1. Purpose and parties
This data processing agreement (the "DPA") is entered into between Kwoji, a simplified joint-stock company with a sole shareholder with a share capital of 100 euros, registered with the Paris Trade and Companies Register under number 108 473 042, whose registered office is at 47 rue Vivienne, 75002 Paris, France (the "Publisher"), and the professional organization that opens an organization space on the Kwoji platform (the "Client").
In accordance with Article 28 of Regulation (EU) 2016/679 (the "GDPR"), it sets out the conditions under which the Publisher processes personal data on behalf of the Client. It supplements the Terms of Use and the Terms of Sale, of which it forms an integral part. In the event of a conflict on a data protection matter, the DPA prevails.
2. Definitions
The terms "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meaning given to them in Article 4 of the GDPR. In addition:
- "Platform": the Kwoji service, available at kwoji.com and kwoji.app;
- "Organization": the space opened by the Client on the Platform, with its members, settings and data;
- "Members": the Client's staff and any other person the Client invites into its Organization;
- "Client Data": the personal data the Publisher processes on behalf of the Client, described in section 3 and Annex A;
- "Sub-processor": any provider the Publisher engages that processes Client Data;
- "Applicable Law": the GDPR, the amended French Data Protection Act no. 78-17 of January 6, 1978, and their implementing texts.
3. Roles of the parties
The Platform brings together two sets of processing operations, which do not have the same controller. The Client decides what it configures and what it reads in its Organization; the Publisher decides what a player account is and how the games work. Each party's role therefore follows the processing operation, not the data:
| Processing | Publisher's role |
|---|---|
| Player account and profile: email, display name, photo, color, language, passwordless sign-in | Controller |
| Game platform: games played, scores, ranks, badges, records, leaderboards, clubs and club challenges, daily challenge, mascot and cheatcodes, content posted in games (photos, drawings, secrets), presence and games in progress | Controller |
| The Publisher's own communications: weekly recap, product announcements, subscription emails, customer support | Controller |
| The Publisher's own operations: billing, audience measurement, error detection, Platform security | Controller |
| Organization administration: members, roles, deactivation and removal, email invitation log, settings, export of the Organization's data | Processor for the Client |
| Organization structure: teams, manager hierarchy, start dates and seniority bands, custom segmentation axes | Processor for the Client |
| Kwoji Pulse: collection of answers to the weekly pulse and the quarterly eNPS, eNPS email, reminders in the channel, computation of aggregated results and their breakdowns, downloadable reports, AI wave summary when the Client turns it on | Processor for the Client |
| Engagement dashboard, cohesion graph and Galaxy, AI answers from the Galaxy's mascot when the Client turns them on | Processor for the Client |
| Announcements in the Slack or Microsoft Teams channel connected by the Client | Processor for the Client |
| Game scheduling in Google Calendar with Google Meet | Processor for the Client |
| Kwoji Live: voice and video during a game | Processor for the Client |
The same data may belong to both sets. A game result is collected by the Publisher to run the game, as controller; its aggregation in the dashboard the Client reads is processing carried out on the Client's behalf. This DPA applies only to processing carried out as a processor. Processing for which the Publisher is the controller is described in the Privacy Policy.
As controller of the processing it has carried out, the Client determines its legal basis, informs its staff, consults its employee representative bodies where the law requires it, and carries out its own impact assessment where appropriate. It ensures that it is entitled to entrust the Publisher with the data it enters, in particular the email addresses of the people it invites.
4. Description of the processing
The purposes, categories of data subjects, categories of data and retention periods of the processing carried out on behalf of the Client are described in Annex A. The processing lasts for the lifetime of the Organization, within the retention limits set out in that annex. The Platform does not ask for any special category of data within the meaning of Article 9 of the GDPR; the Client undertakes not to enter any in the fields it fills in (names of teams, axes or segmentation values).
5. The Client's instructions
The Publisher processes Client Data only on the Client's documented instructions. The following constitute documented instructions: this DPA, the Terms of Use and the Terms of Sale, the Client's use of the Platform's features, and the settings it makes in its administration space (enabling Kwoji Pulse, its reminders or Kwoji Live, connecting a channel, defining teams, managers, start dates and axes, choosing the Kwoji Pulse anonymity threshold, invitations, removing a member, exporting data).
