This Data Processing Agreement forms part of the agreement under which Attensi supplies QuizRace. It applies where the customer acts as controller or processor and Attensi processes personal data on the customer’s behalf. It is intended to satisfy the requirements of Article 28 of the GDPR and the UK GDPR.
1 Parties, Scope and Definitions
1.1 The customer identified in the applicable Account or Order Form is referred to as “Customer”, and Attensi AS is referred to as “Attensi”. The terms “controller”, “processor”, “personal data”, “processing”, “data subject”, “personal data breach” and “supervisory authority” have the meanings given to them under applicable data protection law.
1.2 Customer acts as controller and Attensi acts as processor, unless Customer is itself a processor, in which case Attensi acts as subprocessor. Annex I describes the processing. This Agreement shall remain in effect for as long as Attensi processes Customer Personal Data.
2 Instructions and Compliance
2.1 Attensi shall process Customer Personal Data only on Customer’s documented instructions, including as set out in the QuizRace Terms of Use and the Order Form and as reflected in Customer’s configured use of the Service, unless required to do otherwise by applicable law. In such a case, Attensi shall notify Customer of that legal requirement before processing, unless the law prohibits such notification.
2.2 Attensi shall inform Customer if, in its opinion, an instruction infringes applicable data protection law, and may suspend the affected processing until the instruction has been clarified. Customer is responsible for ensuring that its instructions are lawful and for providing notices, establishing legal bases and handling communications with data subjects.
2.3 Attensi shall ensure that persons authorised to process Customer Personal Data are bound by obligations of confidentiality and are subject to appropriate data protection and security obligations.
3 Security
3.1 Taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of processing and the associated risks, Attensi shall implement appropriate technical and organisational measures in accordance with Article 32 of the GDPR. These measures are described in Annex II and the QuizRace Security Measures Schedule. Customer acknowledges that the measures may evolve over time, provided that the overall level of protection is not materially reduced.
4 Subprocessors
4.1 Customer grants Attensi a general written authorisation to engage subprocessors. The current list of subprocessors is set out in Annex III and at https://attensi.com/legal/approved-sub-processors/. Attensi shall give 30 days’ notice before a new subprocessor processes Customer Personal Data, by publishing the updated list at https://attensi.com/legal/approved-sub-processors/ and, where Customer has subscribed to change notifications at that page, by email to the Account’s notified contact.
4.2 Customer may object to a new subprocessor on reasonable data protection grounds during that notice period. In that event, the parties shall seek in good faith to agree a reasonable alternative. If no such alternative is available, Attensi may cease to provide the affected feature and either party may terminate the affected feature without penalty. Attensi shall impose materially equivalent data protection obligations on each subprocessor and shall remain responsible for the performance of its subprocessors to the extent required by law.
5 Assistance
5.1 Taking into account the nature of the processing, Attensi shall provide Customer with reasonable assistance, by appropriate technical and organisational measures, in responding to data subject requests and in complying with Customer’s obligations under Articles 32 to 36 of the GDPR, including in relation to security, breach notification, data protection impact assessments and prior consultation. Customer shall reimburse Attensi’s reasonable costs where the assistance required goes beyond the standard functionality of the Service, unless the need for assistance arises from Attensi’s breach of this Agreement.
5.2 Attensi shall notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data and shall provide the information then available regarding the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences, the measures taken or proposed and a contact point. Notification of a breach shall not constitute an admission of fault.
6 Return, Deletion and Audits
6.1 On termination or expiry of the services, Attensi shall, at Customer’s choice, return or delete Customer Personal Data and all copies, unless applicable law requires its retention. Customer must request any export within 30 days after the end of the services. Deletion from backups shall take place in accordance with the applicable period set out in the QuizRace Privacy Policy.
