Data processing agreement

This agreement governs how we process players' personal data on your behalf when you run a quiz on Sip&Score. You accept it by accepting the Terms of use and it is part of those terms. The Croatian version is binding.

1. Parties and roles

• Controller: you, the quiz organizer (a person or a venue that starts a session). You decide whether to run a quiz, with whom and with which questions.
• Processor: us, [NAZIV], [ADRESA], OIB [OIB], hello@sipnscore.eu.

For your account data we are the controller; that is covered by the Privacy policy, not this agreement.

2. Subject, duration, nature and purpose

• Subject: processing data of players and teams in the quiz sessions you start.
• Duration: while you use the service, and afterwards until the retention periods in section 9 end.
• Nature: collection, storage, display on your screens and players' screens, scoring, ranking, deletion.
• Purpose: running the quiz, scoring, standings, quiz history and checking fair play.

3. Types of data and categories of data subjects

Data subjects: players and teams in your sessions, with or without an account.

Data:

• team name, avatar (the look picked in the character creator) and colour,
• answers: text, numbers, choices, points on a map, drawings and photos,
• answer time and points,
• fair-play records: leaving the app or switching browser tabs, and sending an answer more than once,
• presence in the session (whether a team is connected),
• for a player with an account: the link between the session and their account, and the list of team participants they entered (account or email address),
• photos of paper answer sheets when you use sheet reading (OCR); they can show handwriting and the team name.

We do not process special categories of data (Art. 9 GDPR) and you may not ask players for them (section 10).

4. Processing on your instructions

We process data only on your documented instructions. The instructions are your use of the app (starting a session, settings, scoring, deletion) and this agreement. If EU or Croatian law requires different processing from us, we tell you before processing unless the law forbids it. If we think an instruction breaks the GDPR, we tell you at once.

5. Confidentiality

Only people who need access to run the service have it, and they are bound to confidentiality by agreement or by law.

6. Security

We apply the Art. 32 GDPR measures described in Annex 1.

7. Subprocessors

You give us general authorisation to engage the subprocessors on the list of subprocessors. Before adding or replacing a subprocessor we email you at least 30 days in advance [PRAVNIK: period]. In that period you can object with reasons; if we do not agree, you can stop using the service. Our contracts with subprocessors carry the same data protection obligations as this agreement. We are liable to you for their work.

8. Assistance to the controller

• Players' rights: if a player contacts us directly, we forward the request to you and help you carry it out (finding, exporting or deleting session data).
• Data breach: we notify you of a breach affecting your sessions' data without undue delay and no later than 48 hours after we become aware of it, with the information we have then (what happened, categories and approximate number of players, likely consequences, measures taken). We send the rest as soon as we have it.
• Impact assessment and consultation with the supervisory authority: we give you the information we have and you need.

9. Deletion at the end and retention

We keep session data for these periods: [PROVJERITI: čeka GI-11; periods for files on S3 are not enforced automatically yet]

When you delete your account, we also delete your venues with their sessions and players' data. Sessions you ran at someone else's venue stay with that venue's owner, without a link to your account. Before deletion you can download your data as JSON in the account settings; for sessions you ran it contains a summary with teams, points and ranks, without raw answers. Deleted data disappears from database backups when the restore window ends (6 hours).

10. Your obligations

• Inform players about the processing. You can use the template for players.
• Do not ask players for special categories of data (health, religion, political opinions and similar) or for data the quiz does not need.
• For quizzes with children, make sure there is a lawful basis. [PRAVNIK: what the organizer must do for players under 16]
• Photograph answer sheets only to read the answers.

11. Information and audits

On request we give you the information you need to show compliance with Art. 28 GDPR: this agreement, the list of subprocessors and their processing agreements, the description of the measures in Annex 1. An audit or inspection, if that information is not enough, is agreed in advance within a reasonable time and scope. [PRAVNIK: audit costs]

12. Transfers outside the EEA

Some subprocessors process data outside the European Economic Area. The transfer mechanism for each is on the list of subprocessors. We transfer session data outside the EEA only under an adequacy decision (for example the EU-US Data Privacy Framework) or standard contractual clauses.

13. Liability and term

This agreement lasts as long as your account and the obligations in section 9. Liability follows the Terms of use and Art. 82 GDPR. Where this agreement and the Terms differ on data protection, this agreement prevails.

Annex 1. Technical and organisational measures

• Transport: all traffic between the browser, the web app and the API uses HTTPS.
• Passwords: stored only as a hash (scrypt), never in readable form.
• Sign-in: a session lasts 7 days; the access token 15 minutes; the renewal token changes on every renewal and reuse of an old one is detected.
• Access: an organizer sees only their own sessions; a player reaches a session only with their team's token; only accounts with the administrator role have administrator access.
• Rate limiting: requests per IP address and per account are limited.
• Files: stored in the AWS eu-north-1 (Stockholm) region [PROVJERITI: SSE-S3 encryption in the bucket settings]; the file key contains a random identifier.
• Database: Neon in the eu-central-1 (Frankfurt) region; the database can be restored to any point in the last 6 hours.
• Error tracking: Sentry in the EU region; only the user ID is sent, no cookies, headers, request bodies or URL parameters.
• Retention: data is deleted according to the periods in section 9.
• Organisation: a small group has access to production systems with two-factor sign-in [PROVJERITI: 2FA on all vendor accounts]; the breach procedure is written down.