Data Processing Agreement

Last updated: 22 October 2026

Print or save as PDF

Agreement on the processing of personal data under art. 28 of Regulation (EU) 2016/679 (GDPR). It forms an integral part of the Quizhat Terms of service and applies automatically, without the need for a signature, to every account that uses Quizhat with participants' data. For a signed copy or for questions write to festalaurea.info@gmail.com.

1. Parties and subject matter

• Controller (the “Controller”): the customer holding the Quizhat account, or the organisation (training provider, company, school, event organiser) on whose behalf they act, which organises the sessions.
• Processor (the “Processor”): FESTALAUREA SRLS, Via Luigi Mascherpa 18, 35131 Padova (PD), Italy, VAT no. 05743150285, PEC festalaurea@pec.it, which provides Quizhat.
• Subject matter: the processing, by the Processor and on behalf of the Controller, of the personal data of session participants and enrolled participants, necessary to provide the Quizhat service. The Controller's account data is instead processed by FESTALAUREA SRLS as an independent controller, in accordance with the Privacy policy.

2. Description of the processing

• Nature and purpose: collection, recording, storage, consultation, processing, disclosure to the Controller and erasure of data in order to run quizzes and tests live or remotely, calculate scores and results, produce reports, official records, certificates and exports, and send by email the test links and follow-up questionnaires requested by the Controller.
• Categories of data subjects: session participants (for example workers in training, students, guests at an event) and enrolled participants uploaded by the Controller.
• Types of data: nickname, avatar and team; first name and surname; company and the other fields the Controller chooses to request; email of enrolled participants, if the Controller enters it; answers, times, scores, results and attempts; session events (joining, leaving, submission, leaving the page during the test); certificate data (name, course, date, result, verification code); answers to follow-up questionnaires; technical connection data needed for real-time operation.
• Special categories and criminal data: the service is not designed to process special categories of data (art. 9 GDPR) or data relating to criminal convictions and offences (art. 10). The Controller undertakes not to collect them through the additional fields or the questions.
• Duration: for the term of the contract, except as provided in section 11.

3. Obligations of the Controller

• The Controller determines the purposes and means of the processing and warrants that it has a valid legal basis, that it has provided data subjects with the information notice (Articles 13 and 14 GDPR), including on the use of Quizhat, the sending of emails and follow-ups, and that it collects only the data necessary (data minimisation).
• For participants who are minors, the Controller complies with the rules applicable to the school or organisation and prefers the use of non-identifying nicknames.
• The Controller keeps the credentials of its account safe and handles with care the reports, official records and exports it downloads, for which it is responsible once they leave the service.

4. Instructions

The Processor processes the data only on documented instructions from the Controller (art. 28(3)(a) GDPR). The instructions consist of this agreement, the Terms of service and the settings and actions the Controller performs in the service (for example fields to request, sending links, scheduling follow-ups, deleting a session or the account). Further instructions must be given in writing, including by email, and if they involve costs or activities not provided for by the service they may be agreed separately. The Processor informs the Controller without delay if it considers that an instruction infringes the GDPR or other data protection provisions. If Union or Italian law requires different processing, the Processor informs the Controller before the processing, unless the law prohibits it.

5. Confidentiality

The Processor authorises to process the data only the persons who need to do so in order to provide, maintain and support the service, instructs them and ensures that they have committed themselves to confidentiality or are under a statutory obligation of confidentiality (art. 28(3)(b)). The Processor does not access the content of sessions except to provide the service, for support requested by the Controller, for security or to comply with legal obligations.

6. Security measures

The Processor adopts technical and organisational measures appropriate to the risk (art. 32 GDPR), including:

• always-encrypted connections (HTTPS/TLS), including for the real-time connection of phones;
• access control: each account sees only its own sessions and reports; passwords stored only as Argon2 hashes; sign-in with Google or Microsoft via OpenID Connect;
• servers in a data centre in Italy, with firewall, administrative access only via cryptographic key and protection against repeated sign-in attempts;
• limits on sign-in attempts and registrations, checks on uploaded files;
• daily backup of the database and images, with verification of the integrity of the copy, and a restore procedure;
• software updates and automated tests of access controls.

The Processor may update the measures over time, provided that the overall level of security does not decrease.

