Data Processing Agreement

1.Purpose and how this agreement applies

1.1  The Customer uses the Quiz Maker online quiz, survey, assessment and course services (the "Services") under the Quiz Maker Terms of Service (the "Terms"). When people open or answer the Customer's quizzes, Quiz Maker processes their personal data on the Customer's behalf.

1.2  This Data Processing Agreement ("DPA") sets out the terms of that processing as required by Article 28 of the GDPR, and provides a lawful basis for transferring that personal data outside the European Economic Area.

1.3  This DPA is between My Plaza Pty Ltd (ABN 58 110 054 245), trading as Quiz Maker ("Quiz Maker") and the customer that holds a Quiz Maker account (the "Customer"). It forms part of the Terms and applies automatically, without signature, whenever Quiz Maker processes Customer Personal Data that is subject to Data Protection Laws. The Customer accepts it by accepting the Terms.

1.4  A Customer that needs a signed copy can ask through Quiz Maker's contact page. A signed copy contains the same terms as this DPA.

1.5  If there is any conflict, the following order applies: first the SCCs (where they apply), then this DPA, then the Terms. In all other respects the Terms continue to apply.

2.Definitions

Terms used in this DPA but not defined here (such as controller, processor, data subject, personal data, processing and supervisory authority) have the meaning given in the GDPR. In addition:

3.Roles and scope

3.1  The Customer is the controller of Customer Personal Data and Quiz Maker is its processor.

3.2  Quiz Maker is the controller of the Customer's own account, sign-in and billing information, which it handles under its Security and Privacy Policy. That information is not Customer Personal Data and this DPA does not apply to it.

3.3  The Customer is responsible for having a lawful basis for collecting Customer Personal Data through its quizzes, for the notices it gives to and the consents it obtains from data subjects (including any consent required for cookies or similar technologies on its quizzes and on websites where it embeds them), and for not collecting special categories of personal data or other data the Terms prohibit, unless Quiz Maker has agreed in writing.

4.Processing on the Customer's instructions

4.1  Quiz Maker will process Customer Personal Data only on the Customer's documented instructions, including with regard to transfers to a third country. The Customer's instructions are this DPA, the Terms, and the Customer's use and configuration of the Services (for example publishing a quiz, choosing what it asks, turning on result emails or AI features, and exporting or deleting responses).

4.2  Quiz Maker may process Customer Personal Data otherwise only where required by Union or Member State law to which it is subject. In that case it will tell the Customer of that legal requirement before processing, unless the law prohibits this on important grounds of public interest.

4.3  Quiz Maker will tell the Customer promptly if, in its opinion, an instruction infringes Data Protection Laws.

4.4  Quiz Maker will not sell Customer Personal Data, use it for advertising, use it to train artificial intelligence models, or otherwise use it for its own purposes, except to create aggregated statistics that do not identify the Customer or any data subject, as described in the Terms.

5.Confidentiality

5.1  Quiz Maker will ensure that everyone it authorises to process Customer Personal Data is bound by an appropriate obligation of confidentiality, and that access is limited to the staff who need it to provide, secure and support the Services.

6.Security

6.1  Quiz Maker will implement and maintain the technical and organisational measures described in Annex II to protect Customer Personal Data, as required by Article 32 of the GDPR.

6.2  Quiz Maker may update those measures as technology and threats change, provided the overall level of protection is not materially reduced.

7.Sub-processors

7.1  The Customer gives Quiz Maker general written authorisation to engage Sub-processors. The Sub-processors listed in Annex III are approved.

7.2  Quiz Maker publishes the current list of Sub-processors as Annex III of this DPA at quiz-maker.com/Data-Processing-Agreement, and will update it at least 30 days before it adds or replaces a Sub-processor. Quiz Maker will also email that notice to any Customer that has asked for it through the contact page.

7.3  The Customer may object to a new Sub-processor on reasonable data protection grounds within that 30 days, and the parties will discuss the objection in good faith. If it cannot be resolved, the Customer may terminate the affected Services and Quiz Maker will refund any prepaid fees for the unused period.

7.4  Quiz Maker will engage each Sub-processor under a written contract that imposes data protection obligations no less protective than those in this DPA, and remains fully liable to the Customer for each Sub-processor's performance of those obligations.

8.Data subject requests

8.1  If Quiz Maker receives a request from a data subject about Customer Personal Data, it will pass the request to the Customer without undue delay and will not respond to it except to direct the data subject to the Customer, unless the Customer authorises otherwise.

8.2  The Services let the Customer view, export, correct and delete Customer Personal Data itself. Where the Customer cannot do so through the Services, Quiz Maker will provide reasonable assistance, taking into account the nature of the processing, so the Customer can respond to requests to exercise data subject rights.

9.Personal Data Breaches

9.1  Quiz Maker will notify the Customer without undue delay after becoming aware of a Personal Data Breach, and where feasible within 48 hours.

9.2  The notification will describe, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences, and the measures taken or proposed. Where not all of this is known at once, Quiz Maker will provide it in phases as it becomes available.

9.3  Quiz Maker will take reasonable steps to contain and remedy the breach and will give the Customer the information it reasonably needs to meet its own obligations to notify supervisory authorities and data subjects. Notifying a breach is not an admission of fault or liability.