Some rules are set by the Platform and cannot be configured, precisely because they protect Members: the floor of the Kwoji Pulse anonymity threshold (never fewer than three answers, and a lowered threshold only applies to the following waves), its six-month retention period, and the fact that no individual answer is ever returned. By using the features concerned, the Client adopts these rules as part of its instructions. Any additional instruction is sent in writing to contact@kwoji.com. The Publisher informs the Client if it considers that an instruction infringes Applicable Law, and may then suspend its execution.
6. The Publisher's obligations
The Publisher undertakes to:
- process Client Data only for the purposes set out in Annex A and in accordance with the Client's instructions, unless required to do so by Union or Member State law, in which case it informs the Client before processing, unless that law prohibits it;
- ensure the confidentiality of Client Data (sections 7 and 8);
- implement the security measures described in section 9;
- comply with the conditions for engaging Sub-processors (section 10);
- assist the Client in meeting its own obligations (sections 12 and 13);
- make available to the Client the information necessary to demonstrate compliance with this DPA (section 14);
- keep the record of categories of processing activities carried out on behalf of the Client, as required by Article 30(2) of the GDPR.
7. Access to Client Data
Principle. No one at the Publisher looks at Client Data. This commitment covers all Client Data, and Kwoji Pulse answers in particular.
Exhaustive exceptions. Access takes place only in one of the following cases, and only to the extent strictly necessary:
- a written request from the Client for a specific support need, and only for the duration of that support;
- maintenance, fixing a defect, restoring a backup or investigating a security incident, where these cannot be carried out without touching the data;
- a legal obligation or a request from a competent authority.
Any such access is recorded in writing by the Publisher (date, reason, person, data concerned) and this record is provided to the Client on request.
Kwoji Pulse. No individual answer is disclosed to the Client or to anyone else, including at the Client's request. The results returned to the Organization are aggregates computed by the database itself, never below the Organization's anonymity threshold: five answers by default, which only the Organization's owner can set to four or three, with no setting to go lower. A lowered threshold only applies to waves opened after the change, never to answers already given; a raised threshold applies to every wave. The protection that prevents recovering an answer by comparing two neighboring groups stays on whatever the threshold, and every Member can check the threshold in force from their voting card. The answers table is not reachable through any programming interface exposed to browsers. The Publisher does not claim a technical impossibility, however: its authorized personnel have, in order to administer the database, access that would allow them to read it. It is the commitment in this section, not a technical constraint, that forbids it. The anonymous comment a Member can leave after a low answer is stored with no link to them (no identifier, date, segment or rating): it is returned to the Organization's administrators once the wave has closed, with no answer threshold, and the Organization can remove a comment that identifies a third party. The detailed mechanism is described on the page How Kwoji Pulse protects anonymity.
No use for the Publisher's own purposes. The Publisher does not use Client Data for its own purposes. In particular, it does not produce any comparison or benchmark across clients from that data, does not sell or rent it, and does not use it to train any artificial intelligence model.
Administrative access. Technical access to the hosting providers' administration consoles is reserved to persons authorized by the Publisher, strictly limited in number, and withdrawn as soon as a person no longer needs it. The list of these persons is provided to the Client on request.
8. Confidentiality of personnel
The Publisher ensures that every person authorized to process Client Data is bound by a contractual or statutory obligation of confidentiality that survives the end of their assignment, and processes that data only on instructions.
9. Security
The Publisher implements the following technical and organizational measures, appropriate to the risk within the meaning of Article 32 of the GDPR:
- Data isolation: row-level access control in the database (Row Level Security) on the tables, restricting each Member to the data of their Organization; server functions that check the caller's role in the database; sensitive tables (Kwoji Pulse answers, segments frozen at the time of the vote, anonymous comments) with no exposed read path at all.
- Encryption: all communications use encrypted connections (HTTPS and secure WebSockets); encryption of data at rest is provided by the database hosting provider (Supabase, Inc., region Ireland (European Union)).
- Authentication: passwordless sign-in, by single-use link or through Google; session tokens verified server-side; real-time access through a signed organization ticket valid for five minutes.
- Secrets and keys: secrets kept out of the source code; the key that bypasses the database's access control is held only by a dedicated server service and a dedicated automation environment, never by a browser or the game server; Google connection tokens and Slack or Teams channel addresses stored outside any exposed interface and never returned to a browser.
- Integrity of results: game results are signed by the game server and the signature is verified by the database before anything is recorded.
- Backups: daily backup of the production database, taken by a read-only role, encrypted (AES-256) before storage and kept for 30 days.
