This Privacy Policy (“Policy”) explains how Attensi processes personal data when individuals visit the website, create an Account, purchase or administer a Plan, contact Attensi, host a Game or join a Game as a Player. It also explains the rights and choices available to those individuals.
1 Controllers, Processors and Contacts
1.1 Attensi AS, a company incorporated in Norway with organisation number 994 202 367, whose address is Forskningsparken, Gaustadalleen 21, 0349 Oslo, Norway, is the controller of website, Account, billing, support, security and service-administration data, unless another group entity is identified at the point of collection.
1.2 Other Attensi group companies, including Attensi Limited, Attensi USA Inc. and Attensi GmbH, do not act as controllers of personal data processed through QuizRace. Attensi AS is the controller in every market.
1.3 Where an Organisation or Host determines the purposes for which Player names, answers, results or content are processed, that Organisation or Host is normally the controller and Attensi acts as processor under the QuizRace Data Processing Agreement. Requests relating to such data should be directed in the first instance to the Organisation or its Administrator.
1.4 You may contact Attensi at privacy@attensi.com or at the postal address above. Attensi’s data protection officer can be contacted at dataprotectionofficer@attensi.com. Attensi is established in the European Economic Area and is therefore not required to appoint a representative in the EU under Article 27 GDPR. Its representative in the United Kingdom under Article 27 UK GDPR is Attensi Limited, 1 Chapel Street, Warwick, United Kingdom, CV34 4HL.
2 Personal Data Collected
2.1 Depending on how QuizRace is used, Attensi collects: Account and profile details; Organisation, Administrator and Seat details; purchase, tax and payment status; Your Content, prompts and AI output; Player display name, answers, score, rank and timestamps; device, browser, IP address, identifiers, usage, logs and diagnostics; communications, support, preferences and consent records; and cookie data as described in the QuizRace Cookie Notice. Payment card data is handled by the payment provider.
2.2 Personal data is obtained from you, from a Host or Administrator, through automatic collection, and from providers of payment, authentication, hosting, analytics and integration services. You must not submit sensitive personal data unless doing so is necessary, lawful and permitted by the Agreement.
3 Purposes and Legal Bases
3.1 Attensi processes personal data in order to: (a) enter into and perform its contract with you and provide QuizRace; (b) authenticate users and operate Games; (c) process payments; (d) provide support and communicate with you; (e) secure QuizRace, troubleshoot issues and prevent abuse; (f) improve features using aggregated or de-identified information; (g) comply with legal obligations; and (h) send product communications where permitted.
3.2 For individuals in the EEA, the UK and Norway, the legal bases for processing are: performance of a contract; Attensi’s legitimate interests in the reliable and secure operation of the service and in business administration; compliance with a legal obligation; and consent, where required. Where Attensi relies on legitimate interests, it balances those interests against the rights of the individuals concerned. Consent may be withdrawn without affecting the lawfulness of processing carried out before withdrawal.
3.3 Attensi does not use Your Content, Player data, prompts or AI output to train general-purpose AI models. Attensi does not sell personal data, share it for cross-context behavioural advertising or use it for targeted advertising, as those terms are defined under applicable US state law.
4 Education and Children
4.1 Only adults may create Accounts or purchase Plans. Children may join a Game without an Account. The relevant school or Organisation is responsible for selecting an appropriate legal basis, providing notices, obtaining any required parental consent or authorisation and configuring its use of QuizRace appropriately.
4.2 Where Attensi acts on behalf of a US school, it processes education records as a school official under the direct control of the school, for the legitimate educational interest and purposes specified by the school. The school is responsible for providing any consent required under FERPA or COPPA for classroom use. Attensi does not sell such data, use it for targeted advertising or profile any student, except as necessary to provide the educational service.
4.3 Attensi will delete or return student data on the school’s instruction or at the end of the service, subject to applicable law, the QuizRace Data Processing Agreement and documented retention requirements. A parent or eligible student should normally submit requests for access, correction or deletion through the school, and Attensi will assist the school in responding. These commitments are intended to support compliance with FERPA, COPPA and applicable state student privacy laws, including SOPIPA where applicable.
5 Sharing of Personal Data
5.1 Attensi shares personal data with: authorised Administrators; Players and recipients selected by a Host; Attensi group entities; vetted providers of hosting, support, payment, analytics, communication and AI services; professional advisers; a buyer in the context of a corporate transaction; and authorities or other parties where required by law or necessary to protect rights and safety. Providers may use personal data only under contract and for authorised purposes.
5.2 An up-to-date list of subprocessors, including their purposes and locations, is available at https://attensi.com/legal/approved-sub-processors/. Attensi will give 30 days’ advance notice of changes by publishing the updated list at that address and, where the customer has subscribed to change notifications at that page, by email to the Account’s notified contact. Further information is set out in Annex III to the QuizRace Data Processing Agreement.
6 International Transfers
6.1 Where personal data is transferred outside the EEA, the UK, Norway or Switzerland, Attensi relies on an adequacy decision, the EU Standard Contractual Clauses, the UK International Data Transfer Addendum or another lawful safeguard. A relevant US recipient may also rely on the EU-US Data Privacy Framework, the UK Extension or the Swiss-US Data Privacy Framework where it is certified for the data concerned. A copy of the relevant safeguards may be requested at privacy@attensi.com; commercially sensitive terms may be redacted.
