Privacy Notice - Quiddio

This Privacy Notice explains how DataRiver OÜ (“Company”, “we”, “our” or “us”) processes your personal data when you visit our website or use our subscription‑based web application (the “Platform”). It fulfils our information duties under Articles 13 and 14 of the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”).

1. Data Controller

Legal entity	DataRiver OÜ
Registration number	1720102
Registered address	Harju maakond, Tallinn, Kesklinna linnaosa, Järvevana tee 9, 11314
Email	[email protected]

2. Personal Data We Process

Category	Examples	Source
Account Data	Name, email address, password, organisation, preferred language	Provided by you
Billing Data	Partial card details, billing address, VAT number, transaction ID	Provided by you / Stripe Payments Europe Ltd.
User‑Generated Content	Documents you upload (e.g. PDFs) and AI‑generated quizzes	Provided by you
Usage & Log Data	IP address, browser type, device ID, time‑stamps, feature usage	Collected automatically
Cookie & Similar Technologies	Session cookies, analytics cookies, marketing cookies (if consented)	Collected automatically
Support Data	Correspondence, screenshots, error reports	Provided by you

We do not intentionally process special categories of personal data (Art. 9 GDPR) unless you choose to include such data in the documents you upload. Please avoid uploading sensitive personal information.

3. Purposes & Legal Bases

Purpose	Legal basis (Art. 6 GDPR)
Create and maintain your account; provide subscription services	Art. 6 (1)(b) – contract performance
Process payments and invoicing	Art. 6 (1)(b) & (c) – contract & legal obligation
Generate quizzes from your uploaded documents	Art. 6 (1)(b) – contract performance
Provide customer support	Art. 6 (1)(b) – contract performance
Improve, test and secure the Platform	Art. 6 (1)(f) – legitimate interests (service quality & security)
Send service notifications (e.g. renewal, security)	Art. 6 (1)(b) – contract performance
Send marketing emails, newsletters or promotions	Art. 6 (1)(a) – consent (you may withdraw at any time)
Comply with accounting, tax and legal duties	Art. 6 (1)(c) – legal obligation

4. Automated Decision‑Making

We do not use automated decision‑making producing legal or similarly significant effects within the meaning of Article 22 GDPR.

5. Data Retention

Data type	Retention period
Account Data	For the life of your account + 90 days
Billing & Transaction Records	7 years (Estonian accounting laws)
User‑Generated Content	Until deleted by you or 30 days after subscription ends
Log & Usage Data	12 months
Marketing Consent Records	Until you withdraw consent + 2 years for audit

We may retain data longer where required by law or necessary for the establishment, exercise, or defence of legal claims.

6. Disclosure to Third Parties

We share personal data only when necessary for the purposes listed above:

Stripe Payments Europe, Ltd. – payment processing
Cloud hosting provider – data storage and application hosting (servers located in the EU/EEA)
Analytics provider (e.g. Plausible, Matomo, or EU‑hosted Google Analytics) – aggregated usage insights
Customer support tools (e.g. Intercom, Freshdesk) – ticket handling
Professional advisers (legal, accounting) where needed
Authorities or courts where required by law

All service providers act as our processors under written contracts in accordance with Article 28 GDPR.

7. International Transfers

Your personal data is primarily stored and processed within the European Economic Area (EEA). Where we transfer data outside the EEA (e.g. to sub‑processors in the USA), we rely on:

Adequacy decisions under Article 45 GDPR, or
Standard Contractual Clauses adopted by the European Commission under Article 46 GDPR, plus supplementary measures where necessary.

8. Security Measures

We apply appropriate technical and organisational measures, including encryption in transit and at rest, role‑based access controls, regular security audits, and incident response procedures.

9. Your Rights

Subject to legal conditions, you have the right to:

Access your personal data (Art. 15 GDPR)
Rectify inaccurate or incomplete data (Art. 16)
Erase data (“right to be forgotten”) (Art. 17)
Restrict processing (Art. 18)
Data portability (Art. 20)
Object to processing based on legitimate interests (Art. 21)
Withdraw consent at any time (Art. 7(3)); withdrawal does not affect prior lawful processing.

To exercise your rights, contact us using the details in Section 1. We will respond within one month or inform you of any extension.

10. Complaints

If you believe we are processing your personal data unlawfully, please send us an email to [email protected]

11. Cookies & Similar Technologies

We use cookies to:

Keep you logged in (strictly necessary)
Collect anonymised analytics (legitimate interests)
Serve personalised marketing (consent)

You can manage cookie preferences via our Cookie Banner or by adjusting browser settings. For details, see our separate Cookie Policy.

12. Children

The Platform is not directed at children under 18. We do not knowingly collect personal data from children. If you are a parent or guardian and believe your child has provided us with personal data, please contact us.

13. Changes to This Notice

We may update this Privacy Notice from time to time. We will post the revised version with a new “Last updated” date and, where material, notify you via email or Platform message at least 14 days before changes take effect.

14. Contact

For privacy questions, data‑subject requests, or to obtain our Data Processing Agreement (DPA), contact:

DataRiver OÜ
Attn: Data Protection
Harju maakond, Tallinn, Kesklinna linnaosa, Järvevana tee 9, 11314
Email: [email protected]