10.Assistance with compliance

10.1  Taking into account the nature of the processing and the information available to it, Quiz Maker will give the Customer reasonable assistance with its obligations under Articles 32 to 36 of the GDPR, including data protection impact assessments and prior consultation with a supervisory authority.

11.Deletion and return of data

11.1  While the Customer uses the Services it can export or delete Customer Personal Data at any time.

11.2  When the Services end, the Customer has at least 30 days to export its data. After that period Quiz Maker will delete Customer Personal Data, unless Union or Member State law requires it to be kept.

11.3  Copies held in encrypted backups are overwritten in the normal backup cycle and remain protected under this DPA until then. On request, Quiz Maker will confirm in writing that deletion has been carried out.

12.Information and audits

12.1  Quiz Maker will make available to the Customer the information necessary to demonstrate compliance with Article 28 of the GDPR, including written information about its security measures and answers to reasonable security questionnaires.

12.2  Audits are carried out by Quiz Maker providing that information and answering the Customer's reasonable written follow-up questions about it.

12.3  An inspection of Quiz Maker's premises or systems may take place only where a competent supervisory authority requires it, or following a Personal Data Breach affecting Customer Personal Data. It must be carried out by an independent auditor bound by confidentiality who is not a competitor of Quiz Maker, on at least 30 days' written notice (or such shorter notice as the authority requires), during normal business hours, at the Customer's cost, and limited to the processing of Customer Personal Data. It will not include access to other customers' data or to information that would compromise the security of the Services.

12.4  This clause sets out how the Customer's rights under clause 8.9 of the SCCs are exercised, and does not limit the powers of any supervisory authority.

13.International transfers

13.1  The Customer acknowledges that Quiz Maker is established in Australia, that Customer Personal Data is hosted on servers in the United States, that it passes through Cloudflare's global network, and that the Sub-processors in Annex III process it in the locations listed there.

13.2  To the extent the Customer's transfer of Customer Personal Data to Quiz Maker is a transfer to a third country under Chapter V of the GDPR, the SCCs are incorporated into this DPA by reference, with the Customer as data exporter and Quiz Maker as data importer, and with the following choices:

1. Clause 7 (docking clause) applies.
2. Clause 9(a): Option 2 (general written authorisation) applies, the time period is 30 days, and notice is given as described in clause 7.2 of this DPA.
3. Clause 11(a): the optional language does not apply.
4. Clause 13: the competent supervisory authority is the one identified in Annex I, section C.
5. Clause 17: Option 1 applies, and the governing law is the law of Ireland.
6. Clause 18(b): disputes are resolved by the courts of Ireland.
7. Annexes I, II and III of the SCCs are completed by Annexes I, II and III of this DPA.

13.3  Where Quiz Maker transfers Customer Personal Data to a Sub-processor in a third country, it will ensure the transfer is covered by an appropriate safeguard under Chapter V of the GDPR, such as the standard contractual clauses or an adequacy decision (including the EU-U.S. Data Privacy Framework where the Sub-processor is certified under it).

13.4  Quiz Maker will provide reasonable information to help the Customer assess the transfer under clause 14 of the SCCs, and will handle any request from a public authority for Customer Personal Data as set out in clause 15 of the SCCs.

13.5  Where the UK GDPR applies, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner (version B1.0) applies, with its Tables 1 to 3 completed by the details in this DPA and its Annexes, and either party may end it as allowed by its Table 4. Where the Swiss Federal Act on Data Protection applies, the SCCs apply with the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority, and references to the GDPR read as references to that Act.

14.Liability

14.1  Each party's total liability to the other arising out of or in connection with this DPA and the SCCs, taken together with all claims under the Terms, is subject to the limitations and exclusions of liability in the Terms, including the exclusion of indirect and consequential loss and the overall cap on liability, to the extent permitted by law.

14.2  Nothing in this DPA limits either party's liability to data subjects under the SCCs, or any liability that cannot be limited or excluded by law.

15.Term, changes and general

15.1  This DPA takes effect on 25 August 2026, or when the Customer accepts the Terms if that is later, and continues for as long as Quiz Maker processes Customer Personal Data. Clauses that by their nature should survive termination do so.

15.2  This DPA is governed by the law that governs the Terms, except that the SCCs are governed by the law chosen in clause 13.2. Nothing in this DPA reduces the rights of data subjects under the SCCs.

15.3  Quiz Maker may update this DPA in the way the Terms allow it to update the Terms. An update will not materially reduce the protection this DPA gives Customer Personal Data, unless a change in Data Protection Laws or new standard contractual clauses adopted by the European Commission require it.

15.4  If any provision of this DPA is invalid or unenforceable, the rest of it remains in effect.

15.5  Where the parties sign a copy of this DPA, it may be signed electronically and in counterparts, each of which is an original.

Annex I: Description of the processing

A. List of parties

B. Description of the transfer

C. Competent supervisory authority

Where the Customer is established in the European Union, the supervisory authority of the Member State where it is established (or its lead supervisory authority, where it has more than one establishment). Where the Customer is not established in the European Union but the GDPR applies to it, the supervisory authority of the Member State where its representative under Article 27 of the GDPR is established, or, where it is not required to appoint one, of the Member State where the Respondents concerned are located.

Annex II: Technical and organisational measures

Annex III: Approved Sub-processors

Stripe, Inc. processes the Customer's own billing information, for which Quiz Maker is the controller. It does not receive Customer Personal Data and is not a Sub-processor under this DPA.