7 Data Retention
7.1 Attensi retains personal data only for as long as is necessary for the stated purpose or as required for contractual, security, dispute-resolution or legal reasons. The applicable retention periods are set out below.
| Data | Period or criterion |
|---|---|
| Account and profile | Until the Account is deleted. An account holder can delete their Account at any time. Deletion removes it from the live service immediately; copies in backups are deleted on the backup cycle below. |
| Billing and tax records | Not applicable. QuizRace does not currently offer paid Plans. |
| Quiz content, prompts and AI output | Until the Host deletes the quiz or the Account, when it is removed from the live service immediately and from backups on the backup cycle below. Prompts are not stored by QuizRace: they are sent to Scaleway Generative APIs to generate the questions, and Scaleway may keep them for up to two weeks to investigate misuse. Deleted images are removed from storage immediately, and no earlier copies are kept. |
| Player names, answers and results | For as long as the quiz the Game was played on exists. They are deleted when that quiz or its owner’s Account is deleted, and from backups on the backup cycle below. |
| Security and access logs | Application logs are kept for 7 days and database logs for 30 days. |
| Support communications | Up to three years after the enquiry is closed, which reflects the general limitation period under Norwegian law. Communications may be kept for longer where needed for an ongoing dispute or to meet a legal obligation, and are then deleted. |
| Cookie and analytics identifiers | As set out for each technology in the QuizRace Cookie Notice. |
| Backups | Database backups are taken once a day, and each backup is kept for 7 days. |
8 Security and Personal Data Breaches
8.1 Attensi implements technical and organisational measures appropriate to the risk. The current measures, including in respect of access control, encryption, development, resilience, monitoring and incident response, are described in the QuizRace Security Measures Schedule. No internet-based service can be guaranteed to be completely secure.
8.2 Where Attensi acts as processor, the QuizRace Data Processing Agreement governs security and assistance with personal data breaches. Attensi will notify its controller customers without undue delay after becoming aware of a personal data breach and will provide the information then available. Where Attensi acts as controller, it will notify supervisory authorities and affected individuals as required by Articles 33 and 34 of the GDPR or the UK GDPR and by applicable US state laws.
9 Your Rights and Choices
9.1 Depending on applicable law, you may request access to, correction, deletion, restriction or portability of your personal data, or object to its processing; withdraw consent; lodge a complaint with a supervisory authority; and opt out of marketing. To exercise these rights, please contact privacy@attensi.com. Attensi may verify your identity and authority and will respond within the applicable legal period.
9.2 QuizRace does not make decisions based solely on automated processing that produce legal or similarly significant effects for individuals. A Host must not use Game results in that way. If this changes, Attensi will provide the information required by law and a means to obtain human review, to express a point of view and to contest the decision.
9.3 QuizRace does not currently respond to browser Do Not Track signals, as no consistent standard applies. Attensi will honour legally recognised opt-out preference signals, including Global Privacy Control, where they apply to processing performed by Attensi. As stated in clause 3.3, QuizRace does not sell or share personal data or conduct targeted advertising.
10 United States State Privacy Notice
10.1 This clause applies where the laws of California, Colorado, Connecticut, Delaware, Iowa, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah or Virginia apply to the processing. State-specific scope, definitions and exemptions apply.
| Category | Sources | Purposes | Recipients |
|---|---|---|---|
| Identifiers and contact details | You; Organisation; device | Account, access, support, security | Group; hosting; authentication; support |
| Commercial information | You; payment provider | Billing, tax, subscription administration | Payment provider; advisers; authorities |
| Internet and device activity | Device; service use | Operation, analytics, fraud and security | Hosting; analytics; security providers |
| User content and communications | You; Host; Administrator | Games, AI features, support and moderation | Authorised recipients; contracted providers |
| Education and Player records | Player; Host; school | Run Games and provide reports | Host or school; contracted providers |
| Inferences | Quiz answers and use | Scores and service functionality, not targeted advertising | Host; authorised recipients |
| Sensitive data, if supplied | You; Host | Only the disclosed and permitted purpose | Only necessary contracted recipients |
10.2 Subject to applicable exceptions, residents of those states may request to know about or access their personal data, correct it, delete it and receive a portable copy of it. Where applicable, they may also opt out of sale, sharing, targeted advertising or qualifying profiling and limit certain uses of sensitive data. Attensi does not currently engage in any sale, sharing, targeted advertising or qualifying profiling as described above.
10.3 Requests may be submitted to privacy@attensi.com. An authorised agent may act on a resident’s behalf where permitted by law, and Attensi may require proof of authority and verification of identity. Attensi will not discriminate against any individual for exercising their rights. A refusal may be appealed by contacting privacy@attensi.com within 45 days of the decision; Attensi will decide the appeal within 45 days of its receipt and will explain any route for complaint to a regulator.
11 Cookies, Communications and Changes
11.1 The QuizRace Cookie Notice explains the use of cookies, consent and the available controls. You may opt out of marketing communications by using the unsubscribe link or by contacting privacy@attensi.com. Essential service communications will continue while an Account remains active.
11.2 Attensi may update this Policy from time to time. Where practicable, Attensi will notify material changes by email, in-product message or on the website before they take effect. Previous versions of this Policy are available on request from privacy@attensi.com.