Privacy Notice

This notice explains the processing of personal data in connection with the QWIZ (qwiz.hu) live quiz service, in plain language and in accordance with Regulation (EU) 2016/679 (GDPR).

The most important principle in one sentence: players are anonymous. Whoever joins a quiz provides no name, no email address and no other personal data – the system draws a random, funny alias and a number for them (for example "Playful Owl – Q7"), and the game is played under that name throughout. Nobody learns their real identity, not even the presenter running the game. The only exception is the winner, who may – entirely voluntarily, in order to receive the gift – provide an email address at the end of the game.

1. The controller

The service is operated by Ceox Informatika Kft. (the "Operator"). Contact for data protection matters: hello@ceox.hu, website: www.ceox.hu. The Operator acts as controller in respect of presenter accounts and the website, and as processor – on the presenter's behalf – in respect of the email addresses voluntarily provided by winning players.

2. Presenter accounts

Data processed: name, company name (if provided), email address, password (stored exclusively in an irreversible, hashed form), BNI membership declaration (if the presenter ticks it), uploaded logo, brand colour, language and game settings, and the technical logs belonging to the account. The purpose of processing is creating and operating the account, providing the service and sending service-related notifications; on the basis of the BNI declaration the Operator may send a courtesy thank-you letter. Legal basis: performance of a contract (Article 6(1)(b) GDPR); for the thank-you letter, the Operator's legitimate interest (Article 6(1)(f)). Retention: until the account is deleted; the account can be deleted at any time in Settings with immediate effect, in which case the data belonging to it are permanently erased, subject to the exceptions below.

We log the fact, time and accepted version of the Terms and of this notice in order to satisfy the accountability principle (Article 5(2) GDPR). When deleting the account, the presenter may state the reason for leaving; we retain this feedback for service improvement on the basis of legitimate interest (Article 6(1)(f)). We also keep anonymous, aggregated statistics about the use of the service.

3. Newsletter

We send a newsletter (for example about the CEOX AI-Learning programme) exclusively on the basis of the presenter's separate, voluntary consent (Article 6(1)(a) GDPR). The time of consent is logged; consent can be withdrawn at any time, free of charge, in Settings or as described in the email, and subscribing is not a condition of using the service.

4. Players: anonymous participation

The system does not request and does not store any personal data about players joining a quiz. When scanning the QR code, the player automatically receives a randomly drawn, funny alias (for example "Playful Owl") and a joining number (for example "Q7"); only this alias and number appear on the projector and on the other players' screens. The alias is not derived from the player's real name and cannot be linked to their person – thus no personal data are created during participation (Recital 26 GDPR: the Regulation does not apply to anonymous information).

Technical data are created for running the game: the time of joining, the answer given and the response time, and a random technical token identifying the session. These serve exclusively to establish the result of the given game, cannot be linked to a specific person, and are automatically deleted no later than 90 days after the event; the presenter can delete them earlier by deleting the question or their account.

Winners' email addresses. If the presenter has enabled email collection for the given question (configurable separately for live QR and virtual mode), the system may ask – exclusively the winning players – for an email address at the end of the game. Providing it is entirely voluntary: whoever declines suffers no disadvantage whatsoever; the presenter simply cannot reach them by email to hand over the gift. In this respect the controller is the presenter organising the game (purpose: handing over the prize; legal basis: the winner's consent, Article 6(1)(a) GDPR), while the Operator provides the platform as processor. The email address given is linked exclusively to the result of the game concerned, is not used for newsletters, and is deleted together with the game data (no later than after 90 days).

The same rules apply to the public trial (demo) games: demo players also play under an anonymous alias, and demo game data are automatically deleted within 24 hours.

5. Cookies and statistics

The website uses strictly necessary cookies (session, CSRF security protection, language choice, and a technical cookie limiting abusive demo launches); their legal basis is the legitimate interest in providing the service and necessity under electronic communications rules. We use statistical measurement (Google Analytics) only if you expressly consent on the cookie bar; measurement uses anonymised IP addresses, and there is no advertising-related processing and there are no advertising cookies. Consent can be changed at any time; refusing it does not affect the use of the service.

6. Processors, recipients, transfers

We use the following providers: Google Cloud (hosting and database, in a data centre located in the European Union), Google Workspace (sending transactional emails), Cloudflare (network protection, content delivery and bot filtering), and – only with consent – Google Analytics (traffic statistics). During machine translation of questions, the text of the question (content containing no personal data) is processed via OpenAI's service. Where these providers transfer data outside the European Economic Area, the transfer takes place on the basis of the adequacy decision under the EU–US Data Privacy Framework or the standard contractual clauses adopted by the European Commission.

7. Data security

Data are transmitted over encrypted connections (HTTPS/TLS); passwords are stored exclusively with modern, irreversible hashing; access is permission-bound and logged; a logged-in session closes automatically after 30 minutes of inactivity. No automated decision-making with legal effect and no profiling take place; the game's result list is a transparent calculation based solely on measured response times. The anonymous player model is itself a security guarantee: what never enters the system cannot leak from it.

8. Data subjects' rights

Data subjects may request access to their personal data, their rectification, erasure or restriction of processing, may exercise their right to data portability, may object to processing based on legitimate interest, and may withdraw consent at any time without affecting the lawfulness of processing before withdrawal. Requests are received at hello@ceox.hu and answered within one month at the latest. Players who provided an email address as winners may exercise their rights both with the organising presenter and with the Operator; the latter forwards the request to the presenter where necessary.

9. Remedies

Complaints about data processing may be lodged with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH, 1055 Budapest, Falk Miksa utca 9–11.; www.naih.hu), and data subjects may also seek judicial remedy before the competent court of their place of residence.

10. Changes to this notice

The current version of this notice is always published on this page. In the event of a material change we notify registered presenters by email, and the system asks for acceptance of the new version at the next login.

Effective version: 2026-07-08