Data Processing Agreement (DPA)
Last updated: July 2026
This agreement applies when an organization (the controller) uses QuizJhor (the processor) to process participant data — names, roll/ID, answers, results, and the optional contact phone. It forms part of our Terms.
Parties
Processor: QuizJhor (কুইজঝড়) (legal entity details to be added)
Controller: The organization holding the QuizJhor workspace — they own the roster data and its lawful basis.
Nature of processing
Running live quizzes/assessments, producing results and merit lists, issuing certificates, and sending result SMS to nominated phones on the controller's instruction. We do not sell this data; quizzes, rosters, answers and results are never used for advertising.
Subprocessors
- Vercel — application hosting (Singapore region)
- Supabase — database & realtime (Singapore region)
- Resend — transactional email (login codes, receipts, result reports at the host's request)
- bKash / SSLCommerz — payments (card/wallet details never touch our servers)
- AI providers (Anthropic/OpenAI/OpenRouter — as configured) — quiz generation & voice transcription: host-supplied papers/audio are processed; not used for model training
- BulkSMSBD — result-SMS delivery
Security measures
Database-level lockdown (RLS enabled on every table, public/anon access revoked — re-applied automatically after every database change), per-organization scoped queries on the server, TLS encryption, hashed tokens/OTPs, role-based access. Privileged internal actions that modify customer data require fresh-OTP verification and a written reason; viewing customer data is also role-gated and is written to an audit log recording who viewed whose account and when. Details
Retention & deletion
Game/assessment data is deleted automatically after 90 days; expired codes and logs are pruned regularly. Verifiable certificates are long-lived (revocable on request). Account deletion is available with a 7-day cancellation window: /account/delete
Data-subject rights
Participants' access/correction/deletion requests go to the controller (the organization) first; we assist the controller. Requests to stop result SMS can also come directly to us.
Incident notification
On a confirmed security breach affecting participant data, we will notify affected organizations without undue delay, including impact and remediation.
Contact
If the Bangla and English texts differ, the Bangla text controls. This agreement is governed by the laws of Bangladesh.