- Separate environments: sealed development and production environments, each with its own database.
- Minimization: game photos in private storage, served through time-limited links and deleted within seven days; no recording of Kwoji Live streams; technical error reports without identity or IP address.
- Change control: every change to the code and to the database schema goes through a merge request and an automated verification chain (tests, type checks, replay of migrations on a blank database) before it reaches production.
The Publisher may change these measures, provided the overall level of protection of Client Data is not reduced.
10. Sub-processors
The Client gives the Publisher a general authorization to engage the Sub-processors listed in Annex B. The Publisher imposes on each of them, by contract, data protection obligations at least equivalent to those of this DPA, and remains liable to the Client for their performance.
The Publisher informs the Client of any addition or replacement of a Sub-processor at least 30 days before it processes Client Data, by updating Annex B and by sending a message to the owner of the Organization. The Client may object in writing, on reasonable data protection grounds, within that 30-day period. The parties then seek a solution in good faith; failing that, the Client may terminate the subscription concerned, without penalty, before the new Sub-processor starts processing.
Tools that the Client itself connects to its Organization (its Slack or Microsoft Teams workspace, a Member's Google calendar) are not Sub-processors of the Publisher: they are recipients chosen by the Client or by the Member, governed by their provider's terms.
11. Transfers outside the European Union
The Platform's database is hosted in the European Union (Ireland (European Union)). Some Sub-processors are established in the United States or may process data outside the European Union; Annex B states, for each of them, the location and the safeguard governing the transfer (standard contractual clauses of the European Commission and, where applicable, certification under the Data Privacy Framework).
The Client is specifically informed that Kwoji Live media (voice and video) is carried by Cloudflare RealtimeKit, which offers no guaranteed location in the European Union: streams may pass through servers located outside the Union. They are not recorded, either by the Publisher or on its behalf. Kwoji Live is off by default and is only turned on by a decision of the Client, in its administration space.
The Client is likewise informed that the Kwoji Pulse AI wave summary is produced by Scaleway SAS, in France (Paris region), with no transfer outside the European Union. It receives the aggregated results already shown to the Client, never below the Organization's anonymity threshold, including those of managers' scopes with the manager's name, and the text of the wave's anonymous comments exactly as it was written, names included. Only the summary is kept by the Publisher; Scaleway may keep a request that failed for up to two weeks, for its own troubleshooting. The AI summary is off by default and is only turned on by a decision of the Client, in its administration space.
AI answers from the Galaxy's mascot are produced by Scaleway SAS, in France (Paris region), with no transfer outside the European Union. Scaleway receives the question exactly as the administrators write it and the aggregated results by group that the Galaxy already shows the Client, never below the Organization's anonymity threshold, with the names of managers that the Galaxy shows, and no individual answer or comment. Nothing of that exchange is kept by the Publisher; Scaleway may keep a request that failed for up to two weeks, for its own troubleshooting. This feature falls under the same setting as the AI summary, off by default.
12. Assistance to the Client
Data subject rights. The Platform lets each Member exercise their own rights of access and portability (downloading their data from their profile, Kwoji Pulse answers included), rectification and erasure. If the Publisher directly receives a request concerning Client Data, it forwards it to the Client without undue delay and does not answer it without the Client's instructions, except to redirect the person. It assists the Client, as far as possible, with requests the features do not cover.
Impact assessment and prior consultation. The Publisher provides the Client with the information it holds to carry out a data protection impact assessment or consult the supervisory authority, in particular the description of how Kwoji Pulse and Kwoji Live work.
13. Personal data breach notification
The Publisher notifies the Client of any personal data breach affecting Client Data without undue delay, and no later than 48 hours after becoming aware of it. The notification is sent to the owners and administrators of the Organization. It describes, to the extent known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and the Publisher's contact point. Information not yet known is provided afterwards, without undue delay. The Publisher takes the measures necessary to contain the breach and limit its effects, and cooperates with the Client so that it can meet its own notification obligations.
14. Audit
On written request, the Publisher makes available to the Client the information necessary to demonstrate compliance with this DPA: answers to a security questionnaire, a description of the measures in section 9, the list of Sub-processors and available documentation.
If that information is not sufficient, the Client may have an audit carried out, by itself or by an independent auditor bound by professional secrecy who is not a competitor of the Publisher, no more than once in any twelve-month period, with 30 days' written notice, during business hours and without disrupting the operation of the Platform. The audit is at the Client's expense. It does not cover other clients' data. These frequency limits do not apply to an audit required by a supervisory authority or following a personal data breach affecting the Client.
