This section supplements the general Policy for Users in the European Economic Area (including EU member states) and the United Kingdom. In the event of any conflict, this section prevails for such Users.

19.1 Lawful Bases (GDPR Art. 6)

All processing activities have an identified lawful basis as set out in §6. The Controller does not rely on "continued use as implied consent" for any processing activity. Consent-based processing (marketing, profiling beyond legitimate interests) requires a separate, freely given, specific, and revocable opt-in.

19.2 Rights Under GDPR (Arts. 15–22)

• Art. 15 — Right of Access: Request a copy of your personal data within 1 month;
• Art. 16 — Right to Rectification: Correct inaccurate personal data;
• Art. 17 — Right to Erasure ("Right to be Forgotten"): Deletion where no overriding legitimate interest or legal obligation exists;
• Art. 18 — Right to Restriction: Limit processing pending verification of accuracy or legitimate grounds;
• Art. 20 — Right to Data Portability: Receive data in JSON/CSV format where technically feasible;
• Art. 21 — Right to Object: Object to processing based on Art. 6(1)(f) legitimate interests at any time — we will cease unless compelling legitimate grounds override your interests;
• Art. 22 — Rights re. Automated Decision-Making: You are not subject to purely automated decisions with legal effect without human review, except where you have given explicit consent or it is necessary for a contract;
• Art. 7(3) — Withdrawal of Consent: Withdraw consent at any time without affecting prior lawful processing.

19.3 Lead Capture — GDPR Compliance

Lead capture forms where a consent notice is configured present a separate, unticked checkbox. Consent is purpose-specific and documented with a timestamp. Withdrawal is available at any time per §7 and §11.

19.4 International Transfers (EU)

Transfers of EU personal data outside the EEA rely on SCCs, adequacy decisions, or derogations per GDPR Art. 49 as appropriate (see §9).

19.5 Supervisory Authority

EU/EEA Data Subjects have the right to lodge a complaint with the supervisory authority in their EU member state of habitual residence or place of work. UK Data Subjects may complain to the Information Commissioner's Office (ICO): ico.org.uk, Tel: +44 303 123 1113.

This section applies to California residents under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).

20.1 Categories of Personal Information Collected

In the preceding 12 months we have collected: identifiers (name, email, IP address); internet/network activity (usage data, event logs); geolocation data (inferred from IP); inferences drawn from the above (behavioural profiles). We do not collect sensitive personal information as defined by CPRA without explicit opt-in consent.

20.2 Categories of Sources

Directly from consumers (registration, lead forms, game participation) and automatically (device/network data during platform use).

20.3 Business or Commercial Purpose

Service provision, security, analytics, marketing (only with consent), and legitimate business operations.

20.4 Categories of Third Parties with Whom PI is Shared

Infrastructure subprocessors, quiz hosts (for their event data), legal advisers, law enforcement (when required), business transaction counterparties. We do not sell personal information as defined by CCPA.

20.5 Your CCPA/CPRA Rights

• Right to Know (§1798.110): Request disclosure of categories and specific pieces of personal information collected;
• Right to Delete (§1798.105): Request deletion subject to legal exceptions;
• Right to Correct (§1798.106, CPRA): Request correction of inaccurate personal information;
• Right to Opt-Out of Sale/Sharing (§1798.120): We do not sell PI. Behavioural data shared with analytics partners is based on legitimate interests; you may opt out by emailing us or visiting /unsubscribe;
• Right to Limit Use of Sensitive PI (CPRA): Sensitive PI is not collected beyond service necessity;
• Right to Non-Discrimination (§1798.125): We will not discriminate against you for exercising CCPA/CPRA rights — no denial of service, price differences, or reduced quality;
• Right to Opt-Out of Automated Decision-Making (CPRA): Contact us to opt out of profiling with significant effects.

20.6 How to Submit a CCPA Request

Email finunigpt@gmail.com with subject "CCPA Request — [Right]." We respond within 45 calendar days (extendable by 45 days with notice). Requests may be submitted on behalf of a minor child by a parent or guardian.

20.7 Authorised Agent

You may designate an authorised agent to submit requests on your behalf. We will require written authorisation and may verify your identity directly.

This section applies to citizens and residents of the Russian Federation and supplements the general Policy in accordance with Federal Law No. 152-FZ "On Personal Data" (as amended).

21.1 Operator Identity

The operator (оператор персональных данных) for the purposes of FZ-152 is Prazdnik.top. Contact: finunigpt@gmail.com.

21.2 Purpose Limitation

Personal data of Russian citizens is processed strictly for the purposes stated in this Policy: provision of quiz services, security, and (with separate consent) direct marketing. Processing is not carried out for any purposes incompatible with those stated.

21.3 Data Localisation

In accordance with FZ-152 Art. 18.1, the Data Controller acknowledges the requirement to record, systematise, accumulate, store, clarify (update, modify), and retrieve Personal Data of Russian citizens using databases located within the Russian Federation when such data is initially collected. The Controller takes reasonable steps to comply with this requirement for Russian citizens' registration data. Where full compliance is not immediately achievable due to technical infrastructure constraints, the Controller commits to transitioning to compliant infrastructure as technically feasible and notifying Roskomnadzor in accordance with applicable requirements.

21.4 Cross-Border Transfer

Cross-border transfer of personal data of Russian citizens is conducted in accordance with FZ-152 Art. 12. Prior to cross-border transfer, the Controller ensures that the receiving country provides adequate protection of personal data rights, or obtains written consent of the data subject for the transfer.

21.5 Rights of Russian Data Subjects

Citizens of the Russian Federation have the right to: access their personal data; request correction of inaccurate data; request withdrawal of consent and cessation of processing; request deletion of personal data; lodge complaints with Roskomnadzor (rkn.gov.ru). Requests are processed within the timeframes required by FZ-152 (as a rule, within 30 days).

