Evalis Privacy Policy
How Evalis handles account, room, participant, analytics, uploaded content, and contact-message data in the platform.
Last Updated
April 1, 2026
Overview
What this policy covers
This privacy policy explains what personal data Evalis currently processes, why it is processed, how it is used inside the product, and which rights users and participants may have under the GDPR / AVG.
Who we are
Controller details
Controller: Evalis
Business address: Binnenhof, Hardenberg
Business registration: Not applicable
Data subjects
Whose data we process
Registered users who create and manage quizzes
Hosts who create and manage live rooms
Participants who join live rooms using a room code
Website visitors using public pages
People who send a message through the terms-page contact form
Data categories
What personal data we process
Account data
Name, email address, password hash, email verification status, and account timestamps.
Name, email address, password hash, email verification status, and account timestamps.
Quiz and question content
Quiz titles, descriptions, questions, answers, and question images uploaded by account holders.
Quiz titles, descriptions, questions, answers, and question images uploaded by account holders.
Room data
Room codes, room status, current question progress, host linkage, and room timestamps.
Room codes, room status, current question progress, host linkage, and room timestamps.
Participant data
Participant name, room participation, selected answers, score, ranking, and related timestamps.
Participant name, room participation, selected answers, score, ranking, and related timestamps.
Visitor analytics data
IP address, visited path, and derived country for certain non-room page visits.
IP address, visited path, and derived country for certain non-room page visits.
Contact message data
Name, email address, subject, message content, locale, IP address, user agent, optional linked account, and related timestamps when a contact form is submitted.
Name, email address, subject, message content, locale, IP address, user agent, optional linked account, and related timestamps when a contact form is submitted.
Session and technical data
Session data needed to keep users signed in, maintain room participation, and protect access to authenticated parts of the app.
Session data needed to keep users signed in, maintain room participation, and protect access to authenticated parts of the app.
Purposes
Why we process data
Create and manage user accounts
Authenticate users and secure access to hosted content
Create, store, edit, and present quizzes and question images
Run live quiz rooms, calculate scores, and show leaderboards
Show hosts live room state, participant progress, and answer statistics
Receive, review, and respond to contact messages sent through the terms page
Measure basic site traffic and understand which public pages are visited
Maintain, troubleshoot, and secure the platform
Legal bases
Grounds for processing
Contract
For account access, quiz management, room creation, room participation, and core platform features.
For account access, quiz management, room creation, room participation, and core platform features.
Legitimate interest
For service security, abuse prevention, troubleshooting, traffic measurement, handling contact enquiries, and protecting the integrity of live quiz rooms.
For service security, abuse prevention, troubleshooting, traffic measurement, handling contact enquiries, and protecting the integrity of live quiz rooms.
Legal obligation
Where processing or retention is required by applicable law.
Where processing or retention is required by applicable law.
Consent
Only where optional processing is introduced that legally requires consent.
Only where optional processing is introduced that legally requires consent.
Analytics and tracking
How visitor tracking currently works
Evalis currently stores a visit record containing IP address, requested path, and country for certain page visits.
A geolocation lookup is used to derive a country from the IP address.
Room gameplay routes, join routes, and JSON / XHR requests are excluded from this visit tracking.
Tracking is also limited by a session flag so the same visitor is not counted on every page load within the same session.
Retention
How long we keep personal data
Account, quiz, room, participant, answer, visit, and contact-message records may remain stored until they are manually deleted by the operator or removed through future retention tooling.
Sharing
Who data may be shared with
Hosting or server providers used to run the application
Infrastructure tools that support storage, backups, and uptime
Geolocation or similar service providers used to derive visitor country information
Authorities or third parties where disclosure is legally required
Inside Evalis, contact messages may be accessible to administrators or operators who need to review, moderate, or respond to them. Where third parties process personal data on behalf of Evalis, a data processing agreement should be used where legally required.
Rights
Your privacy rights
Right of access
Right to rectification
Right to erasure
Right to restriction of processing
Right to object
Right to data portability where applicable
Right to lodge a complaint with the Autoriteit Persoonsgegevens
Participants
Live room participant notice
Participants may join a room without creating a full account. In that case, Evalis still processes the name entered for the room, room participation data, answers, score, ranking, and related live room state so the session can run and the host can present results and leaderboards.