Privacy policy

Data controller

Jimmy Cousseau, sole proprietor, 12 rue des Templiers, 39100 Dole, France, reachable at contact@lamaquest.com, is the controller of the processing described below.

On this website

• Contact form (name, e-mail, organisation, profile, expected number of players, message): to reply to you and, where applicable, draw up a quote. Legal basis: pre-contractual measures taken at your request, or legitimate interest in replying to messages received. Retention: at most three years after our last exchange.
• Server technical logs (IP address, page requested, date): for the security and proper operation of the website. Legal basis: legitimate interest. Retention: 30 days.
• Cookies: the website uses neither advertising cookies nor audience measurement. Only a strictly necessary language preference cookie may be set; it is exempt from consent.

In the application

• Organiser account (e-mail, display name, hashed password, optional avatar): creation and management of the account. Legal basis: performance of the contract.
• Google sign-in (Google account identifier, e-mail, name), if you choose this sign-in method. No other access to your Google account. Legal basis: performance of the contract.
• Taking part in a game (nickname, icon, score, answers, messages): real-time operation of the game. Legal basis: performance of the contract.
• GPS position, only during a game in progress, to unlock points and show your position to the organiser and, depending on the settings, to the other players. The route, thinned to about one point every ten metres, is used to calculate the distance covered and to replay movements. Legal basis: performance of the contract.
• Photos sent during a game (photo answers and challenges), whose rights of use are described in the terms of sale and use. Legal basis: performance of the contract.
• Payments (purchase history, Stripe customer identifier). Card details are processed exclusively by Stripe. Legal bases: performance of the contract and accounting obligations.
• Help and support (searches typed in the dashboard help, requests sent to support): to reply to you and improve the help. Support requests are passed on without your name or e-mail to the publisher’s incident tracking tool, hosted on its own servers. Legal basis: legitimate interest.
• Application technical logs (connections, errors, game actions): for security and troubleshooting. Legal basis: legitimate interest.

Retention periods

• Organiser account: until it is deleted, which is possible at any time, and at most two years after the last sign-in. An e-mail warns you two weeks before an inactive account is deleted.
• Real-time position: erased at the end of each game; routes: six months after the end of the game.
• Content of finished games (photos, messages, guest participants, logs): automatically deleted six months after the end of the game.
• Contact form messages: three years after the last exchange.
• Help searches: six months; support requests: until the account is deleted.
• Technical logs of the website and the application: 30 days.
• Payment records: ten years (accounting obligation).

Hosting and processors

The website and the application are hosted by the publisher, on his own servers located in France, which also send the e-mails. Strictly for the needs of the service, some data is processed by: Stripe (payments), Google (if you use Google sign-in) and Anthropic (automatic diagnosis of faults and support requests, on a text from which names, e-mail addresses and precise positions have been removed). When these processors are located outside the European Union, transfers are covered by appropriate safeguards (Data Privacy Framework or standard contractual clauses).

Your rights

You have the rights of access, rectification, erasure, portability, objection and restriction of processing. Deleting your organiser account is available directly in the application settings. For any other request, write to contact@lamaquest.com. You can also lodge a complaint with the CNIL (www.cnil.fr).

Minimum age

The service is not intended for persons under 16. No data concerning them is knowingly collected.

Security

Passwords are hashed, exchanges are encrypted (HTTPS) and published content is cleaned against injection. In the event of a data breach presenting a risk to your rights, the CNIL and, where applicable, the persons concerned are notified in accordance with articles 33 and 34 of the GDPR.