Last updated 13 March 2026
Privacy Policy
This is a courtesy translation. In case of any discrepancy, the Italian version prevails.
This Privacy Policy describes how Design Quiz by caffè design ("we", "our") collects, uses and protects your personal data when you use our platform at caffe.design/quizzone (the "Service"). We are committed to complying with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and Italian privacy law.
1. Data Controller
The Data Controller under the GDPR is:
DVERSO STUDIO SRLVia Filippo Argelati 44
20143 Milano (MI), Italy
VAT no. IT12425550964
Email: info@dverso.io
2. Data We Collect
2.1 Account and Profile Data
When you sign in with Google, we receive and store:
- Email address – used to identify your account
- First and last name – shown on your profile and on the leaderboard
- Profile picture – downloaded from Google and stored on our servers; you can replace it with a custom picture
- Google account identifier – used internally to link your Google account to your Design Quiz account
You can update your first name, last name and profile picture at any time from your profile page.
2.2 Usage and Quiz Data
- Quiz answers and scores – the answers you submit, your score percentage and your response times
- Experience points log – a record of every experience point transaction (quiz completions, bonuses)
- Quiz completion history – which quizzes you have completed, when, and your best performances
2.3 Anonymous Session Data
If you use the Service without logging in, we assign you a temporary anonymous identifier (a UUID) stored in your encrypted session cookie. This identifier is used solely to track quiz progress within a single session and cannot be linked to your identity. It is deleted when the session expires.
2.4 Technical and Diagnostic Data
We and our service providers automatically collect:
- IP address, browser type, operating system, device type
- Pages visited, timestamps and interactions (clicks, scrolling)
- Aggregate traffic and performance metrics through Cloudflare Analytics and Google Analytics
2.5 Feedback
If you send feedback through the platform, we store the text of the message and associate it with your account.
3. How We Use Your Data
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Creating and managing your account | Art. 6(1)(b) – performance of a contract |
| Displaying your profile, avatar and leaderboard position | Art. 6(1)(b) – performance of a contract |
| Recording quiz answers and awarding experience points | Art. 6(1)(b) – performance of a contract |
| Session security and fraud prevention (encrypted session cookie) | Art. 6(1)(f) – legitimate interest |
| Platform analytics and performance monitoring (Cloudflare, Google Analytics) | Art. 6(1)(a) – consent (via the cookie banner) and Art. 6(1)(f) – legitimate interest for aggregate/anonymised data |
| Responding to feedback and support requests | Art. 6(1)(f) – legitimate interest |
| Handling data access or erasure requests | Art. 6(1)(c) – legal obligation |
4. Cookies and Tracking Technologies
For detailed information on the cookies we use, see our Cookie Policy.
4.1 Strictly Necessary Cookies
We use an encrypted, HTTP-only session cookie to keep you logged in and protect your quiz sessions. This cookie expires after 7 days and is strictly necessary for the Service to work; it does not require your consent.
4.2 Analytics and Tracking Cookies
With your consent, we use:
- Google Analytics – collects anonymised behavioural data (page views, session duration, traffic source). The data is processed by Google LLC in the United States under Standard Contractual Clauses.
- Cloudflare Analytics – privacy-friendly traffic analysis processed by Cloudflare Inc. (USA). Cloudflare does not use cookies for its core analytics product.
You can withdraw your consent at any time through the cookie banner or your browser settings.
5. Third-Party Service Providers
We share your data with the following data processors, each bound by a Data Processing Agreement or equivalent safeguards:
| Provider | Purpose | Transfer basis |
|---|---|---|
| Google LLC (Google OAuth) | Authentication | Standard Contractual Clauses (SCCs) |
| Google LLC (Google Analytics) | Analytics | SCCs + consent |
| Cloudflare Inc. | Hosting, CDN, DDoS protection, analytics | SCCs |
| Google Cloud (Google LLC) | Database hosting | Servers in the EU – no transfer outside the EU |
| Hetzner Online GmbH | Application hosting (Directus CMS) | Servers in Germany (EU) – no transfer outside the EU |
| Cloudflare R2 | Storage of avatars and media files | SCCs |
We do not sell your personal data to third parties.
6. Data Retention
| Type of data | Retention period |
|---|---|
| Account profile (name, email, avatar) | Until the account is deleted |
| Quiz log and experience points history | Until the account is deleted |
| Feedback messages | Until the account is deleted or the matter is resolved, max 2 years |
| Session cookie | 7 days (or until logout) |
| Temporary quiz session data | From 1 to 24 hours |
| Google Analytics data | 14 months |
| Data access/erasure requests | 3 years (legal obligation) |
7. Your Rights under the GDPR
As a data subject in the EU/EEA, you have the following rights:
- Right of access (Art. 15) – request a copy of all the personal data we hold about you. Use the "Request your data" button in your profile settings.
- Right to rectification (Art. 16) – correct inaccurate data directly from your profile page.
- Right to erasure (Art. 17) – permanently delete your account and all associated data. Use the "Delete your account" button in your profile settings.
- Right to restriction of processing (Art. 18) – request that the processing of your data be restricted in certain circumstances.
- Right to data portability (Art. 20) – receive your data in a structured, machine-readable format.
- Right to object (Art. 21) – object to processing based on legitimate interest, including profiling.
- Right to withdraw consent – withdraw your consent to analytics/tracking at any time through the cookie banner.
To exercise any of these rights, contact us at info@dverso.io. We will respond within 30 days. You also have the right to lodge a complaint with the Garante per la protezione dei dati personali (the Italian Data Protection Authority): garanteprivacy.it.
8. International Data Transfers
Some of our service providers are based in the United States (Google, Cloudflare). Transfers to these providers are protected by Standard Contractual Clauses (SCCs) approved by the European Commission under Art. 46(2)(c) GDPR. You can request a copy of the applicable SCCs by contacting us.
9. Minors
The Service is not intended for minors under the age of 16. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, contact us immediately and we will delete it.
10. Security
We adopt appropriate technical and organisational measures to protect your personal data, in line with Art. 32 GDPR. We use HTTPS transport encryption and appropriate authentication and authorisation mechanisms on our systems.
11. Changes to This Policy
We may update this Privacy Policy from time to time. In the event of significant changes, we will notify you through a notice on the Service or by email. The "Last updated" date at the top of the page reflects the most recent revision. Continued use of the Service after the changes constitutes acceptance of the updated policy.
12. Contact
For any privacy-related question or request, contact:
info@dverso.io