15. End of processing
Terminating a paid plan does not end the Organization, which continues on the free plan under the Terms of Sale. Processing on behalf of the Client ends when the Organization is closed, at the written request of its owner to contact@kwoji.com.
- Return. Before closure, the owner can download the Organization's data from its administration space (Settings), in a structured format. Kwoji Pulse results are returned only in aggregated form, downloadable from the Pulse tab: no individual answer is returned, neither at closure nor at any other time. Anonymous comments are read on screen and are not part of any download.
- Deletion. The Publisher deletes the Organization and the Client Data within 30 days of the request, then confirms the deletion in writing. Copies held in backups disappear at the end of their 30-day retention period.
- What remains. Player accounts, for which the Publisher is the controller and which may be linked to other organizations, are not deleted by the closure; each Member remains free to delete their account. Data the Publisher must keep under a legal obligation, in particular invoices, is kept for the required period.
The removal of a Member during the contract follows the rules described in Annex A.
16. Liability
Each party's liability under this DPA is governed by the "Liability" section of the Terms of Sale. For a Client on the free plan, which has not subscribed under the Terms of Sale, it is governed by the Terms of Use. These provisions apply without prejudice to the rights data subjects hold directly under Article 82 of the GDPR.
17. Acceptance and documents
This DPA forms an integral part of the Terms of Use and the Terms of Sale. The Client accepts it when creating its Organization and, where applicable, when subscribing to a paid plan, under the same conditions as those documents. This online acceptance is equivalent to a signature. The applicable version is the one published at kwoji.com/dpa, dated at the top of the page.
A Client that needs a signed copy can request, at contact@kwoji.com, a PDF version identical to the published version, signed by the Publisher. A negotiated agreement may be concluded for subscriptions on quotation; it then prevails over this DPA to the extent that it departs from it.
18. Changes
The Publisher may amend this DPA, in particular to reflect changes to the Platform, its Sub-processors or Applicable Law. The date of the last update appears at the top of the page. Any material change is notified to the owner of the Organization at least 30 days before it takes effect, unless it is required by law or by an authority. No change may reduce the level of protection of Client Data without the Client's consent.
19. Governing law and jurisdiction
This DPA is governed by French law. Failing an amicable settlement, any dispute relating to its interpretation or performance falls within the jurisdiction of the courts of the Publisher's registered office.
Annex A. Description of the processing
Data subjects: the Members of the Organization, whatever their role; the people the Client invites by email, before they have joined the Organization.
Nature of the operations: collection, recording, organization, storage, computation of aggregates, consultation by the Client, transmission to the recipients it has chosen, erasure.
| Processing | Purpose | Data | Retention period |
|---|---|---|---|
| Organization administration | Manage Members, their roles and status, invite colleagues, configure the Organization, export its data | Identifier, display name, email, role, active or deactivated status, membership dates; for invitations, the invitee's email address, the inviter, sending dates | Membership: until the Member leaves or the Organization is closed. Invitations: 180 days after creation, or earlier if withdrawn by the Client |
| Organization structure | Represent teams, hierarchy and seniority, in order to break down aggregated results | Team, manager, start date, value on each segmentation axis defined by the Client | Until the Member leaves, the Client changes it, or the Organization is closed |
| Kwoji Pulse | Measure the Organization's climate in a way that is aggregated and anonymous with respect to the Client: one question a week, one eNPS a quarter | Score (1 to 5, or 0 to 10), week, Member identifier, segments frozen at the time of the answer (team, seniority band, axis values, chain of managers). Optional anonymous comment after a low answer, not linked to anyone (no identifier, date, segment or rating), up to 500 characters, with a note on the answer that a comment was left | 6 months after the wave. If a Member deletes their account, their answers remain in the averages, detached from any identity |
| Kwoji Pulse AI wave summary (if the Client turns it on) | Summarize a closed wave for the Client's administrators: comment themes and a few sentences | Up to five themes and a summary of a few sentences; no answer, no identifier | 6 months after the wave; deleted earlier if the Client turns the feature off or removes a comment from the wave |
| Engagement dashboard | Measure the Organization's participation and cohesion | Aggregates computed from game results (games per day and per game, who played with whom) | Computed on read, not stored separately |