6.2 Attensi shall make available to Customer the information reasonably necessary to demonstrate compliance with this Agreement. No more than once in any 12-month period, unless a breach has occurred or a supervisory authority requires more frequent audits, Customer may request an audit by an independent auditor bound by obligations of confidentiality, on reasonable notice, during normal business hours and without disruption to Attensi’s operations. Attensi may satisfy such a request by providing current independent audit reports where these are sufficient. Customer shall bear the costs of any audit unless the audit reveals material non-compliance.
7 International Transfers
7.1 Where a restricted transfer takes place, the parties hereby incorporate the standard contractual clauses adopted by the European Commission by Implementing Decision (EU) 2021/914 (the “SCCs”), namely Module 2 for controller-to-processor transfers or Module 3 for processor-to-processor transfers, as applicable. For the purposes of the SCCs: the docking clause in Clause 7 applies; Option 2 of Clause 9 applies, and the time period shall be the notice period set out in clause 4.1; the optional language in Clause 11 does not apply; Clause 17 shall be governed by the laws of Norway; and the courts referred to in Clause 18 shall be [Confirm: the courts of Norway, with Oslo tingrett as the court of first instance, or the courts of England and Wales]. Annexes I to III to this Agreement complete the appendices to the SCCs.
7.2 In respect of a restricted transfer from the United Kingdom, the International Data Transfer Addendum to the EU SCCs issued by the Information Commissioner forms part of this Agreement. The parties select the following: Table 1 – the parties are as set out in Annex I; Table 2 – the Approved EU SCCs, Module 2 or Module 3 as applicable, as incorporated by clause 7.1; Table 3 – the Appendix Information is as set out in Annexes I to III; Table 4 – neither party may end this Addendum when the Approved Addendum changes. In respect of transfers from Switzerland, references in the SCCs shall be adapted as required by Swiss law. An adequacy decision or a certified data privacy framework may be relied on where legally available.
8 Liability, Precedence and General Terms
8.1 Liability under this Agreement is subject to the exclusions and limitations of liability set out in the QuizRace Terms of Use, except to the extent that those limitations cannot lawfully apply to liability under data protection law or the SCCs.
8.2 In the event of any conflict or inconsistency, the following order of precedence shall apply: (a) mandatory applicable law and, where incorporated, the EU Standard Contractual Clauses and the UK International Data Transfer Addendum; (b) the Terms of Use; (c) the Order Form; (d) the Data Processing Agreement; and (e) the remaining documents forming the Agreement.
Annex I Parties and Description of Processing
I.1 Data exporter: Customer, as identified in the Account or Order Form; role: controller or processor; contact: the Customer contact identified in the Account or Order Form. Data importer: Attensi AS, Forskningsparken, Gaustadalleen 21, 0349 Oslo, Norway; role: processor or subprocessor; contact: privacy@attensi.com.
I.2 Categories of data subjects: Account users, Administrators, Hosts, Players, employees, contractors, students, event participants and individuals identified in Your Content. Categories of personal data: identity, contact, Account, Organisation, content, prompts, files, Player display name, answers, scores, ranks, session, device, log, support and other data submitted under Customer’s instructions. Sensitive data: only such data as Customer is authorised to submit under the Agreement and applicable law.
I.3 Nature and purpose of processing: hosting and operating QuizRace, Games, AI-assisted generation, support, security, reporting and configured integrations. Frequency: continuous, or as initiated by users. Duration: the service term plus the periods set out in clause 6 and the QuizRace Privacy Policy. Subject matter of transfers: as described above. Competent supervisory authority: determined in accordance with Clause 13 of the SCCs.
Annex II Technical and Organisational Measures
II.1 The technical and organisational measures are set out in the QuizRace Security Measures Schedule, which is incorporated into this Annex II by reference. Any control that has not yet been confirmed is expressly marked as a placeholder in that Schedule.
Annex III Subprocessors
III.1 The current list of subprocessors, including the service provided by each subprocessor, its processing location and the applicable transfer safeguard, is maintained and kept up to date at https://attensi.com/legal/approved-sub-processors/. The list published at that address constitutes this Annex III.