Join

Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Kadasolutions Hungary Kft., 1139 Budapest, Kartács utca 24-26. 1. em. 15., Hungary ("Team Quiz", "we") and the account holder ("you"). It applies whenever we process personal data on your behalf, and is entered into automatically when you accept the Terms — a countersigned copy is available on request at [email protected].

1. Roles

For your own account data, we are the controller and our Privacy Policy applies.

For the personal data of the players you invite — their display names, the answers they submit during your games, their scores, and any free-text inputs they give to collection prompts — you are the controller and we act as your processor under Art. 28 GDPR. This matters most when you host games for colleagues, students or customers: deciding to run the game and what to ask is your decision, and the lawful basis for it is yours.

2. Subject Matter, Duration, Nature and Purpose

We process participant personal data only to provide the service described in the Terms: running your games, showing scores and leaderboards, storing quiz and game history in your account, and generating questions from the inputs players provide. Processing lasts as long as your account exists, or until you delete the game, quiz or account in question.

3. Categories of Data and Data Subjects

Data subjects: the players who join your games, including guests who join without an account.

Categories of data: display name; email address and profile data where a player has a registered account; game participation, answers, scores and timing; free-text answers to collection prompts; technical session data (IP address, user agent).

You must not use collection prompts or quiz content to gather special categories of data (Art. 9 GDPR — health, beliefs, political opinions, sexual orientation, biometrics and the like) or data relating to criminal convictions.

4. Our Obligations

We will:

  • process participant data only on your documented instructions, which the Terms and your use of the product's features constitute;
  • keep the data confidential and ensure that personnel with access are bound by confidentiality;
  • implement the technical and organisational measures in Section 5;
  • assist you in responding to data subject requests and, where relevant, with data protection impact assessments and consultations with supervisory authorities;
  • notify you without undue delay after becoming aware of a personal data breach affecting participant data, with the information needed for your own notification duties;
  • delete or return the data as described in Section 9 at the end of the processing.

We will inform you if, in our opinion, an instruction infringes the GDPR.

5. Security Measures

  • TLS encryption for all traffic; encryption at rest for the database and file storage.
  • Passwords stored as salted hashes; session tokens revocable by the user.
  • Data hosted in EU regions of Google Cloud Platform.
  • Access to production data restricted to personnel who need it, over authenticated accounts.
  • Role- and ownership-based access control in the application: quizzes, games and results are visible only to their owner, their organisation members, and the players of the game concerned.
  • Backups of the database, retained on a rolling basis.
  • Logging of operational events for debugging and abuse detection.

We may update these measures over time, provided the level of protection is not reduced.

6. Subprocessors

You authorise us to engage the subprocessors listed on the Subprocessors page, each bound by data protection terms no less protective than this DPA. We announce material changes to that list at least 30 days in advance. If you object to a new subprocessor on reasonable data protection grounds, tell us within that period; if we cannot offer a workable alternative, you may terminate the affected part of the service and receive a pro-rata refund of any prepaid, unused fees.

7. International Transfers

Where a subprocessor processes data outside the EEA, the transfer is covered by the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework, together with any supplementary measures required.

8. Data Subject Requests

If a player contacts us directly with a request concerning data we process on your behalf, we will not respond substantively but will forward the request to you without undue delay. Most requests you can satisfy yourself: game and participant data is visible and deletable in your account.

9. Deletion and Return

Deleting a game or quiz deletes the participant data belonging to it. Deleting your account removes your data from live systems within 30 days, and from backups as those backups age out. We will not retain participant data after the end of processing except where EU or Hungarian law requires us to.

10. Audits and Information

On reasonable written request, and no more than once a year unless a breach or a supervisory authority requires otherwise, we will provide the information needed to demonstrate compliance with this DPA. Audits must respect confidentiality and must not disrupt the service.

11. Precedence, Liability and Governing Law

In case of conflict, this DPA prevails over the Terms of Service on matters of data protection. The liability provisions of the Terms apply to this DPA. It is governed by Hungarian law, with the courts of Budapest having exclusive jurisdiction.

12. Contact

Data protection questions, breach reports and DPA countersignature requests: [email protected].