In short
- Players need no account. We store the name and team name they type in, their answers and their points – never an email address or phone number.
- Hosts sign in with their email address. The account and quizzes are kept until the account is closed, and the players’ names and answers are deleted automatically 12 months after the quiz.
- We sell no data, show no ads and use no tracking cookies.
- When an organisation hosts a quiz, the organisation is responsible for the players’ data, and we process it on its behalf.
- You can always ask what we hold about you or ask us to delete it: support@vopola.com.
Contents
Who is responsible
Vopola is run by Saiokatta AB. We are the controller for data about you if you have an account, visit the website or contact us.
- Company
- Saiokatta AB
- Company reg. no.
- 559527-9380
- Registered with
- Swedish Companies Registration Office (Bolagsverket)
- VAT no.
- SE559527938001
- Address
- Hägerstensvägen 170, 126 53 Hägersten, Sweden
- support@vopola.com
When an organisation hosts the quiz
When a company, school, club or other organisation hosts a quiz in Vopola, the organisation decides why the quiz is held and who takes part. The organisation is then the controller for the players’ data in that quiz, and we are its processor: we process the data on the organisation’s behalf and only to make the quiz work. What we have committed to is set out in the terms. If you have questions about such a quiz, contact whoever hosted it first.
When a private person hosts the quiz
When someone hosts a quiz for family and friends, the GDPR does not normally apply to the host personally. We are then responsible for how the players’ data is processed in Vopola, as described in this policy.
Data we process
If you have an account
- the email address you sign in with and a display name, which starts out as the part of the address before the @
- when you accepted the terms of use and which version you accepted
- details about your sign-ins, such as when and from which IP address you signed in, and your password in protected form if you have chosen one
- the organisation your account belongs to: its name, members and their roles, plan and branding (logo and colours)
- the quizzes you build: questions, answers, settings and themes, and the images and logos you upload
- the sessions you host: title, join code, settings, times and results
If someone shares a quiz with you
If someone shares a quiz with you in the quiz builder, we store your email address, whether you may view or edit the quiz and who shared it. The data comes from the person who shared it, and we store it based on our legitimate interest in letting hosts share their quizzes with colleagues (Article 6(1)(f)). Sharing is not finished yet: it gives you no access, and we send you no email and use the address for nothing else. It is kept until the person who shared it removes the share or the account is closed.
If you play
- the name you type in and, if you play in teams, the team name
- your answers, whether they were right, your points and how long each answer took, measured both on your phone and on our server
- when you joined and whether the host removed you
- a random player identity and a key that your phone keeps, so you can carry on as the same player if the connection drops
Players need no account, and we never ask for an email address or phone number. Reactions you send during the quiz are only shown on the big screen in the moment and are not stored.
Every visitor
When you use Vopola, your browser sends technical details such as your IP address, browser type and the time. Our server uses the IP address briefly to limit how many requests can be made and protect the service from overload, and does not store it. Our hosting and security providers may keep it in technical logs for a limited time.
If you contact us
If you email us, we process your email address, what you write and our reply.
Why we process the data, and on what basis
- Your account and the service: creating your account, signing you in, saving your quizzes, letting you host sessions and showing and exporting the results. If you created the account for yourself, this is necessary to perform our contract with you (Article 6(1)(b) GDPR). If you use Vopola for a company, school, club or other organisation, the organisation has the contract with us. The processing is then based on our legitimate interest in letting the organisation’s users use the service it has chosen (Article 6(1)(f)).
- Proof of the agreement: recording when you accepted the terms and which version, so that we can show what we agreed. This is based on our legitimate interest in being able to show the agreement (Article 6(1)(f)).
- The quiz for its players: showing names on the big screen, on the leaderboard and – if the host shares it – on the results page, scoring and letting phones reconnect. When an organisation hosts the quiz, we do this on the organisation’s instructions. Otherwise we rely on our legitimate interest in running the quiz you chose to join (Article 6(1)(f)).
- Security and operations: protecting the service from abuse and overload, finding faults and keeping it running. This is based on our legitimate interest in a secure, working service (Article 6(1)(f)).
- Support: answering when you get in touch. This is based on our contract with you if you have your own account, and otherwise on our legitimate interest in replying (Article 6(1)(b) and (f)).
- Legal obligations: when a law requires us to keep or disclose data (Article 6(1)(c)).
Without an email address you cannot create an account, and without a name you cannot join a quiz. The name can be a first name or a nickname.
We do not sell personal data, show ads or build profiles. Points are calculated automatically, but it is a game: we make no automated decisions that have legal effects on you or similarly significantly affect you.
What others can see
- Names and team names are visible to everyone in the quiz: on the big screen, on the leaderboard and in the host’s control room.
- When the quiz ends, it gets a results page with the leaderboard (names and points), the quiz questions and how the answers were spread. The host decides whether the page is shared, and by default it is. Anyone with the link can then open it, print it or save it as a PDF for 30 days after the quiz; the host and every player get the link and can pass it on. The host can stop sharing at any time, and after 30 days the link stops working by itself. A printout or PDF someone has already saved is not affected. The page is not shown in search engines. The host can see the results in the studio until the participant data is deleted.
