Data Processing Agreement (DPA)

1. Purpose and parties

This data processing agreement (the "DPA") is entered into between Kwoji, a simplified joint-stock company with a sole shareholder with a share capital of 100 euros, registered with the Paris Trade and Companies Register under number 108 473 042, whose registered office is at 47 rue Vivienne, 75002 Paris, France (the "Publisher"), and the professional organization that opens an organization space on the Kwoji platform (the "Client").

In accordance with Article 28 of Regulation (EU) 2016/679 (the "GDPR"), it sets out the conditions under which the Publisher processes personal data on behalf of the Client. It supplements the Terms of Use and the Terms of Sale, of which it forms an integral part. In the event of a conflict on a data protection matter, the DPA prevails.

2. Definitions

The terms "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meaning given to them in Article 4 of the GDPR. In addition:

• "Platform": the Kwoji service, available at kwoji.com and kwoji.app;
• "Organization": the space opened by the Client on the Platform, with its members, settings and data;
• "Members": the Client's staff and any other person the Client invites into its Organization;
• "Client Data": the personal data the Publisher processes on behalf of the Client, described in section 3 and Annex A;
• "Sub-processor": any provider the Publisher engages that processes Client Data;
• "Applicable Law": the GDPR, the amended French Data Protection Act no. 78-17 of January 6, 1978, and their implementing texts.

3. Roles of the parties

The Platform brings together two sets of processing operations, which do not have the same controller. The Client decides what it configures and what it reads in its Organization; the Publisher decides what a player account is and how the games work. Each party's role therefore follows the processing operation, not the data:

The same data may belong to both sets. A game result is collected by the Publisher to run the game, as controller; its aggregation in the dashboard the Client reads is processing carried out on the Client's behalf. This DPA applies only to processing carried out as a processor. Processing for which the Publisher is the controller is described in the Privacy Policy.

As controller of the processing it has carried out, the Client determines its legal basis, informs its staff, consults its employee representative bodies where the law requires it, and carries out its own impact assessment where appropriate. It ensures that it is entitled to entrust the Publisher with the data it enters, in particular the email addresses of the people it invites.

4. Description of the processing

The purposes, categories of data subjects, categories of data and retention periods of the processing carried out on behalf of the Client are described in Annex A. The processing lasts for the lifetime of the Organization, within the retention limits set out in that annex. The Platform does not ask for any special category of data within the meaning of Article 9 of the GDPR; the Client undertakes not to enter any in the fields it fills in (names of teams, axes or segmentation values).

5. The Client's instructions

The Publisher processes Client Data only on the Client's documented instructions. The following constitute documented instructions: this DPA, the Terms of Use and the Terms of Sale, the Client's use of the Platform's features, and the settings it makes in its administration space (enabling Kwoji Pulse, its reminders or Kwoji Live, connecting a channel, defining teams, managers, start dates and axes, choosing the Kwoji Pulse anonymity threshold, deleting its history, invitations, removing a member, exporting data).

Some rules are set by the Platform and cannot be configured, precisely because they protect Members: the floor of the Kwoji Pulse anonymity threshold (never fewer than three answers, and a lowered threshold only applies to the following waves) and the fact that no individual answer is ever returned. By using the features concerned, the Client adopts these rules as part of its instructions. Any additional instruction is sent in writing to contact@kwoji.com. The Publisher informs the Client if it considers that an instruction infringes Applicable Law, and may then suspend its execution.

6. The Publisher's obligations

The Publisher undertakes to:

• process Client Data only for the purposes set out in Annex A and in accordance with the Client's instructions, unless required to do so by Union or Member State law, in which case it informs the Client before processing, unless that law prohibits it;
• ensure the confidentiality of Client Data (sections 7 and 8);
• implement the security measures described in section 9;
• comply with the conditions for engaging Sub-processors (section 10);
• assist the Client in meeting its own obligations (sections 12 and 13);
• make available to the Client the information necessary to demonstrate compliance with this DPA (section 14);
• keep the record of categories of processing activities carried out on behalf of the Client, as required by Article 30(2) of the GDPR.

