Data Processing Agreement

This is a template Data Processing Agreement and must be reviewed by legal counsel before reliance. It is provided as a starting point for business and education customers (for example, schools) who use ilzion to process personal data and who need a written processing agreement with us. It is notlegal advice, and using it does not by itself make any party “compliant” with, or “certified” under, the GDPR, the UK GDPR, or any other law. The operator of ilzion and the customer should each obtain their own legal advice and finalize the remaining blanks before relying on this document. The governing jurisdiction referenced in §13 is the Republic of Azerbaijan.

This Data Processing Agreement (this “DPA”) supplements and forms part of the Terms of Service(the “Terms”) between the customer (“Customer”, “you”) and ilzion, which is operated by an individual sole operator (“ilzion”, “we”, “us”). It is intended to reflect the structure of Articles 28–32 of the EU General Data Protection Regulation (the “GDPR”) and equivalent data-protection law where applicable. Capitalized terms not defined here have the meaning given in the Terms or in applicable data-protection law.

1. Roles of the parties

The parties acknowledge that, with respect to the personal data that Customer submits to or processes through the Service in the course of using it:

• Customer is the data controller of the personal data of its end users — for example, the quiz participants (often students), hosts, and other individuals whose data Customer determines the purposes and means of processing for. ilzion acts as the data processorand processes that data on Customer’s behalf under this DPA.
• ilzion is the independent data controller of the personal data it processes for its own account and operational purposes — for example, the account-registration details of the person who creates the ilzion account, billing information, security and abuse-prevention logs, and similar data. That processing is governed by our Privacy Policy, not by this DPA.

2. Subject-matter and duration of processing

The subject-matterof the processing is ilzion’s provision of the Service to Customer as described in the Terms — namely, hosting live multiplayer quizzes and the related creation, delivery, scoring, and storage of quiz content and participation. The processing begins when Customer first submits personal data to the Service and continues for as long as Customer uses the Service, ending on termination of the Terms or this DPA and the completion of the deletion or return obligations in §11.

3. Nature and purpose of processing

ilzion processes the personal data only to provide, secure, maintain, and improve the Service for Customer and to meet its obligations under the Terms — including hosting and running live quizzes, storing quizzes and results, authenticating account holders, enforcing anti-abuse and moderation controls, and providing support. ilzion does not run third-party advertising, behavioral tracking, or sell personal data.

4. Categories of personal data and data subjects

The categories of data subjects may include: quiz participants (who often join anonymously by nickname, and in education settings are frequently students or other minors), account holders and hosts, and other individuals whose data Customer chooses to include in quiz content.

The categories of personal data may include, depending on how Customer uses the Service:

• Display names, nicknames, and avatars chosen by participants;
• Account details for hosts (such as email address and authentication data);
• Quiz content, answers, scores, streaks, and participation records;
• Any personal data that Customer chooses to upload into quiz questions, answers, or media;
• Technical data needed to operate and secure a quiz, such as a randomly-generated device identifier used only to enforce per-quiz kick and block lists (see our Cookie Policy).

Customer is responsible for ensuring it has a lawful basis and any required consents (for example, parental or school consent in education settings) for the personal data it processes through the Service, and for not submitting special-category data unless it has a valid legal basis to do so.

5. Processor obligations

In its role as processor, ilzion agrees that it will:

• Documented instructions.Process the personal data only on Customer’s documented instructions — including those set out in the Terms and this DPA, and as needed to provide the Service — unless required to do otherwise by applicable law, in which case ilzion will, where legally permitted, inform Customer of that requirement.
• Confidentiality. Ensure that any person authorized to process the personal data is bound by an appropriate duty of confidentiality.
• Security (Article 32). Implement appropriate technical and organizational measures to protect the personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing. ilzion runs the Service on its own private server infrastructure and hashes account passwords. The specific measures in place are described, in summary form, on our Security page and may be updated as the Service evolves, provided the level of protection is not materially reduced.
• Assistance with data-subject requests. Taking into account the nature of the processing, assist Customer by appropriate technical and organizational measures, insofar as possible, in responding to requests from data subjects exercising their rights (such as access, rectification, erasure, restriction, portability, and objection).
• Assistance with compliance. Assist Customer, taking into account the nature of processing and the information available to ilzion, in ensuring compliance with its obligations relating to security, breach notification, data-protection impact assessments, and prior consultation with supervisory authorities.
• Breach notification.Notify Customer without undue delay after becoming aware of a personal-data breach affecting the personal data processed on Customer’s behalf, and provide Customer with the information reasonably available to help Customer meet its own notification obligations.

