At CuliQuiz we treat personal data with care. This Privacy Policy explains what personal data we process, why we use it, with whom it may be shared, how long it is retained and what rights you have under the General Data Protection Regulation (GDPR).

CuliQuiz operates two technically different environments: the Public Website and the Application. Their data practices are described separately so that website cookies and marketing trackers are not incorrectly attributed to the Application.

1. Who we are

CuliQuiz B.V.
Vlielandstraat 2, 1506 ZK Zaandam, Netherlands
Chamber of Commerce: 92064213 | VAT: NL865871358B01

CuliQuiz is normally the data controller for personal data collected directly through the Public Website, the Application and related account and support services.

When an employer, school, organisation, partner or campaign organiser provides access to CuliQuiz and determines why participant or employee data is used, that organisation may be the data controller and CuliQuiz may act as its processor. In that situation, the organisation is responsible for its own legal basis and privacy information, while CuliQuiz processes the relevant data under its instructions and the applicable data-processing agreement.

2. The environments covered by this policy

2.1 Public Website

The Public Website means the marketing and information pages on www.culiquiz.nl, including public contact forms and the Privacy, Support, Account Deletion and Terms pages.

Website contact data, browser data, cookies, consent choices and the website analytics and marketing technologies listed in section 4 belong only to this Public Website environment.

2.2 Application

The Application means the CuliQuiz mobile application for iOS and Android together with the CuliQuiz player web application, account services, guest play, gameplay, campaigns, progress and leaderboards. Although the player web app runs in a browser, it is part of the Application environment and is not part of the public marketing website.

The Application contains no advertisements and does not use advertising SDKs, advertising identifiers or cross-app tracking. Public Website marketing trackers are not loaded merely because a user opens the mobile app or plays through the player web app.

The Application may use operational services or SDKs that are necessary for app functionality, authentication, security, crash diagnostics, performance or communications. These are not used for third-party advertising or cross-app tracking.

3. Application data

3.1 Account and profile data

  • name, display name or username;
  • email address and account identifier;
  • authentication information, such as a password hash or authentication token;
  • preferred language, role, persona and learning preferences;
  • profile image or avatar, if this option is used; and
  • account status, consent records and application settings.

3.2 Organisation and membership data

  • organisation, school, employer, team or location membership;
  • invitation and membership status;
  • administrative or participant role and related permissions;
  • campaign, challenge or learning-group participation; and
  • information an authorised organisation administrator provides or manages.

3.3 Gameplay and learning data

  • game sessions, questions shown and answers submitted;
  • correct and incorrect answers, response times and completion status;
  • scores, XP, streaks, badges, ranks and leaderboard positions;
  • learning progress, skill-domain activity and campaign participation; and
  • technical session identifiers needed to save, resume or synchronise gameplay, including offline activity when it reconnects.

3.4 Application technical, diagnostic and security data

  • IP address, date and time, app version, operating system and device type;
  • language, time zone and basic application settings;
  • session, authentication and notification identifiers where required for the selected features;
  • diagnostic information, error reports, crash information, performance data and server logs; and
  • security events, failed authentication attempts and fraud-prevention signals.

The exact Apple App Privacy and Google Play Data Safety declarations are based on the data and operational services present in the submitted Application build. This does not include the separate marketing technologies used on the Public Website.

3.5 Guest play

CuliQuiz may allow users to play without creating a full registered account. We may use a temporary guest or session identifier, device or browser storage, selected language and gameplay data to operate the session, prevent abuse and synchronise progress. If a guest account or persistent guest profile is created, the account-deletion options described in this policy also apply.

3.6 Sensitive data

CuliQuiz does not intentionally request special categories of personal data, such as health information, political opinions, religion or biometric data. Please do not submit this information through profiles, gameplay or support messages unless CuliQuiz has specifically requested it and provided an appropriate legal basis and privacy notice.

4. Public Website data, cookies and trackers

4.1 Contact and support data

  • information submitted through a contact, support, complaint or account-deletion form;
  • the email address and name used to contact us;
  • device, operating-system and app-version information a user chooses to provide; and
  • verification and correspondence needed to handle a privacy or deletion request.

4.2 Necessary website technologies

Necessary technologies support basic website functionality, security, language selection, form delivery and storage of the visitor’s cookie choice. These cannot be switched off where they are required to provide the Public Website.

4.3 Website statistics — after consent

Optional statistics technologies are loaded on the Public Website only after the visitor gives the required consent through the cookie banner.

  • Vercel Analytics — website page views and performance data;
  • Google Analytics 4 — website visitor and session statistics, with IP anonymisation where configured;
  • Zoho SalesIQ — website customer-service chat and visitor interaction; and
  • Microsoft Clarity — website heatmaps and session interaction used to improve the Public Website.

