Questovery SaaS Data Processing Addendum

Version 1.1 - effective as of December 1, 2026.

Reference language notice: This English translation is provided for convenience only. In case of discrepancy, inconsistency, or interpretation difference, the French version shall prevail.

This addendum supplements the Questovery Platform Terms (the “Platform Terms”) where LEZO processes personal data on behalf of a professional Customer in connection with the use of Questovery.

It constitutes the applicable data processing agreement within the meaning of Article 28 of the GDPR for processing operations performed by LEZO as processor. It does not replace the Questovery Privacy Policy, which also describes the processing operations for which LEZO acts as a separate data controller.

1. Parties and Roles

The Customer acts as data controller where it determines the purposes and means of processing operations related to its Quests, content, participants, players, teams, media, participant data, participation conditions, registration sales and relationships with its own users.

LEZO acts as processor where it processes personal data on behalf of the Customer in order to provide, host, synchronize, maintain, secure, support, return or delete the data processed in connection with the Questovery SaaS Services.

LEZO remains a separate data controller for its own processing operations, including the management of its accounts, authentication, security and abuse prevention, support, technical administration, billing of its services, collection of platform fees, evidence of the acceptance of contractual documents, handling of content reports, audience measurement, compliance with its legal obligations and the defense of its rights.

2. Subject Matter, Duration and Purposes of the Entrusted Processing

The processing operations entrusted to LEZO concern the technical provision of the Questovery SaaS Services to the Customer and its Users.

They cover in particular:

• the creation, editing, configuration and administration of Scenarios, Quests, steps, content, media and game settings
• the management of organizations, accounts, roles, invitations, QR codes, access links and access rights
• access to Quests by players, participants or teams
• the tracking of games, progress, answers, scores, rankings, end-of-game feedback, statuses and histories
• functional geolocation and, where the Customer enables it and the participant accepts it, route history and live tracking
• the management of photos, media, files, publication decisions and related technical evidence
• the collection of participant data requested by the Customer
• the sale, confirmation and refund of paid registrations, where the Customer sells registrations
• synchronization, game resumption, support, maintenance, security, backups, return and deletion

The entrusted processing operations last for the duration of the Customer's use of the Services, and then for the duration of the operations necessary for closure, return, deletion, anonymization, retention required by Union or Member State law or the management of residual backups under the conditions provided for by the Platform Terms, the Privacy Policy and this addendum.

3. Categories of Data Subjects

The entrusted processing operations may concern:

• administrators, organizers, employees, contractors or representatives authorized by the Customer
• players, participants, team members and end users of the Quests
• buyers of paid registrations
• persons appearing in photos, videos or media used in a Quest where such media contain personal data
• persons involved in support requests, incidents, deletions or maintenance operations

Where minors are likely to participate in a Quest, the Customer remains responsible for determining the conditions of appropriate information, parental or responsible-adult authorization, consent, data minimization and supervision applicable to its activity and its audience. The product does not know the age of participants and applies no minor-specific rules on the server side.

4. Categories of Data

The categories of data that may be processed on behalf of the Customer include in particular:

• identification data: last name, first name, display name, identifier, role, organization, team
• contact data: email address and, where the Customer requests them in the participant form, telephone number and postal code
• participant data chosen by the Customer: first name, last name, email address, date of birth, postal code, telephone number, with the consent text displayed
• account and access data: invitations, QR codes, access links, roles, statuses
• Quest data: content, texts, questions, expected answers, hints, steps, settings, themes, media and files
• participation data: team, team name and avatar, progress, answers, hints used, scores, rankings, end-of-game feedback, statuses, timestamps, game history
• geolocation data: route history (latitude, longitude, accuracy, altitude, heading, speed, timestamp) and last transmitted position, where this feature is enabled and accepted
• photo, video or media data: media provided or collected, file metadata, publication decisions
• registration payment data: buyer's email address and language, snapshot of the participant data and of the consent, payment identifiers and status, amount, any refund, confirmation email
• technical data: IP address, browser, device, operating system, application version, logs, errors and security events
• support data: requests, exchanges, attachments and information communicated to resolve a question or an incident

The Services are not designed to process special categories of data within the meaning of Article 9 of the GDPR, nor personal data relating to criminal convictions and offences within the meaning of Article 10 of the GDPR. The Customer undertakes not to use the Services to process such data without a prior and appropriate written framework.

