Feedback in GamesSign in

Data Processing Addendum

Effective and last updated: 22 July 2026

1. Scope

This Data Processing Addendum (the “DPA”) forms part of the Terms of Service or another agreement between Christos Sinopoulos SP, operating Feedback in Games (“Processor”), and the Customer (“Controller”). It applies when the Processor processes personal data in Customer Data on the Controller’s behalf. The Processor’s address is 21st Navarchou Kountouriotou, 54625 Thessaloniki, Greece.

Terms such as controller, processor, personal data, processing and supervisory authority have the meanings given by applicable data protection law, including the GDPR where it applies.

2. Processing details

  • Subject and duration: providing the Service for the term of the Customer relationship and the deletion period described below.
  • Nature and purpose: receiving, storing, organising, matching, displaying, analysing, translating and deleting data to deliver in-game surveys, responses, analytics, targeting and rewards.
  • Data subjects: players and end users of games operated or authorised by the Controller, plus individuals included in Customer-submitted content.
  • Data: Customer-supplied player identifiers, game and application versions, language, survey responses, timestamps, configured traits and events, reward status and related technical request data. The Controller determines which traits and content it submits.

3. Controller obligations

The Controller will:

  • process and instruct processing lawfully, fairly and transparently;
  • provide all required notices and obtain required permissions;
  • limit data to what is necessary for configured surveys and analytics;
  • avoid special-category, criminal-offence or children’s data unless it has confirmed a lawful basis and appropriate safeguards; and
  • configure retention, access and security appropriate to its use of the Service.

4. Processor obligations

The Processor will:

  • process personal data only on documented Controller instructions, including these Terms and normal Service configuration, unless law requires otherwise;
  • notify the Controller if an instruction appears to violate applicable data protection law;
  • ensure people authorised to process the data are bound by confidentiality;
  • maintain appropriate technical and organisational security measures;
  • reasonably assist with data-subject requests, security incidents, impact assessments and regulator consultations, considering the nature of processing and information available;
  • provide information reasonably necessary to demonstrate compliance; and
  • not sell Customer personal data or use it for unrelated advertising.

5. Security and incidents

Security measures include access control, authentication, encryption in transit, environment and secret separation, logging, backups, vulnerability maintenance and recovery procedures appropriate to the risk. The Processor regularly reviews these measures and may update them without materially reducing protection.

The Processor will notify the Controller without undue delay after confirming a personal-data breach affecting Customer Data and provide available information reasonably required for the Controller’s legal obligations. Notification is not an admission of fault or liability.

6. Subprocessors

The Controller generally authorises subprocessors needed to operate the Service, including infrastructure, hosting, email, analytics, translation and reward providers. Current key providers are described in the Privacy Policy. The Processor will require subprocessors to protect Customer personal data under obligations appropriate to their services and remains responsible for their processing to the extent required by law.

We will give reasonable notice of a new subprocessor that materially affects Customer Data. The Controller may object on reasonable data protection grounds. The parties will work in good faith on an alternative; if none is reasonably available, either party may end the affected Service.

7. International transfers

The Controller authorises transfers necessary to provide the Service. Where personal data is transferred from the EEA to a country without an adequacy decision, the parties will rely on a valid transfer mechanism, including the applicable European Commission standard contractual clauses, and supplementary safeguards where required.

8. Return and deletion

During the active relationship, the Service provides available export and deletion controls. After termination or a valid Controller instruction, the Processor will delete or return Customer personal data within a reasonable period, including deletion through normal backup cycles, unless law requires retention. Data retained by law remains protected and is used only for that legal purpose.

9. Audits

On reasonable written request, no more than once annually unless a breach or regulator requires otherwise, the Processor will provide relevant compliance information. If that is insufficient, the Controller may request an audit by an independent, qualified auditor bound by confidentiality. Audits must avoid unreasonable disruption and the Controller bears its costs unless the audit identifies a material Processor breach.

10. Priority and contact

If this DPA conflicts with the Terms on personal-data processing, this DPA controls. The remainder of the Terms continues to apply. Data-protection questions may be sent to support@octappush.com.