7. Access to Client Data

Principle. No one at the Publisher looks at Client Data. This commitment covers all Client Data, and Kwoji Pulse answers in particular.

Exhaustive exceptions. Access takes place only in one of the following cases, and only to the extent strictly necessary:

• a written request from the Client for a specific support need, and only for the duration of that support;
• maintenance, fixing a defect, restoring a backup or investigating a security incident, where these cannot be carried out without touching the data;
• a legal obligation or a request from a competent authority.

Any such access is recorded in writing by the Publisher (date, reason, person, data concerned) and this record is provided to the Client on request.

Kwoji Pulse. No individual answer is disclosed to the Client or to anyone else, including at the Client's request. The results returned to the Organization are aggregates computed by the database itself, never below the Organization's anonymity threshold: five answers by default, which only the Organization's owner can set to four or three, with no setting to go lower. A lowered threshold only applies to waves opened after the change, never to answers already given; a raised threshold applies to every wave. The protection that prevents recovering an answer by comparing two neighboring groups stays on whatever the threshold, and every Member can check the threshold in force from their voting card. The answers table is not reachable through any programming interface exposed to browsers. The Publisher does not claim a technical impossibility, however: its authorized personnel have, in order to administer the database, access that would allow them to read it. It is the commitment in this section, not a technical constraint, that forbids it. The anonymous comment a Member can leave after a low answer is stored with no link to them (no identifier, date, segment or rating): it is returned to the Organization's administrators once the wave has closed, with no answer threshold, and the Organization can remove a comment that identifies a third party. The detailed mechanism is described on the page How Kwoji Pulse protects anonymity.

No use for the Publisher's own purposes. The Publisher does not use Client Data for its own purposes. In particular, it does not produce any comparison or benchmark across clients from that data, does not sell or rent it, and does not use it to train any artificial intelligence model.

Administrative access. Technical access to the hosting providers' administration consoles is reserved to persons authorized by the Publisher, strictly limited in number, and withdrawn as soon as a person no longer needs it. The list of these persons is provided to the Client on request.

8. Confidentiality of personnel

The Publisher ensures that every person authorized to process Client Data is bound by a contractual or statutory obligation of confidentiality that survives the end of their assignment, and processes that data only on instructions.

9. Security

The Publisher implements the following technical and organizational measures, appropriate to the risk within the meaning of Article 32 of the GDPR:

• Data isolation: row-level access control in the database (Row Level Security) on the tables, restricting each Member to the data of their Organization; server functions that check the caller's role in the database; sensitive tables (Kwoji Pulse answers, segments frozen at the time of the vote, anonymous comments) with no exposed read path at all.
• Encryption: all communications use encrypted connections (HTTPS and secure WebSockets); encryption of data at rest is provided by the database hosting provider (Supabase, Inc., region United Kingdom (London)).
• Authentication: passwordless sign-in, by single-use link or code sent by email, or through Google; on the Enterprise plan, sign-in through the Client's identity provider (SAML SSO), which the Client may make mandatory for the addresses of its domains; two-factor authentication by app (TOTP) offered to every account, and required by the database for the owner and administrator actions of an account that has turned it on; anti-bot check of the sign-in form (Cloudflare Turnstile); access of the Publisher's authorized personnel to its administration tool subject to two-factor authentication; session tokens verified server-side; real-time access through a signed organization ticket valid for five minutes.
• Secrets and keys: secrets kept out of the source code; the key that bypasses the database's access control is held only by a dedicated server service and a dedicated automation environment, never by a browser or the game server; Google connection tokens and Slack or Teams channel addresses stored outside any exposed interface and never returned to a browser; the Slack app token encrypted by the server service before it is stored, with a key the database does not hold.
• Integrity of results: game results are signed by the game server and the signature is verified by the database before anything is recorded.
• Backups: daily backup of the production database, taken by a read-only role, encrypted (AES-256) before storage and kept for 30 days.
• Separate environments: sealed development and production environments, each with its own database.
• Minimization: game photos in private storage, served through time-limited links and deleted within seven days; no recording of Kwoji Live streams; technical error reports without identity or IP address.
• Change control: every change to the code and to the database schema goes through a merge request and an automated verification chain (tests, type checks, replay of migrations on a blank database) before it reaches production.

