Ludik Évasion Data Processing Agreement

Version 1.0 - effective as of December 1, 2026.

Reference language notice: This English translation is provided for convenience only. In case of discrepancy, inconsistency, or interpretation difference, the French version shall prevail.

This agreement supplements the Ludik Évasion operator terms (the "Operator Terms") where Ludik Evasion (the "Publisher") processes personal data on behalf of an Operator in connection with the Ludik Évasion platform (the "Platform").

It constitutes the processing contract required by article 28 of Regulation (EU) 2016/679 of April 27, 2016 (the "GDPR") for such processing. Capitalized terms not defined in this agreement have the meaning given to them in the Operator Terms.

1. Parties and roles

1.1 The Operator acts as controller for the Participants' personal data processed in connection with its Quests and the sale of its Registrations. It determines in particular the Quests it operates, their locations, their dates, the features enabled, the participant data requested and the participation conditions.

1.2 The Publisher acts as the Operator's processor for this processing.

1.3 The Publisher remains a separate controller for the processing required to operate the Platform, in particular account management, authentication, security, the Catalog, Operating Licenses, calculation, collection and checking of the Commission, statistical indicators relating to its Scenarios, support, technical diagnostics, handling of reports, compliance with its legal obligations and defense of its rights. This processing is described in the Platform's privacy policy. For statistical indicators relating to its Scenarios and checking of the Commission, the Publisher uses only the necessary data from the Operator's Quests, on the basis of its legitimate interest in monitoring and improving its Scenarios and checking the performance of Operating Licenses, and never uses it to solicit Participants.

2. Subject matter, nature, purposes and duration of processing

2.1 The entrusted processing concerns the technical provision of the Platform to the Operator for the operation of its Quests. It includes the collection, recording, storage, consultation, making available, transmission, synchronization, backup, export, anonymization and deletion of data.

2.2 It covers in particular:

• Participants' and teams' access to Quests, through a QR code, invitation link, Registration or the Catalog
• running games, progress, answers, hints, scores, rankings and results
• functional geolocation and, where enabled and accepted, trail history and live tracking
• photos, media and Quest albums, as well as evidence of publication choices
• collecting the participant data requested by the Operator and evidence of the corresponding consent
• end-of-game feedback and its notification by email to the designated recipients
• recording paid Registrations and sending their confirmation
• support, maintenance, security and backups

2.3 The entrusted processing lasts throughout the relationship between the Publisher and the Operator, then during the end-of-relationship operations provided for in article 13.

3. Categories of data subjects

The entrusted processing concerns:

• Participants, players and team members of the Operator's Quests, including minors where the Operator admits them
• buyers of Registrations
• persons appearing in photos or videos submitted during a Quest
• the Operator's Members and the feedback email recipients it designates

4. Categories of data

4.1 The categories of data processed on behalf of the Operator are:

• participation data: team, team name and avatar, times, progress, answers, hints, scores, aggregated distance, rankings
• participant data, among the fields chosen by the Operator: first name, last name, email address, date of birth, postal code, telephone number
• trail history, where the Operator enables it and the Participant accepts it: latitude, longitude, accuracy, altitude, heading, speed, timestamp and last position
• photos, videos, sounds and avatars submitted during the Quest, with their file metadata
• evidence of Participants' choices: type of choice, decision, text displayed and its fingerprint, language, context, technical session and device identifiers, fingerprints of the IP address and browser
• end-of-game feedback
• paid Registration data: the buyer's email address and language, participant data and related choices, payment identifiers and status, amount, confirmation email
• technical data required for the operation and security of the entrusted processing

4.2 The Platform is not designed to process special categories of data within the meaning of article 9 of the GDPR or data relating to criminal convictions and offenses within the meaning of article 10 of the GDPR. The Operator shall not collect such data through the Platform, in particular in the questions of its Quests. Photos are not subject to any biometric processing.

5. Documented instructions

5.1 The Operator's documented instructions consist of the Operator Terms, this agreement, the settings configured by the Operator on the Platform and its written requests accepted by the Publisher. The Publisher processes the entrusted data only on these instructions, including with regard to transfers outside the European Union, unless required to do so by Union or Member State law to which it is subject; in that case, it informs the Operator of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

5.2 The Publisher immediately informs the Operator if it considers that an instruction infringes the GDPR or another data protection provision.

5.3 Unless the Operator gives a different documented instruction accepted by the Publisher, the following retention and deletion rules apply:

6. Confidentiality

The Publisher guarantees that persons authorized to process the entrusted data, including the staff of its sub-processors, have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that they access the data only to the extent necessary for their duties.

7. Security

7.1 The Publisher takes all measures required pursuant to article 32 of the GDPR. It implements, with its sub-processors, appropriate technical and organizational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing and the risks to the rights and freedoms of individuals.

7.2 These measures include in particular:

• encryption of communications between the applications and the servers
• storage of passwords and invitation secrets in hashed form
• access control to data based on organization membership and the rights of each role
• media access links limited to one (1) hour after rights are checked
• removal of location and device metadata from photos when they are processed
• named operating accounts, with no shared account, with multi-factor authentication where the provider allows it, and removal of access that is no longer necessary
• regular database backups
• technical logging designed to exclude secrets, raw geolocation coordinates and payment identifiers

7.3 Without prejudice to article 7.1, enhanced security audits, certifications, dedicated penetration tests, enhanced service levels or specific encryption are provided only if set out in a separate written agreement.

