The tracker records that the click came from the desk. It does not see the reader's identity, payment or any credential. The reader sees the desk's privacy note here and the operator's own privacy note after the click.
Yes — open the operator's domain directly. The desk does not redirect; the tracker only records clicks.
The tracker records the click and the redirect. The reader's identity is not logged by the desk.
The operator's own domain is reachable directly. The desk publishes the operator's stated domain on the /owner/ page with the date the desk last verified the statement.