4.4 Website marketing — after consent

Optional marketing and advertising-measurement technologies are used only on the Public Website and only after the visitor gives the required consent.

  • LinkedIn Insight Tag — website advertising measurement and audience services;
  • Meta Pixel — website advertising measurement and retargeting on Facebook and Instagram;
  • TikTok Pixel — website advertising measurement on TikTok; and
  • Google Ads — website conversion measurement through the linked Google Analytics property.

Visitors can change or withdraw their optional website consent at any time through the Cookie settings link in the website footer. Withdrawing consent does not affect processing that took place before withdrawal.

5. How we obtain personal data

We obtain personal data:

  • directly from a user who registers, plays, updates a profile, submits a Public Website form, contacts support or requests deletion;
  • from an employer, school, organisation, partner or campaign organiser that invites or registers a user;
  • automatically from the Application, browser or device when a user uses the relevant service; and
  • from service providers that support authentication, hosting, databases, security, communication, diagnostics, app distribution or, for the Public Website only, consented analytics and marketing.

6. Why we use personal data and our legal bases

6.1 Application purposes

  • Provide and operate the Application — to create accounts, authenticate users, deliver games, save progress and provide requested features. Legal basis: performance of a contract or steps requested before entering a contract.
  • Learning, scoring and competition — to calculate scores, XP, ranks, streaks, badges and relevant leaderboards. Legal basis: performance of a contract and our legitimate interest in providing the requested game-based learning service.
  • Organisation and campaign services — to manage invitations, memberships, permissions, campaigns and authorised analytics. Legal basis: performance of a contract, legitimate interests or the instructions of the relevant organisation as controller.
  • Security and reliability — to prevent abuse, detect fraud, investigate incidents, maintain logs and protect accounts and infrastructure. Legal basis: our legitimate interests and, where applicable, legal obligations.
  • Application support and communication — to answer enquiries, resolve technical issues and send service-related messages. Legal basis: performance of a contract, legitimate interests and legal obligations.
  • Service analytics and improvement — to understand application use, performance and learning outcomes and to improve the service. Legal basis: legitimate interests, or consent where required.

6.2 Public Website purposes

  • Provide the Public Website — to display information, remember language and cookie choices, protect the website and deliver submitted forms. Legal basis: legitimate interests, performance of a requested service or consent where required.
  • Website statistics — to measure and improve the Public Website through optional statistics technologies. Legal basis: consent.
  • Website marketing — to measure campaigns, create audiences or show relevant advertising through optional Public Website trackers. Legal basis: consent.
  • Privacy, deletion and support requests — to verify and respond to requests. Legal basis: legal obligations, performance of a requested service and legitimate interests.
  • Legal and administrative purposes — to keep required business records, handle disputes and comply with law. Legal basis: legal obligations and legitimate interests.

7. Leaderboards, organisations and campaigns

Depending on the game, organisation or campaign settings, a display name, score, rank, badge or progress indicator may be visible to other participants, authorised organisation administrators, campaign owners or partners. The relevant scope may be public, campaign-specific, organisation-specific or limited to a team.

Organisation administrators may view membership, participation, progress and analytics where this is necessary to provide the organisation service. Campaign partners or sponsors receive only the information needed for the campaign and the reporting scope communicated to participants. Direct contact details are not shared with a campaign partner for its own marketing unless there is a separate legal basis or valid consent.

8. With whom we share personal data

8.1 Application recipients and service providers

  • authorised organisation administrators, schools, employers, partners or campaign owners within the relevant Application service scope;
  • hosting, database, infrastructure and security providers used by the Application, including Amazon Web Services, Supabase and Cloudflare;
  • email and communication providers used for invitations, verification, notifications and support, including Amazon Simple Email Service;
  • Apple and Google for app distribution, store services and platform-level functions under their own privacy terms; and
  • operational providers used for authentication, diagnostics or performance where they are included in the relevant Application build.

8.2 Public Website recipients and service providers

  • website hosting, security, consent and form-delivery providers, including Vercel and Cloudflare;
  • Zoho for website customer-service and contact functions where used;
  • the website statistics providers listed in section 4.3, after the required consent; and
  • the website marketing providers listed in section 4.4, after the required consent.

8.3 Other disclosures

We may disclose limited personal data to professional advisers, public authorities or other recipients where disclosure is legally required or necessary to establish, exercise or defend legal claims.

Service providers may process personal data only for the agreed services and under appropriate contractual and security obligations. CuliQuiz does not sell personal data.

9. International transfers

Some providers may process personal data outside the European Economic Area. Where required, we use an adequacy decision, the EU-US Data Privacy Framework for eligible organisations, the European Commission’s Standard Contractual Clauses or another lawful transfer mechanism, together with additional safeguards where appropriate.

10. Retention

We retain personal data only for as long as needed for the purposes described above, the agreed service, security and dispute resolution, or a legal obligation.

