Contents
1. Who are we?
The controller responsible for the processing of your personal data via kwishetwel.com is:
De Bie Digital
Represented by: Roy de Bie and Thomas van der Pas
Address: Burgemeester van de Venstraat 20, Haaren
Netherlands Chamber of Commerce (KvK) number: 95114459
Email: roy@debiedigital.nl
Website: www.kwishetwel.com
We process personal data in accordance with the General Data Protection Regulation (GDPR) and the Dutch GDPR Implementation Act (UAVG).
2. Which personal data do we process?
2.1 Data of subscribers (customers)
If you take out a subscription to Kwishetwel, we process:
- First and last name
- Email address
- Payment details (via our payment provider Stripe; we do not store full payment details ourselves)
- Billing address (where applicable)
- Subscription and transaction history
2.2 Data of players (end users in the quiz app)
Players who join a Kwishetwel session can provide the following data:
- First name or nickname (required to participate)
- Profile photo (voluntary, taken or uploaded by the player)
We expressly ask players not to upload sensitive personal data as a profile photo. Uploaded images are used solely for display during the quiz session.
2.3 Technical and usage data
When you use our website and app, some technical data is processed automatically, such as:
- IP address (briefly, for security and abuse prevention)
- Browser type and version
- Device type and operating system
- Time of the request
- A temporary session and reconnection ID (see section 5)
- The country a signup came from (see below)
When an account is created we derive only the country from the IP address and store it with the account, so that we know where our users come from. We do not keep the IP address itself for this, and the lookup happens on our own server using a country database shipped with the app: no IP address is sent to another party. We keep the country for as long as the account exists and it is included in your data export (see section 9).
We also store with the account how you found us: the website you came from (only the domain name, for example a search engine), the page you first landed on and any label in the link (such as the QR code on the end screen of a quiz or a campaign link). Until you create an account, your browser keeps this in local storage; it is not sent to other parties. We keep it for as long as the account exists and it is included in your data export.
Beyond that, we measure pages visited, time spent on the site and click behavior with PostHog and Google Analytics. Without your consent, this only happens with PostHog and without cookies: we count visits anonymously and do not link them to you or your account. Only after you give consent do we measure with cookies, does Google Analytics load, and do we link what you do in the app as a logged-in user to your account (see sections 5.2 and 5.3).
2.4 Personal data in content created by the customer
Customers with a subscription that allows it can create their own quiz rounds and questions and share them privately with their own group (see article 10 of our terms and conditions). To the extent that a customer processes personal data of others in that self-created content (for example, questions about people within their own group), the customer is the controller for that processing. De Bie Digital only stores this content and displays it as part of the service, does not moderate it, and is not the controller for it. The customer is responsible for having a valid legal basis and for informing the data subjects where the law requires this.
2.5 Newsletter and contact form
If you sign up for our newsletter, through the form on the website or with the switch when creating an account, we process your email address. If you use the contact form, we process your name, your email address, and the contents of your message.
3. For which purposes do we process your data?
We only process personal data for specified, explicitly described, and legitimate purposes:
- Performance of the agreement (subscription, billing, customer service). Legal basis: performance of a contract (Article 6(1)(b) GDPR).
- Display of name and profile photo during a quiz session. Legal basis: performance of a contract or legitimate interest (Article 6(1)(b)/(f) GDPR).
- Improvement of our services based on anonymized usage data. Legal basis: legitimate interest (Article 6(1)(f) GDPR).
- Anonymous visitor statistics without cookies via PostHog (number of visits, pages, time on the site). Legal basis: legitimate interest (Article 6(1)(f) GDPR).
- Website analytics with cookies via Google Analytics and PostHog, including linking your use of the app to your account. Legal basis: consent (Article 6(1)(a) GDPR).
- Sending our newsletter after you sign up. Legal basis: consent (Article 6(1)(a) GDPR); you can unsubscribe at any time via the link in every newsletter.
- Answering questions and messages sent via the contact form. Legal basis: legitimate interest (Article 6(1)(f) GDPR).
- Compliance with legal obligations (for example, tax records). Legal basis: legal obligation (Article 6(1)(c) GDPR).
4. How long do we keep your data?
We do not keep personal data longer than necessary for the purposes for which it was collected:
- Player data (name/nickname, profile photo): finished and abandoned quiz sessions are cleaned up automatically (by default about 30 days after the session has ended); the associated profile photos are then also deleted from our storage.
- Subscriber account data: for as long as the subscription is active, plus a maximum of 12 months afterwards to comply with legal obligations and handle any remaining questions.
- Financial data (invoices, transactions): 7 years, in accordance with the Dutch tax retention obligation (Article 52 of the Dutch General Tax Act (AWR)).
- Website analytics data (Google Analytics): a maximum of 14 months.
- Product analytics data (PostHog): a maximum of 12 months.
- Server and access logs: a maximum of 90 days, solely for security and troubleshooting.
- Newsletter signups: until you unsubscribe. Contact-form messages are kept as long as needed to handle your question.
