Unitag Alternative: European Hosting, GDPR and What to Check

Procurement sent the QR platform proposal back with one comment: "Where is the scan data stored?" If you cannot answer that in a sentence, the purchase stalls, and for a European buyer it should.

Unitag comes up often in that conversation because data residency is central to how the company presents itself. This piece is deliberately about the evaluation rather than the vendor, for a reason worth stating openly: Unitag's site is a JavaScript application and very little about it can be read without running the app, so we are not going to assert specifics we could not verify.

What Unitag states about itself

The positioning we could verify directly is that Unitag describes itself as an "Enterprise QR Code Platform" highlighting GDPR compliance and European hosting in its own headline, and markets "QR codes solutions for Enterprises." Their materials also point to GS1 Digital Link support.

That is the honest extent of it. We did not obtain pricing, quota, or export format details, so this post states none. If you see a number attributed to Unitag in a comparison article, treat it as unverified until you see it on their own current materials.

Their pricing is not readable without JavaScript and routes through a calculator rather than a plain published table, which makes it comparatively opaque to evaluate from the outside. The practical implication is simple: request a quote early, because you will not be able to shortlist on price from a search result.

Why European hosting is a real differentiator

It would be easy to treat data residency as a checkbox. For a lot of European buyers it is not.

Scan data is personal data more often than people assume. A scan event can carry an IP address, an approximate location derived from it, a timestamp, and a device fingerprint. Under GDPR that combination is usually personal data, which means the questions of where it is processed, who else touches it, and how long it is kept are legal questions rather than technical preferences.

If your organization is a public body, operates in healthcare, handles anything regulated, or has an internal policy requiring European processing, then a vendor that hosts in Europe and builds its positioning around GDPR is answering a requirement you genuinely have. That is a legitimate reason to shortlist a vendor, and buyers outside Europe sometimes underrate how binding it is.

Our piece on scan tracking, GDPR and consent covers what a scan event typically contains and what that means for your privacy notice.

Question one: where the scan data physically lives

"Hosted in Europe" is a good starting claim, and a procurement process should turn it into specifics. Ask for:

• The countries and regions of the primary data centers.
• Whether backups, logs, and analytics pipelines stay in the same region, since these are the parts that quietly leave.
• Whether support staff access production data from outside the region.
• Whether any transfer mechanism, such as standard contractual clauses, is relied on at all.

The last one is the tell. A vendor with genuinely Europe-only processing can say so without qualification. A vendor with a support team elsewhere will have transfer language, which is fine and lawful, but you should know about it before signing rather than during an audit.

Question two: retention and sub-processors

Two follow-ups matter more than most feature comparisons:

Retention. How long are raw scan events kept, and can you set that period? Indefinite retention of IP-level records is a harder position to defend than aggregated counts kept for a year. Ask what the default is and what you can change.

Sub-processors. Every platform uses some. Ask for the current list, where each one sits, and how you get notified when it changes. A vendor that maintains a public sub-processor page has already done the work of being auditable.

Ask the same questions of us. Any vendor that treats them as unusual is telling you something.

Question three: the DPA and the contract

Request the data processing agreement before the demo, not after the quote. Read it for three things specifically: the sub-processor notification period, the audit rights, and the deletion commitment on termination.

Then ask the question that most buyers forget entirely.

Question four: what happens to live codes when the contract ends

This is the one that costs money. If your codes are dynamic, the redirect runs on the vendor's infrastructure. When the contract ends, that redirect is the thing that stops.

Every printed code you have in the field depends on it. Packaging, signage, catalogs, product labels, anything with a multi-year life. Ask directly:

• Can I export every code with its current destination in a machine-readable file?
• Is there a grace period after termination during which redirects keep resolving?
• Can I point my own domain at the redirect, so that the short links are mine rather than the vendor's?

That last option is the strongest protection available. If the short link uses a domain you control, you can repoint it at a different provider without touching a single printed code. If it uses the vendor's domain, you cannot, and a migration means a reprint. We wrote about the general version of this failure in what happens when a QR code generator shuts down.

Where QRolling sits, stated plainly

We should be direct about our own shape rather than claiming to win every comparison.

Our generator charges nothing for styling or SVG and puts no watermark on the file; a free account by email or Google unlocks the download. Dynamic codes with editable destinations and scan analytics are paid, with a free trial. Where we are weaker: we do not offer enterprise SSO or large-scale automation integrations, and we no longer hand out a static file at all. If either is a hard requirement, that is a real gap and you should weigh it.

If GS1 product identification is part of the project, our GS1 Digital Link explainer covers the standard itself, independent of any vendor.

Send the four questions above to every vendor on your shortlist, in one email, and compare the replies side by side. The answers, and how quickly they arrive, will separate the list faster than a feature matrix will. Our buyer's comparison of QR generators is a reasonable place to build that shortlist from.