Information for procurement

GeoQuestr is a web service that runs on our own servers within the EU. Administrators sign in to build experiences. Participants join via a link or QR code in the browser or the app with anonymous accounts and do not need to give their real name or their email address. Participants' gameplay data (player name, avatar, score, progress, answers and submitted photos) is stored to run the activity and for reports. Location data is never stored and is not sent over the network. It is only processed locally on the participant's device. Sensitive personal data under Article 9 GDPR must not be processed. The AI judge runs an open AI model on our own server in the EU (Hetzner, Finland). It reads a submitted photo in memory, scores how well it does the task, turns that into bonus points and keeps no copy. Submitted photos and videos are not sent to OpenAI. The AI judge does not filter content: the organizer reviews submitted photos. The organizer can turn off the AI features completely. The organizer chooses whether a report is shared publicly. A public report shows statistics and the leaderboard with player names, but no submitted photos. All categories of personal data are described in our privacy policy.

• Encryption in transit (HTTPS/TLS) and at rest. • Our own login service, where every request is authorization-checked on the server, so that administrators can only reach their own organization's data. Passwords are only stored as salted hashes. • Only authorized staff have access to the production environment, with personal SSH keys and two-factor authentication. • Everyone who processes the personal data has committed to keeping it confidential. • Data minimization: participants are anonymous and location data is not stored. • Backups are taken daily, stored encrypted within the EU and kept for at most 30 days.

• Participants' data is automatically deleted or anonymized no later than 6 months after the round has ended. • Administrator accounts are deleted no later than 90 days after the agreement has ended. • Within 90 days after the agreement has ended, you can request your content: texts, quests and locations as a JSON file and images in their original format. • Backups are kept for at most 30 days, so deleted data also disappears from them. • We confirm the deletion in writing on request.

When you run activities in GeoQuestr, you are the controller and we are the processor. We sign data processing agreements under Article 28 GDPR. In the agreement we undertake, among other things, to: • process personal data only according to your written instructions, • notify you in writing at least 30 days before a sub-processor is added or replaced. You can object, and if we cannot agree, you may terminate the agreement at no cost, • help you respond to requests from data subjects, for example for access or erasure, and assist with data protection impact assessments, • let you, or an independent auditor bound by confidentiality, audit compliance with the agreement after written notice at least 30 days in advance. Swedish law applies. Email upphandling@geoquestr.com with your organization number, and we will send you the agreement.

In the event of a personal data breach, we notify you without undue delay, and no later than 36 hours after becoming aware of it. The notification contains what Article 33(3) GDPR requires, to the extent it is known. To report a security issue or a suspected vulnerability: email security@geoquestr.com with the subject "Suspected vulnerability". You can send questions about personal data to the same address. Describe your matter and your relationship to the account or activity.

Our platform is designed to meet WCAG 2.1 Level AA for core marketing pages and creator flows where feasible. Participants use maps where a 3D avatar moves on the map as the participant moves. How the creator designs their quest is important for achieving high accessibility. All text is designed to be easy to read and accessible, and quests can also be read aloud in the user's chosen language. For public-sector requirements: describe your needs when contacting us so we can discuss any necessary adjustments.

Self-serve card payments are handled by Stripe. For purchase orders, invoices, custom participant limits or municipal procurement: use Full Service on the pricing page or the contact forms on the solution pages, and we will handle it case by case. Stripe is not involved for organizations that are invoiced.

GeoQuestr uses the following sub-processors. Each one only receives the data its function requires. Sub-processors outside the EU/EEA only receive personal data on the basis of an adequacy decision, such as the EU–US Data Privacy Framework, or the European Commission's standard contractual clauses. Organizations with a data processing agreement are notified in writing at least 30 days before a sub-processor is added or replaced.

All personal data, including backups and logs, is stored within the EU on our own servers at Hetzner Online GmbH, in data centers in Finland and Germany. Stripe stores payment data for customers who pay by card. OpenAI is not used to store personal data. Place search and directions run on our own servers.