Privacy Policy

1. Data controller

The controller of personal data processed in the Quizzy service (quizzyplace.pl, the "Service") is Anton Merkulau, a private individual running the Service on a non-commercial basis. In all matters concerning personal data you can contact the controller at support@quizzyplace.pl.

This policy fulfils the information duties under Articles 13–14 of the GDPR. It is available in five languages; in case of discrepancies, the Polish version prevails.

2. What data we process, why, and for how long

Process	Data	Purpose & legal basis	Retention
Account	Name, username, email address, password (stored only as a hash), avatar, preferred language	Providing the account and the Service — Art. 6(1)(b) GDPR (contract)	Until you delete your account
Email verification	Email address, verification token	Confirming ownership of the address — Art. 6(1)(b) and (f) GDPR	Until verified; tokens expire automatically
Telegram sign-in	Telegram identifier and name received from Telegram during sign-in	Account creation and login — Art. 6(1)(b) GDPR	Until you delete your account
Teams	Team name, roster (member accounts), team images	Team functionality — Art. 6(1)(b) GDPR	Until the team or account is deleted
Quiz registrations	Team name, number of players, contact name, contact handle, comment	Handling the registration and passing it to the quiz's organizer — Art. 6(1)(b) GDPR	As part of the quiz history, until deletion of the team or on request
Results & ratings	Team results of quizzes, computed rating points	Public leaderboards and team statistics — Art. 6(1)(f) GDPR (legitimate interest in providing the core rating functionality)	For the operation of the Service
Notifications	Notification content and delivery data (in-app, Telegram)	Informing about quizzes, teams and registrations — Art. 6(1)(b) GDPR	Until read/expired or account deletion
Quiz ratings & comments	Score, comment, author account, rated quiz	Feedback to organizers and quality of the Service — Art. 6(1)(f) GDPR	For the operation of the Service or until removal
Support & reports	Correspondence, reporter email in illegal-content reports	Handling requests and content reports — Art. 6(1)(f) and (c) GDPR (Digital Services Act obligations)	As long as needed to handle the matter, then up to 12 months
Security	IP address, request metadata, technical logs, rate-limiting counters	Security, abuse and fraud prevention — Art. 6(1)(f) GDPR	Short-lived; no longer than 12 months
Analytics (Google Analytics)	Pseudonymous usage statistics: pages visited, device and browser information, approximate location	Understanding how the Service is used — Art. 6(1)(a) GDPR (your consent given in the cookie banner)	Per the shortest available Google Analytics retention setting; consent can be withdrawn at any time

Providing data is voluntary, but without the data marked as required in the forms we cannot provide the given functionality (e.g. an account cannot be created without an email address or a Telegram account).

3. Sharing data with organizers

When a team registers for a quiz, the registration data (team name, number of players, contact name and handle, comment) is made available to the organizer of that quiz so that they can run the event. The organizer is an independent controller of the data received and processes it in accordance with their own obligations; the rules binding organizers are described in the Organizer Terms.

4. Recipients of data

Data is processed with the help of the following categories of recipients:

the hosting provider of the Service's infrastructure;
the email (SMTP) provider used to send service messages;
Telegram (when you choose to sign in via Telegram — Telegram acts under its own terms);
Google (when analytics consent is given — Google processes Google Analytics data on the controller's behalf; calendar integrations use Google services for event data).

5. Transfers outside the EEA

Data is stored within the European Economic Area. When Google Analytics is enabled with your consent, data may be transferred to Google LLC in the United States on the basis of the EU–US Data Privacy Framework; where the framework does not apply, Standard Contractual Clauses are used.

6. Your rights

You have the right to:

access your data and receive a copy of it;
rectify inaccurate data;
have your data erased;
restrict processing;
data portability;
object to processing based on legitimate interest;
withdraw consent at any time (e.g. for analytics cookies — via the cookie settings in the footer), without affecting the lawfulness of processing before withdrawal.

To exercise your rights, write to support@quizzyplace.pl. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes UODO, ul. Stanisława Moniuszki 1A, 00-193 Warsaw, uodo.gov.pl).

7. Automated decision-making

The Service does not make automated decisions that produce legal effects concerning you or similarly significantly affect you. Team ratings are simple arithmetic computed from publicly uploaded quiz results, as described in the appendix to the Terms of Service.

8. Cookies

The cookies and similar technologies used by the Service, including the analytics category that requires your consent, are described in the Cookie Policy. You can change your choices at any time via the cookie settings available in the footer.

9. Changes to this policy

This policy may be updated, in particular when the Service's functionality changes (e.g. when analytics is enabled). The current version with its date is always available on this page.

Quizzy