The Publisher may change these measures, provided the overall level of protection of Client Data is not reduced.

10. Sub-processors

The Client gives the Publisher a general authorization to engage the Sub-processors listed in Annex B. The Publisher imposes on each of them, by contract, data protection obligations at least equivalent to those of this DPA, and remains liable to the Client for their performance.

The Publisher informs the Client of any addition or replacement of a Sub-processor at least 30 days before it processes Client Data, by updating Annex B and by sending a message to the owner of the Organization. The Client may object in writing, on reasonable data protection grounds, within that 30-day period. The parties then seek a solution in good faith; failing that, the Client may terminate the subscription concerned, without penalty, before the new Sub-processor starts processing.

Tools that the Client itself connects to its Organization (its Slack or Microsoft Teams workspace, a Member's Google calendar) are not Sub-processors of the Publisher: they are recipients chosen by the Client or by the Member, governed by their provider's terms. The same applies when the Client installs the Publisher's Slack app so that direct messages are delivered in its workspace: those messages become the Client's data, under its own contract with Slack.

11. Transfers outside the European Union

The Platform's database is hosted in the United Kingdom (London), a country covered by an adequacy decision of the European Commission. Some Sub-processors are established in the United States or may process data outside the European Union; Annex B states, for each of them, the location and the safeguard governing the transfer (standard contractual clauses of the European Commission and, where applicable, certification under the Data Privacy Framework).

The Client is specifically informed that Kwoji Live media (voice and video) is carried by Cloudflare RealtimeKit, which offers no guaranteed location in the European Union: streams may pass through servers located outside the Union. They are not recorded, either by the Publisher or on its behalf. Kwoji Live is off by default and is only turned on by a decision of the Client, in its administration space.

The Client is likewise informed that the Kwoji Pulse AI wave summary is produced by Scaleway SAS, in France (Paris region), with no transfer outside the European Union. It receives the aggregated results already shown to the Client, never below the Organization's anonymity threshold, including those of managers' scopes with the manager's name, and the text of the wave's anonymous comments exactly as it was written, names included. Only the summary is kept by the Publisher; Scaleway may keep a request that failed for up to two weeks, for its own troubleshooting. The AI summary is off by default and is only turned on by a decision of the Client, in its administration space.

AI answers from the Galaxy's mascot are produced by Scaleway SAS, in France (Paris region), with no transfer outside the European Union. Scaleway receives the question exactly as the administrators write it and the aggregated results by group that the Galaxy already shows the Client, never below the Organization's anonymity threshold, with the names of managers that the Galaxy shows, and no individual answer or comment. Nothing of that exchange is kept by the Publisher; Scaleway may keep a request that failed for up to two weeks, for its own troubleshooting. This feature falls under the same setting as the AI summary, off by default.

The AI context sentence of an alert is produced by Scaleway SAS, in France (Paris region), with no transfer outside the European Union. Scaleway receives only the aggregated results already shown for that alert, never below the Organization's anonymity threshold, with the manager's name for their scope, and no individual answer or comment, and picks the suggested action from a fixed list. The Publisher keeps the sentence and the action, not what was sent; Scaleway may keep a request that failed for up to two weeks, for its own troubleshooting. This feature falls under the same setting as the AI summary, off by default.

The AI summary of the written answers of a closed survey is produced by Scaleway SAS, in France (Paris region), with no transfer outside the European Union. Scaleway receives the survey's title and the question's wording, as the Client's administrators wrote them, and the written answers they already read, without their author's name; nothing from an anonymous survey until it reaches the Organization's anonymity threshold, nor the survey's audience, nor any group. Only the summary is kept by the Publisher; Scaleway may keep a request that failed for up to two weeks, for its own troubleshooting. This feature falls under the same setting as the AI summary, off by default.