6. Sub-processors

Customer provides a general authorization for ilzion to engage sub-processors to help provide the Service. ilzion will impose data-protection obligations on each sub-processor that are substantially similar to those in this DPA, and remains responsible to Customer for a sub-processor’s performance of those obligations.

ilzion will give Customer at least thirty (30) days’ notice before adding or replacing a sub-processor that processes the personal data, so that Customer has an opportunity to object on reasonable data-protection grounds. The current sub-processors are:

The streaming integrations are optional and engage only when a host chooses to connect the relevant account; if no host connects a streaming account, those sub-processors do not process the personal data. This list may change over time, subject to the notice period above.

7. International transfers

The core Service infrastructure is hosted in the EU (Germany). Where any processing of personal data under this DPA involves a transfer to a country outside the European Economic Area, the United Kingdom, or another region whose laws require a transfer mechanism, that transfer will be carried out under an appropriate safeguard recognized by applicable law — for example, the European Commission’s Standard Contractual Clauses (and the UK Addendum or UK International Data Transfer Agreement where relevant) — or under another lawful transfer mechanism, in each case where and to the extent applicable. The optional streaming integrations in §6 may involve such transfers where a host connects them.

8. Customer obligations

Customer is responsible for the lawfulness of the personal data it submits and of its processing instructions, for having a valid legal basis and any required consents, and for complying with its own obligations as a controller under applicable data-protection law. Customer must not instruct ilzion to process personal data in a way that would breach applicable law.

9. Audit and information

ilzion will make available to Customer information reasonably necessary to demonstrate compliance with the obligations in this DPA, and will cooperate with and contribute to audits or inspections conducted by Customer or an auditor mandated by Customer, in each case on reasonable prior notice, no more than once per year (unless required more frequently by a supervisory authority or following a personal-data breach), during business hours, subject to confidentiality, and in a manner that does not unduly disrupt the Service or compromise the security or data of other customers.

10. Data-subject and authority requests

If ilzion receives a request from a data subject, or an inquiry from a supervisory authority, relating to personal data processed on Customer’s behalf, ilzion will, where legally permitted, promptly inform Customer and will not respond directly except on Customer’s documented instructions or as required by applicable law.

11. Deletion or return of data

On termination or expiry of the Service, or earlier on Customer’s written request, ilzion will, at Customer’s choice, delete or return the personal data processed on Customer’s behalf and delete existing copies, unless applicable law requires further storage. Personal data held in routine, secured backups will be deleted in the ordinary course as those backups age out over a normal rotation period. Customer can also use the Service’s self-service tools and our Data Deletion process for specific records.

12. Liability

Each party’s liability arising out of or related to this DPA is subject to the limitations and exclusions of liability set out in the Terms. This DPA does not increase a party’s aggregate liability beyond what is provided in the Terms, except to the extent applicable data-protection law requires otherwise.

13. Governing law and order of precedence

This DPA is governed by the laws of the Republic of Azerbaijan, being the governing jurisdiction set out in the Terms §15. In the event of a conflict between this DPA and the Terms regarding the processing of personal data, this DPA prevails to the extent of that conflict. In all other respects, the Terms remain in full force and effect.

14. Contact

For privacy and data-processing matters, including requests for a signed copy of a finalized DPA, contact privacy@ilzion.com. For security disclosures, contact security@ilzion.com. You can also visit our Contact page.

Reminder: this template must be reviewed and finalized by qualified legal counsel before either party relies on it. The governing jurisdiction in the Terms §15 is the Republic of Azerbaijan.