Photos and videos may constitute personal data where a person is identifiable. They are not subject to any biometric processing. The optimized copy displayed in the Application does not include the camera metadata. When it is processed, the original file of a photo in JPEG, PNG, WebP or TIFF format is stripped of its EXIF, XMP and IPTC metadata, including the GPS position; files in other formats are retained as transmitted.

Evidence of decisions relating to route history, photo publication and participant data includes the type of choice, the decision, the displayed text and its fingerprint, the age confirmation sentence ticked where the choice is an agreement, the date, the language, the Quest and team context, technical session and device identifiers and fingerprints of the IP address and browser.

5. Documented Instructions of the Customer

The Customer's documented instructions consist of the Platform Terms, the settings configured in the Application, this addendum, written exchanges accepted by LEZO and lawful requests sent by the Customer in connection with support or administration of the Services.

LEZO processes the entrusted personal data only on the Customer's documented instructions and for the purposes described in these instructions. Where LEZO is required to process data under Union or Member State law to which it is subject, it informs the Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

LEZO immediately informs the Customer if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions.

The Customer remains responsible for the lawfulness of its instructions, its content, its legal bases, the information it provides to data subjects, its authorizations and the consents it must collect for its own purposes.

Current Operational Framework

Unless otherwise documented by the Customer's instructions and accepted by LEZO, or required by a legal obligation, dispute, evidentiary need, security or technical constraint, the following retention and deletion rules apply:

6. Sub-processors and Providers

The Customer authorizes LEZO to engage the following sub-processors for the entrusted processing operations:

LEZO imposes on each sub-processor, by contract or other legal act, the same data protection obligations as those set out in this addendum, in particular sufficient guarantees to implement appropriate technical and organizational measures. Where a sub-processor fails to fulfil its data protection obligations, LEZO remains fully liable to the Customer for the performance of that sub-processor's obligations.

LEZO informs the Customer in advance of any intended addition or replacement of a sub-processor for the entrusted processing operations, by any appropriate means, indicating the sub-processor concerned and the service entrusted. The Customer may object to that change on reasonable data protection grounds, within a reasonable period before it is implemented. Where the objection cannot be resolved between LEZO and the Customer, the Customer may terminate the Services affected by that change without penalty.

Registration payments are processed by Stripe on the Customer's connected account, under the contract entered into directly between the Customer and Stripe. Stripe, Apple, Google and the map providers act under their own terms and are not sub-processors of LEZO.

7. Transfers Outside the European Economic Area

LEZO favors processing and hosting within the European Union. The main SaaS infrastructure is operated in France. Some sub-processors or providers are nevertheless established outside the European Economic Area or belong to groups established there, in particular for anti-bot verification, distribution and updates of the mobile application, payment or mapping.

Where safeguards are required by applicable regulations, LEZO relies on the mechanisms provided for by the GDPR or on the safeguards provided by the relevant provider, in particular adequacy decisions, standard contractual clauses, supplementary measures or equivalent safeguards where applicable.

8. Security and Confidentiality

LEZO ensures that persons authorized to process personal data on behalf of the Customer have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

LEZO implements the technical and organizational measures required by Article 32 of the GDPR, appropriate to the service, the risks, the state of the art and the costs of implementation.