7. Sub-processors

The Controller grants a general authorisation to engage other processors (sub-processors, art. 28(2) and 28(4) GDPR). The Processor imposes on each of them, by contract, data protection obligations substantially equivalent to those of this agreement and remains liable to the Controller for their performance. The current sub-processors are:

The Processor notifies the Controller by email, at least 15 days in advance, of the addition or replacement of a sub-processor and updates this page. The Controller may object on reasonable grounds relating to data protection within the same period; if no solution is found, the Controller may terminate the contract with a refund of the unused part of the subscription.

The following are not sub-processors, because they act as independent controllers and do not receive participants' data from the Processor on its behalf: Stripe (the Controller's payments), Google and Microsoft (sign-in to the Controller's account). In quizzes with YouTube videos inserted by the Controller, the participant's device loads the player directly from YouTube (Google), which receives the IP address as an independent controller: the Controller takes this into account in its own information notice or uses quizzes without videos.

8. Transfers outside the EU

The database, images and backups are stored in Italy. A transfer of data to countries outside the European Economic Area, including through a sub-processor, takes place only if a safeguard provided for by Chapter V of the GDPR is ensured: an adequacy decision (such as the EU-US Data Privacy Framework for certified providers) or the standard contractual clauses approved by the European Commission.

9. Assistance to the Controller

• Data subjects' rights (art. 28(3)(e)): the service allows the Controller to consult and export session data and to erase it by deleting the individual session from its report. The Processor forwards to the Controller, without delay and as a rule within 5 working days, the requests it receives directly from data subjects, without responding on the merits unless instructed by the Controller, and helps it follow up on requests that the Controller cannot fulfil on its own with the features of the service (for example by deleting a single participant at its request).
• Security, impact assessments and prior consultation (art. 28(3)(f)): the Processor provides the Controller with the information reasonably necessary for the obligations under Articles 32-36 GDPR, taking into account the nature of the processing and the information available to it.

10. Personal data breaches

The Processor informs the Controller without undue delay, and in any case within 48 hours of becoming aware of it, of any personal data breach affecting the data processed on its behalf (art. 33(2) GDPR). The notification is sent to the account email and contains, as far as available, the nature of the breach, the categories and approximate number of data subjects and of records concerned, the likely consequences, the measures taken or proposed and a contact point; information not immediately available is provided as soon as possible. The Processor takes measures without delay to contain the breach and assists the Controller with notifications to the Garante (Italian Data Protection Authority) and to data subjects.

11. Deletion and return of data

• During the contract the Controller can download at any time reports, official records, certificates and the full export of the account data (JSON format) from the Account page.
• The Controller can delete a single session from its report at any time (“Delete session”): the Processor immediately deletes the participants, answers, scores, page exits, enrolled participants and personal links, certificates (their verification page no longer shows them as valid) and follow-ups of the session. Copies in backups are overwritten within 14 days.
• When the Controller deletes the account, the Processor immediately deletes the data processed on its behalf (art. 28(3)(g)). Copies in backups are overwritten within 14 days; until then they are not used except for restoration in the event of a failure.
• If the contract ends for other reasons, the Processor keeps the data for 30 days to allow the Controller to download it, then deletes it, unless Union or Italian law requires its retention.
• At the Controller's request the Processor confirms the deletion in writing.

12. Information and audits

The Processor makes available to the Controller the information necessary to demonstrate compliance with art. 28 GDPR and allows for and contributes to audits, including inspections, conducted by the Controller or by an auditor mandated by it and bound by confidentiality (art. 28(3)(h)). Except in the case of data breaches or requests from an authority, audits take place as a rule once a year, with at least 30 days' written notice, during working hours, without access to other customers' data and without compromising the security of the service; they are carried out primarily through the Processor's documentation and written answers. The costs of the audit are borne by the Controller, unless material breaches by the Processor emerge.

13. Term and final provisions

• This agreement remains in force as long as the Processor processes data on behalf of the Controller and ends with the deletion provided for in section 11.
• Each party is liable to data subjects and to the other party in accordance with art. 82 GDPR. Between the parties, the limitations of liability in the Terms of service apply, to the extent permitted by law.
• In the event of conflict between this agreement and the Terms of service on data protection matters, this agreement prevails.
• Italian law and the jurisdiction stated in the Terms of service apply. The Processor may update the agreement in the manner provided for in the Terms of service, without reducing the safeguards for data subjects.