In OpenQR, the focus is on tracking scans rather than individual users. The data collected from scans, such as time, location, and device (IOS, Android, Microsoft), is used for analytical purposes. If the tracked information does not directly identify individual users and is only used for aggregate analytical purposes, then it may not be necessary to specifically inform users about it under GDPR regulations.
This is what I found on the internet and that's why I do not added opt-out option in the dynamic QR Code when user scan it.