Under the same setting, Scaleway also classifies the tone of each published written answer of a closed survey (negative, neutral or positive), from the same data: the title, the wording and the written answers, without their author's name, and with no minimum number of answers, unlike the summary. The Client's administrators may correct a tone; their most recent corrections, the answer's text and the corrected tone, are sent as examples to the next classifications of the same Organization, never of another, and who made a correction is not kept. The Publisher keeps the tones and the corrections, not what was sent.

12. Assistance to the Client

Data subject rights. The Platform lets each Member exercise their own rights of access and portability (downloading their data from their profile, Kwoji Pulse answers included), rectification and erasure. If the Publisher directly receives a request concerning Client Data, it forwards it to the Client without undue delay and does not answer it without the Client's instructions, except to redirect the person. It assists the Client, as far as possible, with requests the features do not cover.

Impact assessment and prior consultation. The Publisher provides the Client with the information it holds to carry out a data protection impact assessment or consult the supervisory authority, in particular the description of how Kwoji Pulse and Kwoji Live work.

13. Personal data breach notification

The Publisher notifies the Client of any personal data breach affecting Client Data without undue delay, and no later than 48 hours after becoming aware of it. The notification is sent to the owners and administrators of the Organization. It describes, to the extent known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and the Publisher's contact point. Information not yet known is provided afterwards, without undue delay. The Publisher takes the measures necessary to contain the breach and limit its effects, and cooperates with the Client so that it can meet its own notification obligations.

14. Audit

On written request, the Publisher makes available to the Client the information necessary to demonstrate compliance with this DPA: answers to a security questionnaire, a description of the measures in section 9, the list of Sub-processors and available documentation.

If that information is not sufficient, the Client may have an audit carried out, by itself or by an independent auditor bound by professional secrecy who is not a competitor of the Publisher, no more than once in any twelve-month period, with 30 days' written notice, during business hours and without disrupting the operation of the Platform. The audit is at the Client's expense. It does not cover other clients' data. These frequency limits do not apply to an audit required by a supervisory authority or following a personal data breach affecting the Client.

15. End of processing

Terminating a paid plan does not end the Organization, which continues on the free plan under the Terms of Sale. Processing on behalf of the Client ends when the Organization is closed, at the written request of its owner to contact@kwoji.com.

• Return. Before closure, the owner can download the Organization's data from its administration space (Settings), in a structured format. Kwoji Pulse results are returned only in aggregated form, downloadable from the Pulse tab: no individual answer is returned, neither at closure nor at any other time. Anonymous comments are read on screen and are not part of any download.
• Deletion. The Publisher deletes the Organization and the Client Data within 30 days of the request, then confirms the deletion in writing. Copies held in backups disappear at the end of their 30-day retention period.
• What remains. Player accounts, for which the Publisher is the controller and which may be linked to other organizations, are not deleted by the closure; each Member remains free to delete their account. Data the Publisher must keep under a legal obligation, in particular invoices, is kept for the required period.

The removal of a Member during the contract follows the rules described in Annex A.

16. Liability

Each party's liability under this DPA is governed by the "Liability" section of the Terms of Sale. For a Client on the free plan, which has not subscribed under the Terms of Sale, it is governed by the Terms of Use. These provisions apply without prejudice to the rights data subjects hold directly under Article 82 of the GDPR.

17. Acceptance and documents

This DPA forms an integral part of the Terms of Use and the Terms of Sale. The Client accepts it when creating its Organization and, where applicable, when subscribing to a paid plan, under the same conditions as those documents. This online acceptance is equivalent to a signature. The applicable version is the one published at kwoji.com/dpa, dated at the top of the page.

