Data processing agreement (DPA)

In short: when you run a room for a school, company or other organisation, you (the organisation) are the controller of participants' data and limequiz is your processor. This agreement is the contract that Article 28 of the GDPR requires between the two. It follows the European Commission's standard contractual clauses for controllers and processors (Implementing Decision (EU) 2021/915), adapted for limequiz. If you accept the Terms, you accept this agreement too. Schools and larger organisations can ask for a signable copy at hello@limequiz.com.

Parties

• Controller ("you"): the organisation on whose behalf a presenter runs rooms, as identified by the presenter's account and workspace. Presenters confirm they are authorised to accept this agreement for it.
• Processor ("limequiz"): the self-employed person who runs limequiz, in Spain. Their full name, tax ID and address appear in any signed copy and are given on request. Contact: hello@limequiz.com.

1. Purpose and scope

1.1 This agreement sets out how limequiz processes personal data on your behalf when you use limequiz to run rooms, as described in Annex I. It applies alongside the Terms.

1.2 Data that limequiz processes as its own controller (accounts, billing and the like) is not covered. The Privacy policy covers it.

1.3 If there is a conflict between this agreement and the Terms about personal data, this agreement prevails. Nothing in it contradicts the GDPR or Spain's Organic Law 3/2018 (LOPDGDD).

2. Instructions

2.1 limequiz processes personal data only on your documented instructions, unless the law requires otherwise. If so, it tells you before, unless the law forbids that. Your instructions are these clauses, the Terms, and your use of limequiz's features and settings.

2.2 limequiz tells you at once if it believes an instruction breaks the GDPR or other data protection law.

2.3 limequiz does not use personal data from rooms for its own purposes. In particular, it does not use it for advertising, profiling, training AI models or selling it. It may count anonymous totals about the service, such as how many rooms were run.

3. Your responsibilities

You decide the purposes and means of processing and are responsible for having a lawful basis, for informing participants (limequiz's join-screen notice helps but does not replace your information), and for the instructions you give. Schools stay responsible for their pupils' data, including when they publish results (LOPDGDD, article 92). You will not ask limequiz to process special categories of data, and you will not put personal data of pupils or others into what you send to AI features (see the Terms). Sticky notes grouped by idea send participants' notes to Anthropic (Annex III); where you don't want that, turn off «Group by idea when shown» on the block.

4. Confidentiality

limequiz allows access to personal data only to people who need it to provide the service, and makes sure they are bound by confidentiality.

5. Security

limequiz takes the technical and organisational measures in Annex II, and keeps them appropriate to the risk, taking into account the state of the art, the cost, and the nature and risks of the processing (GDPR, article 32).

6. Sub-processors

6.1 You give limequiz general written authorisation to use the sub-processors in Annex III (also published at /legal/subprocessors).

6.2 limequiz tells you at least 30 days before adding or replacing a sub-processor, by email to the owner of your workspace and on the sub-processors page. You may object on reasonable data protection grounds within that time. Then the parties look for a solution. If there is none, you may end the service, and limequiz refunds the unused part of any paid period.

6.3 limequiz has a written contract with each sub-processor that imposes the same data protection obligations as this agreement. limequiz remains responsible to you for the sub-processor's performance and tells you if one fails to meet its obligations.

7. Transfers outside the EU

limequiz transfers personal data outside the EU/EEA only on your instructions and in line with Chapter V of the GDPR. Annex III lists each provider's location and the safeguard used, such as the Standard Contractual Clauses. If a safeguard stops being valid, limequiz tells you and takes appropriate steps, which may include moving processing or stopping the transfer.

8. Helping you

8.1 Data subjects' requests. If someone contacts limequiz about their data from a room, limequiz passes the request to you without answering it itself, unless you instruct otherwise. It helps you answer requests to access, correct, delete, restrict, export or object, using the tools in limequiz (for example deleting participants or exporting results).

8.2 Impact assessments and authorities. limequiz helps you with data protection impact assessments, prior consultations and dealings with the authorities, given the nature of the processing and the information it has.

