Data processing agreement

Parties

1. What this agreement is about

1. 1.1You use Quiz Playground to organize a party, with a Warm-up Deck, a show and a Recap page. In doing so we process personal data for you. This agreement sets out how, as article 28 of the GDPR requires.
2. 1.2Words such as personal data, processing, data subject and data breach mean the same here as in the GDPR.
3. 1.3This agreement belongs with our terms and conditions. Where they contradict each other on personal data, this agreement applies.

2. What we process and why

1. 2.1We process personal data only to make your party work: collecting contributions, making a show of them, playing the show and showing the Recap page. Annex 1 says which data, whose, and for how long.
2. 2.2We use the data for nothing else. We don’t sell it, and don’t use it for advertising or to train AI.

3. Only on your instructions

1. 3.1We process the data only on your instructions. How you use and set up Quiz Playground counts as those instructions.
2. 3.2If the law requires us to do otherwise, we tell you beforehand, unless the law forbids that. If we think an instruction breaks the GDPR, we say so at once.

4. Confidentiality

1. 4.1Anyone at our side who can reach the data must keep it confidential.
2. 4.2We only look at a contribution’s content when you or a guest ask for help, or when someone reports something.

5. Security

1. 5.1We secure the data appropriately, as article 32 of the GDPR requires. Among other things:
   • The database and the files are in the EU (Frankfurt), and all connections are encrypted.
   • Rules in the database make sure only those allowed can reach the data. Links to the Warm-up Deck and the Recap page contain a key that can’t be guessed.
   • We store photos again, without location and other metadata. There is no face recognition.
   • Attempts to guess room codes or flood the system are limited.
   • Our own logs and error reports contain no names, email addresses or memories.
2. 5.2We keep these measures up to date and adjust them when needed.

6. Subprocessors

1. 6.1You allow us to use the subprocessors in annex 2.
2. 6.2We announce a new or different subprocessor at least 14 days ahead. If you have a good reason to object, we look for a solution together. If that fails, you can end this agreement and get your money back for a party that hasn’t been played yet.
3. 6.3We impose on every subprocessor at least the same duties as in this agreement, and remain responsible to you for what they do.

7. Outside the EU

1. 7.1Data only goes to a country outside the European Economic Area under arrangements the EU approves: a decision of the European Commission, such as the EU-US Data Privacy Framework, or standard contractual clauses. Annex 2 says which, per subprocessor.

8. Data subjects’ rights

1. 8.1If a colleague wants to see, correct, delete or take their data, we help you with it. In the Studio you delete a party with everything in it. Hiding a contribution takes it out of the show but doesn’t delete it: we delete a single contribution at your request.
2. 8.2If we receive such a request directly, we forward it to you within two working days.

9. Data breaches

1. 9.1If we discover a data breach that affects your data, we report it without undue delay, and at the latest within 48 hours of discovering it.
2. 9.2We tell you what happened, which data and how many people it affects, what the consequences may be and what we do about it. That way you can report it to the Dutch Data Protection Authority within 72 hours when required.

10. Help with a DPIA

1. 10.1If you need to carry out a data protection impact assessment (DPIA) or consult the Dutch Data Protection Authority beforehand, we give you the information you need.

11. Audits

1. 11.1We give you all the information needed to show that we keep to this agreement.
2. 11.2If you want that checked, you can have it done once a year, by an independent expert who promises confidentiality, with 30 days’ notice and at your cost.

12. Keeping and deleting

1. 12.1We keep the data no longer than annex 1 says.
2. 12.2When this agreement ends, we delete the data within 30 days, unless the law requires us to keep something longer. If you want a copy first, ask us before then.
3. 12.3You can also delete everything sooner yourself, with Verwijder alles (Delete everything) in the Studio.

13. Liability

1. 13.1For liability, what our terms and conditions and the law say applies. Each of us is liable for damage it causes itself by not complying with this agreement or the GDPR.

14. Term

1. 14.1This agreement applies from signing, as long as we process personal data for you.
2. 14.2Agreements that must keep applying afterwards, such as confidentiality, keep applying.

15. Law and disputes

1. 15.1Dutch law applies to this agreement. If we can’t work it out together, the competent court in the Netherlands decides.

Annex 1: the processing

Whose data

Your organization’s organizers, colleagues and other guests who send in contributions, and players.

Which data

Organizers’ names and email addresses and their relation to the guest of honor; guests’ nicknames and relations; contributions (text, photos, voice messages) with the AI check’s labels (topic, period, names mentioned); the confirmation that a guest is 16 or older and when they gave consent; answers and points; sessions with IP address and browser; against abuse also IP addresses, stored only unrecognizable in our counters.

Special categories

Not intended. Topics like health don’t belong in a show: the AI check flags such contributions and hides them until the organizer has looked. There is no face recognition.

What we do with it

Store it, check it with AI, turn it into quiz questions, show it on the TV and the phones, and on the Recap page.

How long

Loose contributions, photos and voice messages: 30 days after the party. The Recap page: as long as the pass says (7 days, 30 days or 12 months). Anonymous sessions: 60 days without activity. Everything sooner if you choose Verwijder alles (Delete everything).

Annex 2: subprocessors

This list is the same as in our privacy statement. If it changes, we announce it as article 6 says.

Supabase

Database, login and storage of contributions, photos and voice messages. For every login session the login system keeps your IP address and browser.

EU (Frankfurt). Supabase itself is in the US: standard contractual clauses.Supabase’s data processing agreement

Vercel

Hosting the website and the app

EU (Frankfurt). Vercel itself is in the US: standard contractual clauses.Vercel’s data processing agreement

Anthropic

AI that checks contributions and turns them into quiz questions

US: standard contractual clauses. Gone after 30 days at most, and never used to train AI.Anthropic’s data processing agreement

Stripe

Payments with iDEAL | Wero and card, and receipts

EU (Ireland) and US: EU-US Data Privacy Framework and standard contractual clauses.Stripe’s data processing agreement

Resend

Sending email

Sent from the EU (Ireland); account and logs in the US: EU-US Data Privacy Framework and standard contractual clauses.Resend’s data processing agreement

Sentry

Error reports, with a user id and the page’s address (which can hold the key of an invitation link). No names, email addresses or content.

EU (Frankfurt); company in the US: EU-US Data Privacy Framework and standard contractual clauses.Sentry’s data processing agreement

ElevenLabs

The voice that presents the show, when it’s on; the organizer can turn it off. Gets the guest of honor’s first name and the lines we write from your memories. Never a guest’s nickname, and never who wrote what.

US: EU-US Data Privacy Framework and standard contractual clauses. We turn off ElevenLabs’ use of it to train AI.ElevenLabs’s data processing agreement

Cloudflare

Checking that a person is there and not a bot (Turnstile): when you start as a guest, when you log in or sign up to the Studio, and when you pair a TV

Worldwide network, company in the US: EU-US Data Privacy Framework and standard contractual clauses.Cloudflare’s data processing agreement

Google Workspace

The mailbox of hello@quizplayground.com: what you mail us, with your email address, such as a question or a request to see or remove your data

Google Cloud EMEA in Ireland; stored worldwide, company in the US: EU-US Data Privacy Framework and standard contractual clauses.Google Workspace’s data processing agreement

Plausible

Website statistics: which pages are visited and where visitors come from. No cookies: your IP address and browser only go into a code that changes every day. Links to the warm-up deck and the memory page go there without their key, and nothing is counted during the show.

EU: company in Estonia, servers in Germany.Plausible’s data processing agreement