A Client that needs a signed copy can request, at contact@kwoji.com, a PDF version identical to the published version, signed by the Publisher. A negotiated agreement may be concluded for subscriptions on quotation; it then prevails over this DPA to the extent that it departs from it.

18. Changes

The Publisher may amend this DPA, in particular to reflect changes to the Platform, its Sub-processors or Applicable Law. The date of the last update appears at the top of the page. Any material change is notified to the owner of the Organization at least 30 days before it takes effect, unless it is required by law or by an authority. No change may reduce the level of protection of Client Data without the Client's consent.

19. Governing law and jurisdiction

This DPA is governed by French law. Failing an amicable settlement, any dispute relating to its interpretation or performance falls within the jurisdiction of the courts of the Publisher's registered office.

Annex A. Description of the processing

Data subjects: the Members of the Organization, whatever their role; the people the Client invites by email, before they have joined the Organization.

Nature of the operations: collection, recording, organization, storage, computation of aggregates, consultation by the Client, transmission to the recipients it has chosen, erasure.

A Member leaving. The permanent removal of a Member by the Client deletes their membership, clubs, team, segmentation assignments, registrations and the scheduled games they hosted in the Organization. Their game results are kept for the Organization's aggregates, but their identifier is replaced by a random alias and no mapping between the two is kept: the results can no longer be linked to them. Their Kwoji Pulse answers follow the retention period of the answers (above), as do anonymous comments, which are linked to no one. Their signed ideas, kudos and survey answers remain in the Organization for their own retention periods (above): ideas and kudos no longer display them, their identifier remaining in the database, and a named survey answer keeps their name.

Annex B. Sub-processors

The Publisher's other providers (payment, audience measurement) only process data for which the Publisher is the controller; they are listed in the Privacy Policy.

Version history

• September 23, 2026: initial version.
• September 24, 2026: addition of the AI summary, an optional feature, turned off by default (Annex A, and Cloudflare Workers AI as a sub-processor in Annex B).
• September 25, 2026: addition of AI answers from the Galaxy's mascot; Scaleway SAS becomes the AI sub-processor for those answers and for the Kwoji Pulse wave summary, and Cloudflare Workers AI is removed; a single setting, turned off by default, covers both features (§3, §11, Annex A, Annex B); Scaleway SAS also serves the Kwoji Verita game referee, with no option (Annex B).
• October 4, 2026: Kwoji Pulse data is no longer deleted after six months; it is kept for the whole duration of the contract, until the Organization's owner deletes it, and at the latest 30 days after the contract ends (§5, Annex A).
• October 5, 2026: follow-up actions on the signals of “To handle” and the context sentence of an alert written by the AI are kept for the whole duration of the contract and deleted with the Kwoji Pulse history (Annex A); Scaleway SAS is named for that context sentence (§11, Annex B).
• October 10, 2026: the support chat is removed; Crisp IM SAS is no longer a sub-processor (Annex B). Slack direct messages to linked Members are added (§3, §9, Annex A); the Client's Slack workspace remains a recipient designated by the Client, not a Sub-processor (§10). The processing description clarifies the technical cache of aggregated results of closed Pulse waves, subject to the same anonymity rules (Annex A).
• October 17, 2026: the database is hosted in the United Kingdom (London), a country covered by an adequacy decision of the European Commission, and not in Ireland (§9, §11, Annex B). Scaleway SAS is named for the AI summary and tone of the written answers of a closed survey, under the same setting (§11, Annex A, Annex B).
• October 24, 2026: the description is completed with processing already in service. Custom surveys, the idea box and Kwoji Kudos are described (§3, Annex A), as are two Slack direct messages (start of a Kwoji Secret game, a colleague's dare) and what becomes of this data when a Member leaves (Annex A). The authentication measures name the SAML SSO of the Enterprise plan, two-factor authentication and the anti-bot check of the sign-in form (§9). Annex B clarifies what the game server keeps during a game and the anti-bot check (Cloudflare), the emails sent (Resend) and error detection for the server services (Sentry).