Data Processing Agreement
Last updated: 24 July 2026
1. Parties and applicability
This Data Processing Agreement (“DPA”) under Article 28 GDPR is entered into between David Azarian, K Beranovu 1190/15, Dolní Chabry, 184 00 Praha 8, Czech Republic, IČO: 17064619 (the “Processor”) and the customer using the Quizlo service (the “Controller”). It forms Annex 1 to the Terms of Service and applies automatically whenever the Controller collects or processes personal data of quiz respondents (“Respondent Data”) through the Service. No signature is required.
2. Details of the processing
| Subject matter | Hosting and processing of Respondent Data submitted through the Controller's quizzes. |
|---|---|
| Duration | For the term of the Controller's use of the Service, until deletion of the data or the account. |
| Nature and purpose | Collection via quiz forms, storage, display to the Controller, analytics aggregation, export (JSON/CSV), webhook and third-party integration delivery (e.g. Ecomail, Telegram, Slack, Discord) to destinations configured by the Controller, email notification of the Controller, deletion. |
| Types of personal data | Contact details configured by the Controller (typically name, email, phone), quiz answers, campaign (UTM) parameters, country code derived from IP, timestamps. Special categories of data (Art. 9 GDPR) are prohibited. |
| Categories of data subjects | Persons who fill in the Controller's quizzes (leads, customers, prospects). |
3. Controller's obligations
The Controller warrants it has a lawful basis for the processing, provides required information to data subjects (its own privacy notice), issues only lawful instructions, and will not use the Service to collect special categories of data, data of children, or payment card numbers.
4. Processor's obligations
The Processor shall:
- process Respondent Data only on the Controller's documented instructions – these consist of the functionality of the Service as configured and used by the Controller – including with regard to transfers, unless required otherwise by EU or Member State law (in which case the Processor informs the Controller unless prohibited);
- ensure persons authorised to process the data are bound by confidentiality;
- implement the technical and organisational measures in Annex B (Art. 32 GDPR);
- respect the sub-processor conditions in Section 5;
- taking into account the nature of the processing, assist the Controller with responding to data-subject requests (the Service provides self-service export and deletion; further assistance on request);
- assist the Controller with obligations under Articles 32–36 GDPR (security, breach notification, data protection impact assessments (DPIA) and prior consultation with the supervisory authority), taking into account the nature of processing and the information available;
- notify the Controller without undue delay after becoming aware of a personal data breach affecting Respondent Data, with information reasonably available to it;
- at the end of the provision of services, delete the Respondent Data (deletion of a lead, quiz or account permanently removes it; residual copies leave backups within 30 days), unless EU or Member State law requires storage;
- make available information necessary to demonstrate compliance with Art. 28 GDPR and allow audits under Section 7.
The Processor shall inform the Controller if, in its opinion, an instruction infringes the GDPR.
5. Sub-processors
The Controller grants a general authorisation to engage the sub-processors listed in Annex A. The Processor will inform the Controller at least 14 days before adding or replacing a sub-processor, by email or a notice in the Service's admin interface, and will update Annex A on this page accordingly. The Controller may object on reasonable data-protection grounds; if the objection cannot be resolved, the Controller may terminate the affected use of the Service. The Processor imposes data-protection obligations equivalent to this DPA on all sub-processors and remains liable for their performance.
6. International transfers
Where processing involves transfers outside the EEA, they are carried out under the EU-U.S. Data Privacy Framework and/or the European Commission's Standard Contractual Clauses concluded with the relevant sub-processor, supplemented by the measures in Annex B.
7. Audits
Upon written request no more than once per year, the Processor will provide documentation reasonably necessary to demonstrate compliance with this DPA. Where this is insufficient, the Controller may conduct (itself or via a mandated auditor that is not a competitor) an audit during business hours, upon 30 days' notice, without disrupting operations, at its own cost. The Controller shall reimburse the Processor for all documented costs and the time of the Processor's specialists spent supporting an on-site audit, at the Processor's then-current rates.
8. Liability and final provisions
Liability under this DPA is subject to the limitations in the Terms of Service, except where GDPR mandates otherwise (Art. 82). This DPA prevails over the Terms in case of conflict concerning personal data processing. It is governed by Czech law. It exists in English and Czech; in case of discrepancy the Czech version prevails.
Annex A – Authorised sub-processors
| Sub-processor | Processing | Location / transfer safeguard |
|---|---|---|
| Cloudflare, Inc. (incl. Cloudflare Workers, D1, R2, Workers AI, Turnstile, Email Sending) | Infrastructure hosting, database and file storage, transactional email delivery, bot protection, AI inference | USA / global network – EU-U.S. DPF, SCCs |
Note: payment processing (Stripe) and Google sign-in relate to the Controller's own account data, for which the Processor acts as controller – see the Privacy Policy – and are therefore not sub-processors of Respondent Data under this DPA.
Annex B – Technical and organisational measures
- Encryption in transit (TLS 1.2+) and at rest (provider-managed storage encryption).
- Authentication with salted PBKDF2 password hashing; httpOnly, secure session cookies; session invalidation on password change.
- Strict tenant isolation: every data access is scoped to the owning account; public endpoints expose only published quiz content.
- Webhook payloads signed with per-endpoint HMAC-SHA256 secrets; outbound webhook destinations validated against internal networks.
- Bot protection (Cloudflare Turnstile), per-IP rate limiting, honeypot and timing checks on public forms.
- Respondent IP addresses are not stored with submissions (only a derived country code).
- Atomic cascade deletion of leads, quizzes and accounts; backups expire within 30 days.
- Access to production restricted to authorised personnel; secrets stored in the platform's secret store, never in source code.