| AI answers from the Galaxy's mascot (if the Client turns them on) | Answer the Client's administrators' questions about the Galaxy | The question asked (free text) and the aggregated results by group already shown on the Galaxy, with the names of managers; no individual answer, no comment, no identifier | Not kept by the Publisher. The sub-processor does not keep the content, except for a request causing an abnormal error, kept for at most two weeks for diagnosis |
| Slack or Teams channel | Announce games and relay some rituals in the channel chosen by the Client | Channel address; in messages, the game name and game link, the names and results of the daily challenge leaders, the invitation to answer Kwoji Pulse (never a Pulse result) | Channel address: until the Client removes it. Messages: not kept by the Publisher, their lifetime follows the Client's Slack or Teams retention |
| Google Calendar and Meet scheduling | Schedule a game in a Member's calendar and invite their colleagues | Game, time slot, host, email addresses of invited colleagues, Meet link, event identifier; "free or busy" availability read without being stored; the Member's Google connection token | Scheduled games: 7 days after the end of the slot, 24 hours after a cancellation. Token: until the calendar is disconnected or the account is deleted |
| Kwoji Live | Let Members talk to and see each other during a game | Real-time audio and video streams, Member identifier sent to the media provider; no name or photo | No media recording. Technical room metadata: 7 days at most |
| Kwoji Pulse eNPS email | Invite Members to answer the quarterly eNPS wave | Email address, language, Organization name; no result | The message creates no data; the individual unsubscribe is kept as long as the account exists |
A Member leaving. The permanent removal of a Member by the Client deletes their membership, clubs, team, segmentation assignments, registrations and the scheduled games they hosted in the Organization. Their game results are kept for the Organization's aggregates, but their identifier is replaced by a random alias and no mapping between the two is kept: the results can no longer be linked to them. Their Kwoji Pulse answers follow the six-month retention period, as do anonymous comments, which are linked to no one.
Annex B. Sub-processors
| Sub-processor | Service | Data location | Transfer safeguard |
|---|---|---|---|
| Supabase, Inc. | Database, authentication, file storage | Ireland (European Union) | Supabase data processing agreement, standard contractual clauses |
| Cloudflare, Inc. | Hosting of the website and the real-time game server | Global network, with no guaranteed location in the European Union | Standard contractual clauses, Data Privacy Framework |
| Cloudflare, Inc. (RealtimeKit) | Carrying Kwoji Live voice and video, without recording | Global network, with no guaranteed location in the European Union | Standard contractual clauses, Data Privacy Framework |
| Scaleway SAS | Kwoji Pulse AI wave summary and AI answers from the Galaxy's mascot (Mistral model), when the Client turns them on; referee of the Kwoji Verita game (spotting a fake that actually tells the truth), with no option, from the round's texts, with no identifier; retention limited to failed requests, two weeks at most | France (Paris region) | No transfer outside the European Union; Scaleway's data processing agreement |
| Resend, Inc. | Sending emails (invitations, Kwoji Pulse eNPS email) | United States | Resend data processing agreement, standard contractual clauses |
| Google Ireland Limited | Creating Google Calendar and Meet events, reading availability, for Members who connect their calendar | European Union, with Google group processing outside the Union | Google terms, Data Privacy Framework |
| Functional Software, Inc. (Sentry) | Technical error detection, without identity or IP address | European Union (Frankfurt) | Sentry data processing agreement |
| GitHub, Inc. | Running automated maintenance tasks and storing backups, encrypted before upload | United States | GitHub data protection agreement, standard contractual clauses, Data Privacy Framework |
| Crisp IM SAS | Support chat, where the Client or a Member shares Client Data through it | European Union (Amsterdam, Frankfurt) | No transfer outside the European Union |
The Publisher's other providers (payment, audience measurement) only process data for which the Publisher is the controller; they are listed in the Privacy Policy.
Version history
- September 23, 2026: initial version.
- September 24, 2026: addition of the AI summary, an optional feature, turned off by default (Annex A, and Cloudflare Workers AI as a sub-processor in Annex B).
- September 25, 2026: addition of AI answers from the Galaxy's mascot; Scaleway SAS becomes the AI sub-processor for those answers and for the Kwoji Pulse wave summary, and Cloudflare Workers AI is removed; a single setting, turned off by default, covers both features (§3, §11, Annex A, Annex B); Scaleway SAS also serves the Kwoji Verita game referee, with no option (Annex B).