8. Sub-processors

8.1 The Operator authorizes the Publisher to use the following sub-processors:

8.2 The Publisher contractually imposes on each sub-processor the same data protection obligations as those set out in this agreement, in particular sufficient guarantees to implement appropriate technical and organizational measures. Where a sub-processor fails to fulfill its data protection obligations, the Publisher remains fully liable to the Operator for the performance of that sub-processor's obligations.

8.3 The Publisher informs the Operator in advance of any addition or replacement of a sub-processor, at least fifteen (15) days before it takes effect, by email sent to the Operator's contacts, stating the identity of the sub-processor, the service entrusted and the data location, and publishes a new version of this agreement. The Operator may raise objections during that period. In the event of an objection, the parties seek a solution in good faith. Failing that, the Operator may terminate the services affected by that change without penalty, including, where applicable, the relationship governed by the Operator Terms.

8.4 Registration payments are processed by Stripe on the Operator's connected account, under the contract concluded directly between the Operator and Stripe. Stripe, Apple, Google and the map providers act under their own terms and are not sub-processors of the Publisher.

9. Transfers outside the European Union

Where a sub-processor processes or may access data from a country outside the European Union, the Publisher ensures that the transfer is governed by an adequacy decision of the European Commission, including, for certified companies, the EU-U.S. Data Privacy Framework, or by standard contractual clauses adopted by the European Commission. The Publisher provides the Operator, upon request, with information on these safeguards.

10. Assistance with data subject rights

10.1 Participants holding an account may, from the mobile application, obtain an export of their data, modify their profile, delete their account, withdraw their agreement to trail history, delete their team's trail history, object to the publication of the album and delete a photo of their team. They may also delete their account from their account settings on the website.

10.2 Where the Publisher directly receives a data subject request relating to the entrusted processing, it forwards it without undue delay to the Operator, except where the request can be satisfied through the Platform features described in article 10.1.

10.3 The Publisher assists the Operator, through appropriate technical and organizational measures and insofar as possible, in responding to requests for access, rectification, erasure, restriction, objection and portability, in particular by extracting or deleting data that is not accessible from the Platform.

11. Personal data breaches

11.1 The Publisher notifies the Operator of any personal data breach affecting the entrusted processing without undue delay after becoming aware of it, by email to the Operator's contacts.

11.2 The notification includes, where available:

• the nature of the breach, the categories and approximate number of individuals and records concerned
• the name and contact details of the Publisher's point of contact
• the likely consequences of the breach
• the measures taken or proposed to address it and mitigate its effects

11.3 Where this information cannot be provided at the same time, it is provided in phases. As controller, the Operator is responsible for notifying the breach to the supervisory authority and, where applicable, to the data subjects.

12. Impact assessment and prior consultation

The Publisher assists the Operator in ensuring compliance with the obligations under articles 32 to 36 of the GDPR, taking into account the nature of the processing and the information available to it. In particular, it provides the Operator with the information and documentation necessary to carry out a data protection impact assessment and, where applicable, the prior consultation of the supervisory authority, especially where the Operator's Quests combine the participation of minors, trail history or photo publication.

13. End of the relationship

13.1 Before the closure of its Operator Account, the Operator may ask the Publisher to export the available data relating to its Quests.

13.2 After closure, and after the return of data provided for in article 13.1 where the Operator has requested it, the Publisher deletes or anonymizes the personal data processed on behalf of the Operator within a reasonable period communicated to the Operator at closure. It keeps no copy of such data, including for evidence purposes, unless Union or Member State law requires its retention, in particular for accounting records relating to Registration payments; such data is then kept only for the required period and remains protected in accordance with this agreement. Data present in backups is erased at the end of their rotation cycle.

13.3 Upon written request, the Publisher confirms to the Operator that these operations have been carried out.

14. Information and audit

14.1 The Publisher makes available to the Operator the information necessary to demonstrate compliance with the obligations set out in article 28 of the GDPR, in particular the up-to-date list of sub-processors and the description of the security measures.

14.2 The Publisher allows for and contributes to audits, including on-site inspections, conducted by the Operator or by an independent auditor mandated by the Operator. The Operator notifies the Publisher in writing at least thirty (30) days in advance. The auditor is bound by a confidentiality obligation. Except in the event of a personal data breach affecting the entrusted processing, an audit may be carried out no more than once (1) a year. The audit is carried out at the Operator's expense, under conditions that preserve the security and confidentiality of the data of other Operators and Participants. A documentary audit or a questionnaire may be offered in the first instance.

15. Operator obligations

The Operator undertakes in particular to:

• give the Publisher lawful and documented instructions
• determine the legal bases for its processing and inform Participants, including about trail history, live tracking, photo publication and public access to rankings where it enables these features
• obtain the necessary consents and authorizations, in particular for people's image and, for minors, from their legal representatives, including, for a minor under fifteen (15) years of age, the joint consent of the minor and the holder or holders of parental authority where processing is based on consent
• request only the participant data necessary for its purposes
• carry out, where required, the impact assessment relating to its processing
• respond to data subject requests relating to its processing

16. Liability, term and amendment

16.1 Each party's liability under this agreement is governed by the Operator Terms and the GDPR.

16.2 This agreement applies for the entire duration of the entrusted processing. Its provisions relating to confidentiality, deletion and information survive for the time necessary for their performance.

16.3 The Publisher may amend this agreement to reflect legal, technical or operational developments, under the amendment conditions set out in the Operator Terms.