10.1 Application and account retention

  • Account and profile data — while the account is active and until the verified deletion process is completed.
  • Membership, progress and gameplay data — while needed for the account, organisation or campaign. On account deletion, personal links are deleted or irreversibly anonymised unless a legal obligation requires limited retention.
  • Pending account-deletion requests — deletion is scheduled and normally completed within 30 days after verification. The user may cancel before final completion; completed deletion is permanent.
  • Anonymised or aggregated analytics — may be retained where the information can no longer reasonably be linked to an identifiable user.
  • Application server and security logs — normally no longer than 30 days, unless an incident, fraud investigation or legal obligation requires longer retention.
  • Application backups — removed from active systems as part of deletion and normally overwritten within 90 days under the backup rotation cycle. Backup data is isolated and used only for security and disaster recovery.

10.2 Public Website and correspondence retention

  • Website cookie choice — up to 12 months in the browser.
  • Website analytics — according to the configured service period, generally up to 14 months for Google Analytics and up to 26 months for Microsoft Clarity.
  • Support, privacy and complaint correspondence — for as long as needed to handle the request and normally no longer than two years after closure, unless a dispute or legal duty requires longer retention.
  • Financial and administrative records — up to seven years where required under Dutch tax or accounting law.

11. Account and data deletion

Users can initiate permanent account deletion through the account-deletion option in the Application settings or submit a request through the public Account Deletion page:
https://www.culiquiz.nl/en/account-deletion

We may verify the request through the email address associated with the account. Deletion is scheduled and normally completed within 30 days after verification. A user may cancel the request before final completion. Deleting the Application from a device does not delete the account.

After completion, direct identifiers, profile information, organisation connections and personal progress or gameplay history are deleted or irreversibly anonymised. Limited anonymous or aggregated game, campaign and platform statistics may remain where they can no longer be linked to the user. A retained anonymous leaderboard record may be displayed as ‘Deleted player’.

We may retain limited information where required by law or necessary for security, fraud prevention or legal disputes. Retained information remains protected and is used only for those purposes.

12. Artificial intelligence

CuliQuiz may use artificial-intelligence-assisted tools to help generate, translate, classify or review educational content and to support platform operations. Where personal data is processed through an AI service, we apply the same necessity, contractual and security requirements as for other service providers. CuliQuiz does not use solely automated decisions that produce legal effects or similarly significant effects for users.

13. Age and younger users

CuliQuiz is intended for users aged 13 and over. Some educational content may contain factual references to alcoholic beverages as part of hospitality knowledge. These references are informational and do not encourage underage alcohol use.

CuliQuiz is not directed at children under 13. Users aged 13 to 15 may use CuliQuiz only where their access and the relevant processing are appropriately authorised by a parent, guardian, school or other responsible organisation where required by applicable law. Where consent is the legal basis for an online service offered directly to a user under 16 in the Netherlands, valid authorisation from a parent or guardian may be required.

We do not knowingly seek to collect more personal data from younger users than is necessary to provide the service. If you believe a child under 13 has provided personal data, or that a younger user’s data has been processed without appropriate authorisation, contact us so that we can investigate and take appropriate action.

14. Security

We use appropriate technical and organisational safeguards designed to protect personal data. These include encrypted connections, access controls based on role and need, administrative account protection, monitoring and logging, secure cloud infrastructure, backups and processes for handling security incidents. No method of transmission or storage is completely risk-free, but we review safeguards as the platform develops.

15. Your rights

Subject to the GDPR and applicable conditions, you may have the right to:

  • access your personal data;
  • correct inaccurate or incomplete data;
  • request erasure of personal data;
  • restrict processing;
  • object to processing based on legitimate interests or to direct marketing;
  • receive certain data in a structured, commonly used and machine-readable format;
  • withdraw consent at any time, without affecting earlier lawful processing; and
  • lodge a complaint with a data-protection authority.

To protect users, we may ask for information needed to verify identity before responding. If CuliQuiz processes data only on behalf of an employer, school or other organisation, we may refer the request to that controller or assist it in responding.

16. Complaints

For a privacy request or complaint, email complaints@culiquiz.nl. You also have the right to lodge a complaint with the Dutch Data Protection Authority:
https://autoriteitpersoonsgegevens.nl

17. Changes to this policy

We may update this Privacy Policy when the Public Website, the Application, our data practices, providers or legal obligations change. The date at the top shows the latest update. Material changes will be communicated through the Application, the Public Website or email where appropriate.

Contact

CuliQuiz B.V.
Vlielandstraat 2, 1506 ZK Zaandam, Netherlands
Chamber of Commerce: 92064213 | VAT: NL865871358B01

General information: info@culiquiz.nl
Support: support@culiquiz.nl
Privacy requests and complaints: complaints@culiquiz.nl