5. Cookies and sessions
5.1 Functional storage
We use functional storage that is strictly necessary for the operation of the website and app, such as remembering your login status, your quiz session and reconnection, and your theme preference. No consent is required for this. In addition, your browser keeps in local storage how you arrived at our site, until you create an account (see section 2.3). That stays with us and is not sent to other parties.
5.2 Analytics cookies (Google Analytics)
With your consent, we use Google Analytics 4 (GA4) to gain insight into how our website is used. We have taken the following measures:
- IP anonymization is enabled.
- Data is not shared with other Google services for advertising purposes.
- The retention period in Analytics is set to a maximum of 14 months.
Google Analytics only loads after you have given consent via our cookie banner. You can change your choice at any time: .
5.3 Product analytics (PostHog)
We use PostHog (EU cloud, servers in Frankfurt) to see how the website and app are used: which pages you visit, for how long, and which buttons you click. We do not measure what you type into forms. There are two modes:
- Without consent, PostHog sets no cookies and stores nothing on your device. Your visit is counted through an anonymous code that PostHog creates on its servers from, among other things, your IP address and browser type, using a key that changes every day and is then deleted. This lets us count visits without recognizing you.
- With consent ("Accept all"), PostHog keeps an identifier in your browser so we recognize returning visits. If you are logged in, we link your use to your account ID (not your email address), so we can see how customers use the app and where they get stuck.
We do not make screen recordings. You can change your choice at any time: .
5.4 Marketing and tracking cookies
We currently do not use any marketing or advertising cookies. Should we use them in the future, this will only happen after your explicit consent via the cookie banner.
6. Payments via Stripe
We use Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland), a PCI DSS-certified payment service provider, to process payments.
Your payment details (such as card number, expiration date, and CVC) are never stored on our servers but are processed directly by Stripe, in accordance with their privacy policy at stripe.com/nl/privacy. From Stripe, we only receive a payment confirmation and a transaction ID, together with the data we need for our records (name, amount, date).
7. Sharing data with third parties
We never sell your personal data. We only share data in the following cases:
With processors that provide services on our behalf and with whom we conclude data processing agreements:
- Stripe - payments.
- Resend - sending emails (such as a verification code) and managing our newsletter list (your email address after signup).
- DigitalOcean - hosting and storage of any profile photos.
- Sentry - detecting technical errors.
- Google - Google Analytics, only after your consent.
- PostHog - product analytics (servers in the EU): without cookies, or with cookies after your consent.
In addition, we share data with competent authorities if we are legally required to do so.
We do not transfer personal data to countries outside the European Economic Area (EEA) unless appropriate safeguards are in place (such as the European Commission's standard contractual clauses). Stripe, Sentry, Google, and PostHog may process data outside the EEA; these parties use approved transfer mechanisms.
8. Security of your data
We take appropriate technical and organizational measures to protect your personal data against loss, theft, or unauthorized access, including:
- Encrypted connections (HTTPS/TLS) for all data communication.
- Encrypted storage of passwords (bcrypt) and email verification at registration.
- Restricted access to personal data on a need-to-know basis.
- Regular backups and security checks.
In the event of a data breach that is likely to pose a risk to your rights and freedoms, we will report it within 72 hours to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and, if the breach poses a high risk, also to you personally.
9. Your rights
Under the GDPR, you have the following rights with regard to your personal data:
- Right of access (Article 15 GDPR): you can request which data we process about you.
- Right to rectification (Article 16 GDPR): you can have incorrect data corrected.
- Right to erasure (Article 17 GDPR): you can request that your data be deleted (the 'right to be forgotten').
- Right to restriction of processing (Article 18 GDPR).
- Right to data portability (Article 20 GDPR): you can request your data in a machine-readable format.
- Right to object (Article 21 GDPR) to processing based on legitimate interest.
- Right to withdraw consent (Article 7(3) GDPR), without affecting the lawfulness of the processing carried out before the withdrawal.
Subscribers can also download their data themselves and delete their account (with the associated data) via the account settings. For other requests, or if you are a player, email roy@debiedigital.nl. We respond within 30 days. We may ask you to verify your identity before we handle your request.
10. Complaints
Do you have a complaint about the way we handle your personal data? Please contact us first via roy@debiedigital.nl. We aim to resolve your complaint within 30 days.
You also have the right to lodge a complaint with the supervisory authority:
Autoriteit Persoonsgegevens (the Dutch Data Protection Authority)
Postbus 93374, 2509 AJ Den Haag
Telephone: 088 1805 250
Website: www.autoriteitpersoonsgegevens.nl
11. Changes to this privacy statement
We reserve the right to amend this privacy statement. Changes will be published on kwishetwel.com, stating the date of the most recent update. In the case of substantial changes that directly affect your rights, we will inform you proactively if we know your email address.
12. Contact
For questions, requests, or comments about this privacy statement or about the processing of your personal data, you can contact us via:
De Bie Digital
Roy de Bie and Thomas van der Pas
Burgemeester van de Venstraat 20, Haaren
Netherlands Chamber of Commerce (KvK) number: 95114459
Email: roy@debiedigital.nl
Website: www.kwishetwel.com
Our terms and conditions also apply to the use of Kwishetwel.