Data Processing Agreement

1. Scope and Roles

This Data Processing Agreement ("DPA") applies where you use RooQuiz to collect personal data from your respondents. It forms part of, and is incorporated by reference into, the RooQuiz Terms of Service. By using the service to collect responses, you accept this DPA; no signature is required for it to take effect.

As explained in our Privacy Policy, our role depends on the data. For your account data (your name, email address, billing details and usage data) we are the controller. For quiz responses and leads — the answers, contact details and any other information your respondents submit through quizzes you create — you are the controller and we act as your processor. This DPA governs that second category.

The processor under this DPA is JINJUN SHAO, operating as RooQuiz. Contact: contact@rooquiz.com.

If this DPA conflicts with the Terms of Service or the Privacy Policy in respect of processing carried out on your behalf, this DPA prevails.

2. Subject Matter, Duration, Nature and Purpose

The particulars required by Article 28(3) GDPR are as follows:

• Subject matter: provision of the RooQuiz quiz and assessment platform, including collection, scoring, storage, analysis and delivery of quiz responses and the leads derived from them.
• Duration: for as long as your account is active, plus the retention periods set out in section 9.
• Nature and purpose: hosting, storing, scoring and displaying responses; generating result pages and reports; capturing and organising leads; sending result and notification emails at your configuration; and delivering data to the destinations you connect.
• Types of personal data and categories of data subjects: as set out in Annex A.

3. Our Obligations as Processor

We will:

• process personal data only on your documented instructions, including the instructions expressed through your configuration of the service (your questions, scoring, report settings, connectors and email settings), unless required otherwise by applicable law — in which case we will inform you before processing, unless that law prohibits it;
• ensure that personnel authorised to process personal data are bound by an obligation of confidentiality;
• implement the technical and organisational measures described in Annex B;
• assist you, taking into account the nature of the processing, in fulfilling your obligation to respond to data subject requests (see section 6);
• assist you in ensuring compliance with your obligations under Articles 32 to 36 GDPR, taking into account the nature of processing and the information available to us;
• make available the information necessary to demonstrate compliance with Article 28 GDPR (see section 8);
• at your choice, delete or return personal data at the end of the service, as described in section 9.

We do not sell personal data, and we do not use your respondents' personal data for our own purposes — including advertising, profiling, or training AI models.

4. Sub-processors

You give us general written authorisation to engage the sub-processors listed in Annex C. We remain fully liable to you for the performance of each sub-processor's obligations.

Each sub-processor is engaged under a written contract imposing data protection obligations no less protective than those in this DPA.

We will update the list in Annex C before adding or replacing a sub-processor, and the "Last Updated" date at the top of this page will change accordingly. If you object to a new sub-processor on reasonable data protection grounds, tell us at contact@rooquiz.com within 30 days; if we cannot offer a reasonable alternative, you may terminate the affected part of the service and receive a refund of any prepaid, unused fees.

Destinations you connect yourself — Slack, Zapier, Kit, webhooks, your own SMTP server, and any AI client you link over MCP — are not our sub-processors. When you enable one, you instruct us to transmit data to a third party of your choosing, and that provider processes it under your relationship with them.

5. International Transfers

The primary database holding quiz responses and leads is hosted in the United States (AWS us-west-2, Oregon). The application layer, object storage and caching run on Cloudflare's global network.

Personal data processed under this DPA is therefore transferred outside the European Economic Area, and several sub-processors listed in Annex C are established outside it or operate global infrastructure. Where we transfer personal data of individuals in the EEA, the United Kingdom or Switzerland, the transfer is covered by the European Commission's Standard Contractual Clauses (together with the UK International Data Transfer Addendum where applicable), or by another transfer mechanism recognised under Chapter V GDPR. A copy of the clauses we rely on is available on request.

AI features — quiz generation and report analysis — run on Cloudflare Workers AI using models hosted by Cloudflare. Your content is not sent to OpenAI, Anthropic, Google or any other external AI provider for these features, and is not used to train third-party models.

6. Data Subject Requests

You are responsible for responding to your respondents' requests to exercise their rights. The service gives you direct access to the personal data we hold on your behalf: you can view, edit, export and delete responses, respondents and leads from your account at any time, which is normally sufficient to satisfy a request without our involvement.

If a respondent contacts us directly about data you control, we will not respond on your behalf. We will tell them to contact you and, where we can identify you as the controller, forward the request to you without undue delay. If you need help that the product's own tools cannot provide, contact us at contact@rooquiz.com and we will assist you.

7. Personal Data Breaches

We will notify you without undue delay after becoming aware of a personal data breach affecting personal data we process on your behalf, and in any event in time for you to meet your own notification obligations under Articles 33 and 34 GDPR.

The notification will describe the nature of the breach, the categories and approximate number of data subjects and records concerned so far as known, the likely consequences, the measures taken or proposed, and a contact point for further information. Where the full picture is not yet available, we will provide information in phases as it becomes known.