- The host can download answers and points per player and question as a file. Whoever downloads a file or saves a PDF is responsible for what happens to it afterwards.
- Images and logos in a quiz are shown to everyone who plays, and anyone who has the address of an image can open it.
Providers and other recipients
We use providers to run Vopola. They process the data on our behalf, as processors, under data processing agreements with us, and only receive what they need for their task:
- Supabase: the database, sign-in (including the email with the sign-in link) and storage of images and logos.
- Cloudflare: delivers the website and runs Vopola’s server, which receives the answers, calculates the points and sends the quiz’s events to the big screen and the phones. Cloudflare also protects the service from overload and abuse.
- Simply.com: receives and stores email sent to support@vopola.com.
Two services receive data directly from your browser and are responsible for it themselves, under their own privacy policies:
- Unsplash: image search in the quiz builder. The search terms are sent from our server. The preview images, and any Unsplash images a quiz uses, load directly from Unsplash – in the quiz builder, on the big screen and on the players’ phones – and Unsplash then sees the device’s IP address (Unsplash’s privacy policy).
- YouTube (Google): if a quiz has a YouTube video, it plays from youtube-nocookie.com on the big screen and in the studio’s previews. Google then sees the device’s IP address and may store data in the browser under its own terms (Google’s privacy policy). Any other video link loads from the website the link points to.
For some traffic and security data, Cloudflare may also act as an independent controller.
We may also disclose data to an authority when the law requires it, or to an adviser when needed to establish, exercise or defend legal claims.
Transfers outside the EU and EEA
Some of our providers, or their subcontractors, may process data outside the EU and EEA, for example in the United States. Such a transfer must rest on a European Commission adequacy decision, such as the EU–US Data Privacy Framework for recipients certified under it, or on the Commission’s standard contractual clauses with the necessary safeguards. Unsplash and YouTube receive the IP address directly from the browser; see above.
Email support@vopola.com if you want to know which safeguard applies to a particular provider.
How long we keep data
This is how long we keep data:
- Your account, organisation, quizzes and uploaded images are kept until you ask us to close the account. A quiz you delete disappears from the studio, but is only erased from the database when the account is closed.
- The players’ names and team names, answers, points and times are deleted automatically 12 months after the quiz. If the host never ends the quiz, the time counts from when someone last did something in it – joined, answered or moved the quiz on – and a started quiz nobody has used for 30 days ends by itself. The host can delete them earlier for a session, and then everything about the players is deleted, including the teams and who was in which team. What remains is the session itself – title, join code, settings and times – with nothing about the players, until the account is closed.
- Anyone with the link can open the results page for at most 30 days after the quiz, and only while the host shares it.
- A player the host removes during the quiz disappears from the leaderboard, but their name and answers are only deleted together with the rest of the participant data.
- Whatever your phone or browser stores stays there until you clear it; see the next section.
- Support emails are kept for as long as the matter requires.
- Technical logs at our providers are kept for a limited time under their terms.
- Deleted data may remain for a short time in our database provider’s backups before it is overwritten.
Your rights
You have the right to:
- know what data we hold about you and get a copy of it
- have inaccurate data corrected
- in some cases have your data erased or its processing restricted
- object to processing based on our legitimate interest
- receive data you have provided yourself in a machine-readable format
Email support@vopola.com. Write from your account’s email address if it concerns your account. We reply within one month and may need to check that you are who you say you are.
If you took part in a quiz hosted by an organisation, contact the organisation first. If you contact us, we help the organisation respond. Please include the join code, the name you played with and roughly when the quiz took place, so we can find the right data.
Hosts can remove a player during the quiz, stop sharing the results page and delete the participant data afterwards; otherwise it is deleted automatically after 12 months. To close your account, email us from the account’s address and we will delete it. If you are the only member of your organisation, we also delete its quizzes, sessions, results and images.
You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY), imy.se, or the data protection authority where you live.
Children and schools
Accounts are for adults. To create one you must be at least 18 or have a parent’s or guardian’s permission.
Children can play without an account, for example in a lesson. When a school or another organisation hosts the quiz, it is responsible for the players’ data. When a private person hosts it, we are; see Who is responsible. Let children use a first name or a nickname, and bear in mind that, while you share it, anyone with the link can open the results page with the names for 30 days, including the players themselves and anyone they share it with. You can turn sharing off for the session in the control room. Delete the participant data when it is no longer needed; otherwise it is deleted after 12 months.
Security
Data is sent encrypted. Each organisation can only reach its own data, which the database itself enforces, and a player’s key only works for their own place in one session. We limit how many requests can be made, and only those who need it have access to the systems.
No service is free of risk, but we work to protect the data against unauthorised access, loss and misuse. If your data is affected by an incident that may put you at risk, we will inform you and the supervisory authority when the law requires it.
Changes
We update this policy when the service or the law changes. The date at the top shows the latest version. If we make a change that significantly affects you, we will tell you in the service or by email before it takes effect.
Contact
Send questions about personal data to support@vopola.com.
- Company
- Saiokatta AB
- Company reg. no.
- 559527-9380
- Registered with
- Swedish Companies Registration Office (Bolagsverket)
- VAT no.
- SE559527938001
- Address
- Hägerstensvägen 170, 126 53 Hägersten, Sweden
- support@vopola.com