klapp Sign in Join a game Start a game

Data processing terms · last updated 17 October 2026

When the data belongs to your organisation.

These terms

These terms apply when an organisation uses klapp Q&A and is the controller of personal data in the material its host uploads or in the questions its audience sends, and when an organisation takes registrations for an event in klapp. They are the contract Article 28(3) of the GDPR requires between a controller and a processor. They form part of the terms for that use.

Controller: the organisation the host acts for ("you").

Processor: Cadence AS, organisation number 912 024 652, Svaneviksveien 13, 5063 Bergen, Norway ("we"). Contact: hello@playklapp.com.

For everything else klapp does (sign-in, payment, logs, the quiz), Cadence AS is the controller, and privacy applies. A host who runs a Q&A as a private person has no controller duties, and these terms do not apply to that Q&A. Only an organisation with an organisation number can take registrations, so these terms always apply to registrations.

1. What is processed

Q&A

  • Subject matter. Drafting answer suggestions to questions from an audience during one event, from material the host has chosen.
  • Duration. From the host adds material until the event ends. The material and the questions are held in memory only and are deleted when the host ends the Q&A, after six hours at the latest, or when the server restarts.
  • Nature and purpose. Receiving, holding in memory, sending to the language model, and showing the result to the host. No other purpose.
  • Personal data. Whatever the material and the questions contain. klapp does not ask for any. Audience members are not asked for a name, and questions are not linked to a person.
  • Data subjects. People named or described in the material or in a question.
  • Special categories. You must not upload material that contains special categories of personal data (Article 9) or data about criminal convictions (Article 10). The service is not built for it.

Registrations

  • Subject matter. Taking registrations for your event, sending the ticket, sign-in links, changes and word of a cancellation by e-mail, and showing you the list of who registered.
  • Duration. From the first registration. Names and e-mail addresses are deleted 30 days after the last day of the event, and the rest 180 days after it. If someone cancels their registration, their name and e-mail address are deleted at once.
  • Nature and purpose. Storing, sending e-mail, showing the list and letting you download it. No other purpose. We never use the list for our own marketing.
  • Personal data. Name, e-mail address, ticket type, status, and when the registration was made, the ticket was sent and the person first signed in.
  • Data subjects. The people who register.
  • Special categories. You must not use registration where taking part in the event in itself reveals health, religious belief, trade union membership or other data under Article 9, unless you have a basis under Article 9(2).

2. Our obligations

  1. Instructions. We process the data only on your documented instructions. The instructions are these terms and what the host does in the service: adding or removing material, opening and ending the Q&A, and opening and closing registration, downloading the list and cancelling the event. If Norwegian or EEA law requires us to process the data in another way, we tell you first, unless that law forbids it.
  2. Confidentiality. Everyone who can access the data on our side is bound by a duty of confidentiality.
  3. Security. We take the measures Article 32 requires. For Q&A, the data is held in memory only, is never written to disk or to the log, is sent over TLS, and is reachable only with the host's key for that session. Location data and other metadata are removed from uploaded files before anything is sent on. Registrations are stored in Microsoft Azure Storage in Norway East, encrypted at rest, one file per registration. They can be reached only with your sign-in and never through the log. Sign-in links are stored only as a hash.
  4. Sub-processors. You give us a general authorisation to use the sub-processors in section 3. We tell you at least 14 days before we add or replace one, by updating subprocessors and, if you have given us an address for it, by e-mail. You can object within that time. If we cannot meet the objection, you can stop using the service and get back what you paid for an event that has not been held. We put the same data protection duties on each sub-processor as these terms put on us, and we answer to you for what they do.
  5. Rights of data subjects. We help you answer requests from data subjects as far as the service allows. In practice: the data is deleted when the event ends, and we cannot search it afterwards. For registrations: you can download the list before it is deleted, and after that there is nothing to return. If someone who registered asks for access or deletion, we help you answer, and you can ask us to delete a single registration before the deadline.
  6. Help with your duties. We help you with security, breach notification, impact assessments and prior consultation (Articles 32 to 36), with the information we have.
  7. Breach. We tell you without undue delay, and within 48 hours, after we become aware of a personal data breach that concerns your data.
  8. Deletion. The data is deleted when the event ends, as described in section 1. There is nothing to return. Sub-processors delete on their own schedule: see section 3. For registrations: names and e-mail addresses are deleted 30 days after the last day of the event, and the rest 180 days after it, as described in section 1. Download the list before then if you need it. On request, we confirm in writing that the data has been deleted.
  9. Audit. We give you the information you need to show that Article 28 is met, and we allow and contribute to audits, including inspections, by you or an auditor you appoint. An audit is announced 30 days ahead, happens at most once a year unless there has been a breach, and you bear your own costs.
  10. Unlawful instructions. We tell you at once if we think an instruction breaks the GDPR or other data protection law.

3. Sub-processors

Anthropic Ireland Limited, with Anthropic, PBC and Anthropic's own sub-processors. The language model that drafts the answer suggestions. It receives the pages the host kept, the topics the host blocked and each question. Where: the United States, and cloud providers Anthropic lists as worldwide. How long: Anthropic says it deletes inputs and outputs within 30 days. A request its safety systems flag may be kept for up to two years.

Microsoft Azure (Microsoft Ireland Operations Limited). Hosts the service. The data passes through its network and is held in the memory of a server. Where: Norway East. How long: not stored.

For registrations, only Microsoft Azure. It stores the registrations in Norway East and sends the e-mails, with the e-mail data kept at rest in Norway. How long: as in section 1. Anthropic never receives registrations, and none of them leave the EEA.

Transfers out of the EEA. The transfer to Anthropic in the United States rests on the EU standard contractual clauses in Anthropic's data processing addendum. Your general authorisation in section 2 point 4 covers it. We have assessed the transfer in a written transfer impact assessment, and you can have it on request at hello@playklapp.com.

4. Liability and term

The limitation of liability in the terms applies between you and us under these terms as well. It does not limit what either of us owes a data subject under Article 82 of the GDPR, or a fine either of us is given.

These terms apply for as long as we process data for you, and end when the data is deleted. If these terms and the terms say different things about personal data, these terms apply.

Type a topic. Wake the room.

Start a game →