These measures include:

• access control to environments administered by LEZO
• limitation of access to persons or providers with a need to know
• encryption of communications by secure protocol where available
• logical separation of organizations and application access rights
• standard backups depending on the relevant infrastructure and service
• proportionate technical logging and monitoring of security events
• monitoring, error tracking and technical diagnostics
• reasonable maintenance, correction and update procedures
• deletion or anonymization measures according to the applicable features and technical constraints

Enhanced security audits, specific certifications, dedicated penetration tests, enhanced service levels, dedicated encryption, customer keys, on-call duty or qualified hosting requirements are included only if they are provided for by a separate written agreement.

9. Assistance with Data Subject Rights and Customer Obligations

Where LEZO receives a request to exercise rights concerning processing performed on behalf of the Customer, LEZO may forward that request to the Customer or invite the data subject to contact the Customer.

To the extent possible and reasonable given the nature of the processing and the information available, LEZO assists the Customer in responding to requests for access, rectification, erasure, restriction, objection, portability or withdrawal of consent relating to the entrusted processing operations, in particular by extracting a person's data, or by correcting or deleting data on the Customer's instructions.

Taking into account the nature of processing and the information available to it, LEZO assists the Customer in ensuring compliance with the obligations under Articles 32 to 36 of the GDPR, in particular for carrying out data protection impact assessments and, where applicable, prior consultation of the supervisory authority.

The Customer remains responsible for responding to data subjects where the processing falls within its purposes, its Quests, its content, its participants or its relationship with its own users.

10. Personal Data Breaches

LEZO informs the Customer as soon as possible after becoming aware of a personal data breach affecting processing operations performed on behalf of the Customer.

The information may include, where the elements are available:

• the nature of the breach
• the categories of data subjects and data concerned
• the likely consequences
• the measures taken or proposed to address the breach or mitigate its effects
• information useful for any notification to the supervisory authority or to data subjects

LEZO may provide this information in phases where not all elements are immediately available.

11. Return, Deletion and Backups

At the end of the Contract or the Subscription, Customer Data is deleted or anonymized under the conditions provided for by the Platform Terms, subject to returns requested in due time by the Customer and to retention required by Union or Member State law to which LEZO is subject. Backups are handled under the conditions below.

The Customer may request LEZO to return the available Customer Data before the effective end of the Contract or the Subscription. An owner or administrator of the organization may also delete the organization from the Application; where the organization is linked to a commercial history shared with another Customer, including an operating license, a license order or a registration payment, the deletion is handled by LEZO on request, and the data necessary for that history is retained under the conditions of the Platform Terms.

Persons with a named account may delete their account from the mobile application or the website, or by sending a request to support. This deletion dissociates the game history from the deleted account where retention of the history is necessary for the operation of rankings, results and proof of consent.

Residual backups are overwritten at the end of their rotation cycle. Until they are overwritten, they are not used for active processing of the data, except for a restoration required after an incident.

For the standard SaaS scenario, the operational target is active deletion or anonymization of Customer Data within thirty (30) days after the effective end of the Contract or the Subscription, with residual backups limited to a maximum of ninety (90) days where technically applicable.

12. Audit and Demonstration of Compliance

LEZO makes available to the Customer the information reasonably necessary to demonstrate compliance with the obligations set out in this addendum, within the limits of confidentiality, security, trade secrets, obligations towards other customers and the shared operation of the SaaS service.

LEZO allows for and contributes to audits, including on-site inspections, conducted by the Customer or by an auditor mandated by the Customer. The Customer gives LEZO reasonable prior notice. The auditor is bound by a confidentiality obligation. The terms of the audit are agreed in writing in advance in order to preserve security, confidentiality, service availability and the rights of other customers. Except in the event of a personal data breach affecting processing operations performed on behalf of the Customer, an audit may be carried out no more than once (1) a year. Document-based audits or reasonable questionnaires may be offered in the first instance for the shared SaaS offering.

13. Changes to this Addendum

LEZO may amend this addendum to reflect legal, technical, functional, contractual or operational developments of the SaaS Services. Substantial changes are brought to the Customer's attention according to the methods provided for by the Platform Terms or the Application.