8. Audits and Information

On written request, and no more than once in any 12-month period unless a supervisory authority requires otherwise or a breach has occurred, we will provide the information reasonably necessary to demonstrate our compliance with this DPA, including a description of our technical and organisational measures.

Where that information is not sufficient for your purposes, we will cooperate in good faith with a further audit conducted by you or an independent auditor mandated by you, subject to reasonable notice, confidentiality obligations, and arrangements that do not compromise the security or privacy of our other customers.

9. Deletion and Return

You can delete responses, respondents and leads at any time from your account, and export them in CSV format subject to your plan's export limits.

On termination or expiry of your account, we will delete personal data processed on your behalf within 90 days, except where retention is required by applicable law. Backups are purged on their normal rotation cycle. If you need a final export, request it before your account closes.

At your request before deletion, we will make the data available to you in a commonly used, machine-readable format.

10. Your Obligations as Controller

You are responsible for the lawfulness of the data you collect through RooQuiz. In particular you must:

• have a lawful basis under Article 6 GDPR for collecting and using respondent data, and a valid basis for any marketing you carry out afterwards;
• provide your respondents with the information required by Articles 13 and 14 GDPR — who you are, what you will do with their answers, and how to reach you;
• obtain consent where consent is the basis you rely on, including for marketing emails you send to leads captured through a quiz, and keep a record of it;
• not collect special category data (Article 9 GDPR) — health, biometric, political, religious or similar data — through quizzes unless you have an appropriate lawful basis and have told us in advance;
• configure the service, including report gates and connectors, in a way that is consistent with what you have told your respondents.

RooQuiz collects this for you by default: wherever a respondent hands over their email to see their report, an optional checkbox — never pre-ticked — asks whether they would like to hear from you. There is nothing to switch on. Leaving it unticked does not stop them viewing the report, because consent demanded in exchange for something is not valid consent. Consent status is filterable on your leads and respondents and is included in exports, so you can send only the people who agreed. Withdrawal is self-service for anyone with an account: they can turn it off in their personal centre at any time, and your lists and exports reflect that immediately — you do not have to process the request. Someone who only opened a single report has no account; if such a person asks you to stop, you can withdraw it on their behalf from the lead's detail page. You cannot grant consent on someone's behalf — only the respondent can do that, which is what keeps the record meaningful as evidence. You remain responsible for what you send and for acting on any withdrawal that reaches you directly.

11. Signed Copies

This DPA takes effect without signature. If your own compliance process requires a countersigned copy, or a version on your paper, email contact@rooquiz.com and we will arrange it.

Annex A — Details of the Processing

Categories of data subjects

The people who answer quizzes you publish ("respondents"), and any people whose details you enter into RooQuiz yourself as leads.

Categories of personal data

• Identity and contact data: name, email address, and phone number where your quiz or lead settings collect them.
• Response data: the answers submitted to your quizzes, including any free-text answers, together with scores, dimension results and the generated report.
• Lead management data: notes, comments, tags, assignment, source and status you record against a lead.
• Booking data: requested times, time zone and any message submitted when a respondent books a call through a result page.
• Technical data: IP address, user agent, timestamps and submission metadata collected to operate and secure the service.
• Any other personal data you choose to collect through your questions or custom respondent fields.

Special category data

Not intended. Quizzes are configured by you, so you control whether such data is collected; see section 10.

Frequency and duration

Continuous, for the duration of your use of the service, subject to the retention and deletion terms in section 9.

Annex B — Technical and Organisational Measures

We maintain measures appropriate to the risk, including:

• Encryption in transit (TLS) for all connections to the platform, and encryption at rest for the primary database and object storage.
• Credentials for connected destinations (such as Slack and Kit access tokens) stored encrypted at the application layer.
• Tenant isolation: every query is scoped to the team that owns the data, enforced in the application's access layer rather than by convention.
• Role-based access control within a team (owner, admin, member, viewer), with permission checks on both read and write paths.
• Personal data returned through the MCP interface to AI clients is masked before it leaves our systems.
• Bot and abuse protection on public quiz pages (Cloudflare Turnstile) and rate limiting on sensitive endpoints.
• An audit log of administrative actions, retained for 90 days on the Free plan and 365 days on Pro.
• Access to production systems limited to personnel who require it, protected by multi-factor authentication.
• Managed, redundant infrastructure with automated database backups.
• Security patches applied through regular dependency updates and automated vulnerability alerts.

These measures evolve as the service does. We may replace a measure with one that is at least equivalent in protection.

Annex C — Sub-processors

The following sub-processors are engaged to deliver the service. "Account data" means data about you as a RooQuiz customer; "service data" means the responses and leads we process on your behalf.

Destinations you connect yourself are not included above; see section 4.

Questions

Write to contact@rooquiz.com. For our general handling of personal data, see the Privacy Policy.

Privacy Policy · Terms of Service