, EU personal data) is not supported on our platform. This eligibility threshold helps both parties manage compliance and liability risk responsibly.
HIPAA Business Associate Agreement (BAA)
HealthcareWhen you need it: You are a Covered Entity or Business Associate under HIPAA (clinic, hospital, doctor, dentist, pharmacy, mental-health practice, lab, urgent-care) and want to process Protected Health Information (PHI) through QRCodeKey.
FERPA School Data Addendum
EducationWhen you need it: You are a U.S. K-12 school, school district, college, or university handling student "education records" under FERPA, or processing student data under state student-privacy laws (CA SOPIPA, NY Ed Law § 2-d, IL SOPPA, CT, CO, MD, TX).
GDPR Article 28 Data Processing Agreement
Enterprise / EUWhen you need it: You are an EU / UK / EEA / Swiss customer, or a global enterprise that wants a standalone Article 28 (or equivalent) processor agreement covering GDPR, UK GDPR, India DPDP, Brazil LGPD, CCPA / CPRA service-provider terms, PIPEDA, Australia APP, and other regimes.
After you sign and send
- We acknowledge receipt within 2 business days.
- QRCodeKey will review the executed copy and, if acceptable, counter-sign within 5 business days. QRCodeKey reserves the right to decline execution or propose redlines at its sole discretion.
- If we propose redlines we will mark them up in tracked changes and explain. No agreement is effective until QRCodeKey has counter-signed.
- Once fully executed by both parties, both keep a copy. Customer may begin processing the relevant data through QRCodeKey only after counter-signature.
- Renewal is automatic and tracks the underlying QRCodeKey Terms of Service. Either party may terminate per the executed agreement.
Need the editable Word (.docx) version?
Email info@qrcodekey.com with subject "Word version of customer agreement" and tell us which template you need (BAA, School Addendum, or DPA). We will send the .docx so you can fill in your fields, redline if needed, and return tracked changes.
Other agreement questions
- • Custom MSA / SOW for enterprise procurement: email us with your standard paper.
- • Insurance certificate (COI): available on request once your account is in good standing.
- • Sub-processor list (referenced in the DPA): live at /sub-processors.
- • SOC 2 / ISO 27001 reports: not yet — we're early-stage. We rely on our sub-processors' certifications (MongoDB Atlas, Render, Stripe — all SOC 2 Type II).
The information and templates on this page are provided for general informational purposes only and do not constitute legal advice. No attorney-client relationship is created by downloading, viewing, or using these materials. Laws vary by jurisdiction and change over time. The applicability and adequacy of these templates depends on facts specific to your situation.
You should consult an attorney licensed in your jurisdiction before executing any agreement that creates legal obligations. QRCodeKey, JAL Technology LLC, and their officers, employees, and contractors disclaim all liability for any loss, claim, damage, regulatory action, or expense arising from your use of, or reliance on, these templates.
Last updated 2026-05-12. Template versions: BAA v1.0, School Addendum v1.0, DPA v1.0.