21.6 Consent

Consent for processing personal data of Russian citizens for marketing purposes is obtained separately via an affirmative checkbox at registration. Consent may be withdrawn at any time by contacting finunigpt@gmail.com.

All commercial email communications sent by Prazdnik.top comply with the CAN-SPAM Act of 2003 (US), GDPR (EU/UK), and the Privacy and Electronic Communications Regulations (PECR) (UK):

• Opt-in required: Marketing emails are only sent to users who have explicitly opted in via the marketing consent checkbox at registration or another affirmative mechanism;
• Sender identification: All marketing emails clearly identify Prazdnik.top as the sender in the "From" field;
• Subject line accuracy: Subject lines accurately reflect the email content — no deceptive headers;
• Unsubscribe mechanism: Every marketing email contains a clear, working unsubscribe link (one-click opt-out at /unsubscribe) and the option to reply "UNSUBSCRIBE";
• Opt-out honoured within 10 business days: Unsubscribe requests are processed within 10 business days and the user will not receive further commercial emails after that period;
• No sale of unsubscribed addresses: Email addresses on the opt-out list will not be transferred or sold to third parties for marketing purposes;
• Physical address: Correspondence address: Prazdnik.top, contact via finunigpt@gmail.com.

Transactional emails (password resets, account security alerts, game invitations) are not subject to the opt-in requirement and will be sent regardless of marketing consent.

23.1 Age Restriction

The Platform is not directed at children under 13 (US) or under 16 (EU/EEA/UK) years of age. Users must be of the applicable age of digital consent in their jurisdiction to register an account. The registration form does not knowingly collect data from underage users. If we discover that a child under 13 (US) or under 16 (EU) has provided personal information without appropriate parental consent, we will delete it immediately.

23.2 Educational Use — Host Responsibilities

Quiz hosts who operate the Platform for educational purposes involving minors take on the following obligations:

• Obtain and maintain documented parental/guardian consent for all minor participants before enabling their participation;
• Ensure lead capture forms are not enabled for sessions involving minors unless parental consent specifically covers lead data collection;
• Provide participants and their parents with notice of data collection and the terms of this Policy;
• Comply with COPPA (if serving US children under 13), GDPR Art. 8 (if serving EU/EEA/UK children under 16), and any other applicable child-protection legislation.

Host liability: Hosts who fail to obtain appropriate parental consent for minor participants assume full legal liability for any resulting violations of COPPA, GDPR Art. 8, or equivalent laws. Prazdnik.top is not liable for host failures to secure such consent.

23.3 Parental Rights

Parents or guardians of a child may: review personal information collected from their child; request deletion of that information; refuse further collection; and withdraw consent at any time. Requests should be directed to finunigpt@gmail.com with subject "Parental/Guardian Data Request."

The Platform uses browser localStorage (not HTTP cookies) for session management. A cookie/storage consent notice is displayed on first visit to all public-facing pages. Users may dismiss the notice or clear their browser's localStorage at any time.

24.1 Strictly Necessary Storage (no consent required)

Authentication tokens (qf_jwt), user profile cache (qf_user), and session continuation tokens (qf_session_*) are strictly necessary for the service to function. These cannot be disabled without preventing use of the service.

24.2 Functional Storage (consent or legitimate interests)

Language preference (qf_lang) and cookie notice dismissal (pp_cookie_accept) are functional and improve the user experience. Legal basis: legitimate interests (minimal privacy impact, clearly beneficial to users).

24.3 No Third-Party Tracking

No analytics cookies, advertising pixels, or social media tracking tags are currently deployed. The Platform does not use Google Analytics, Facebook Pixel, or equivalent third-party trackers. If this changes, users will be notified and new consent obtained.

24.4 How to Withdraw

Clear your browser's localStorage via: Browser → Developer Tools → Application → Local Storage → Clear All. Note: this will log you out of all active sessions.

The Data Controller engages the following categories of subprocessors that may process personal data on our behalf. All subprocessors are bound by data processing agreements that include GDPR-compliant protections where applicable.

For a current list of named subprocessors, or to request Data Processing Agreement (DPA) documentation, contact finunigpt@gmail.com. Subprocessors are reviewed periodically; updates are reflected in this Policy.

In accordance with GDPR Art. 35, the Data Controller has conducted a Data Protection Impact Assessment for the following high-risk processing activities:

26.1 Automated Profiling and Behavioural Analysis

Activity: Systematic profiling of users based on game participation and interaction patterns to create engagement scores and behavioural profiles.

Risks identified: Potential for inaccurate scoring affecting user treatment; risk of re-identification from combined datasets.

Mitigations applied: Profiles are used for product improvement and aggregated analytics only — not for decisions with legal effect on individuals; anonymisation applied before commercial use; aggregation thresholds prevent individual re-identification; users retain the right to object per GDPR Art. 21.

DPIA Outcome: Processing is proportionate and necessary; risks are adequately mitigated. A supervisory authority consultation (GDPR Art. 36) is not required.

26.2 Lead Capture Data Processing

Activity: Collection of detailed contact information from event participants through lead capture forms.

Risks identified: Broad consent scope; potential for unanticipated downstream use by hosts.

Mitigations applied: Separate per-form consent checkbox; purpose-specific consent text; 5-year retention limit; deletion on request; host contractual obligations.

DPIA Outcome: Processing lawful with mitigations; no Art. 36 consultation required.

For each processing activity relying on legitimate interests, the Data Controller has applied the three-part test: (1) Purpose test — is the interest legitimate? (2) Necessity test — is processing necessary? (3) Balancing test — do the Controller's interests override Data Subject interests?