8.3 Information and audits. limequiz gives you the information needed to show that it complies with this agreement, and allows and contributes to audits and inspections by you or an auditor you choose. It does so with reasonable notice, during business hours, without disrupting the service or putting other customers' data at risk, and at your cost, unless the audit shows that limequiz breached this agreement.

9. Personal data breaches

9.1 limequiz tells you without undue delay, and within 48 hours, after it becomes aware of a breach that affects your data.

9.2 The notice says, as far as known: the nature of the breach (with the categories and approximate numbers of participants and records affected), the likely consequences, the measures taken or proposed, and a contact. Where not everything is known at once, limequiz gives the rest as it learns it.

9.3 limequiz helps you meet your own duty to notify the AEPD (within 72 hours) and, where needed, the people affected.

10. Retention, deletion and return

10.1 During the service. limequiz keeps each room, with its participants' data, for 12 months after the room was created, on every plan. It then deletes it automatically. You can delete a room earlier, and you can export its results before that.

10.2 At the end. When the service ends, you decide whether limequiz deletes or returns the data (LOPDGDD, article 33.3). Tell limequiz within 30 days of the end of the service. If you do not, limequiz deletes it. Deletion from live systems is at once, and backups roll over within 30 days. limequiz confirms deletion in writing on request. It may keep data only where the law requires, or, duly blocked, for as long as responsibilities could arise from its relationship with you (LOPDGDD, article 33.4).

11. Ending this agreement

This agreement lasts as long as limequiz processes your data. Either party may end it if the other seriously or persistently breaches it and does not put it right within a reasonable time after notice, and you may suspend processing meanwhile. After it ends, clause 10.2 applies.

12. Liability, law and courts

Liability under this agreement follows the Terms (section 11) but does not limit rights that data subjects have under the GDPR (article 82). Spanish law governs, and the courts named in section 16 of the Terms have jurisdiction.

Annex I: description of the processing

Annex II: security measures

limequiz is run by one person. These are the measures in place on the date of this version (see the top of this document).

Access control

• Row-level security on the database. Presenters can only see their own workspace's data. Participants have no account. They act in a room only with a per-room token that is signed and checked by the server. What a room shows on the big screen (names, revealed answers, scoreboard) can be read with the room's code until the room is deleted. Codes are random, rooms are not listed or indexed, and repeated guesses are blocked.
• The key that gives full access to the database only exists on the server side and is never sent to browsers.
• Personal API tokens for the MCP server are stored only as hashes. Tokens are shown once and can be revoked.
• Access by the operator to production systems is limited to what is needed to run and support the service. The operator's accounts with the providers in Annex III and with the code host are protected by two-factor authentication.

Data protection

• Traffic to and from limequiz is encrypted in transit (HTTPS). Data at rest is encrypted by the database provider (AES-256).
• Data minimisation by design: participants have no account or email. Network addresses are not stored in the database. They are turned into a keyed hash for rate limiting and dropped after about a day.
• Participants' answers are not included in emails. They reach an AI provider only as sticky notes a presenter has grouped by idea: the notes' text, without saying who wrote them, and never notes the presenter has hidden (Annex III).
• Automatic deletion of participant data after the retention period, and deletion by the presenter at any time.

Resilience and recovery

• Daily backups by the database provider, kept in the same EU region and overwritten within 30 days.
• Rate limiting on joining rooms, guessing room codes and generating AI content.

Organisation

• The operator is bound by confidentiality. Any contractor with access to personal data will be bound by written confidentiality and by this agreement's obligations, and will be added to Annex III before getting access.
• A written procedure for personal data breaches.
• Providers are chosen for their security and data protection commitments and have data processing agreements with limequiz. Copies are kept.
• Security reports can be sent to hello@limequiz.com.

Annex III: authorised sub-processors

The list at /legal/subprocessors forms part of this agreement. In brief, on the date of this version: Supabase (database) and Vercel (hosting) process participants' data. Anthropic (AI) processes the text of participants' sticky notes, without saying who wrote them, when a presenter has them grouped by idea, as well as presenters' own inputs. Resend (emails) receives only presenters' data; it is listed for transparency and is not a sub-processor of participants' data.