Privacy statement of Doen We!

• Play without an account. A team plays with a code. There is no account and no password, and players do not have to fill in a name or address.
• Location only during the trail. Your phone shares its location only if you allow it, and only while the trail is open.
• Photos gone after thirty days. Photos from tasks are stored in protected storage and are automatically deleted after thirty days, unless at the end of the trail you give permission to use your team photo on our website; according to Google, a copy at Google disappears after 55 days.
• No advertising, no resale. We sell nothing on, send no newsletter and use no advertising or tracking cookies.
• AI looks at what, not at who. AI assesses photos and takes part in the game. We never ask it to recognise anyone.

The website and the puzzle trails belong to Doen We!. We determine why and how your data is used; that makes us the controller under the General Data Protection Regulation (GDPR).

We do not have a data protection officer; we are not required to have one. Your email goes straight to the people who make the trails.

That depends on what you do. Below, per situation, what we receive and what for.

You visit the website

• With every page you open, our hosting provider Vercel sees your IP address, the type of browser and the page. That is needed to send the page and to recognise misuse. Vercel keeps those server logs for a short time.
• We count visits with Vercel Web Analytics and measure loading speed with Vercel Speed Insights. They place no cookies and build no profile: a visit is recognised by a code that expires after a day. We only see totals, such as how many people viewed a page or completed an order.
• Your browser fetches maps and some photos directly from other parties. They see your IP address and which piece of map your browser fetches; with a map of your surroundings they therefore know roughly where you are. Which parties those are is set out under ‘Who we share data with’.
• If you try the task for two phones, the phones talk to each other via Supabase. What you do there goes from phone to phone and is not stored anywhere.

You buy a code

• You pay in a Stripe payment window on our page. Stripe processes your payment details and, to recognise fraud, also looks at characteristics of your device and how you use the payment window. We do not see your full card or account number; we do see the payment method, your bank or the type of card, the last digits of your card or account number and, with iDEAL, the name of the account holder.
• From Stripe we receive your name, your email address and, if Stripe asks for it, your billing address, plus what you bought: which trail, how many teams, the amount and a payment reference. With that we create your code, send the confirmation and keep our accounts.
• We send the email with your code via Brevo. For a city battle, the game master key is in it too. We use your email address only for this order and the trail that goes with it: no newsletter, no advertising.

You withdraw from an order

If you withdraw from the contract via ‘Withdraw from contract here’, by email or by post, we keep your name, your email address or address, the code or order number and the time. We must be able to demonstrate that, and we send you a confirmation via Brevo. If you give a reason, we use it only to improve the trails and the site.

You request a quotation

In the form on the business page you enter your email address and the number of people, and if you wish your name, organisation, telephone number, place, date, game format and a message. We use that only to answer your request. The request is in our database and reaches us via Brevo.

You email us

If you email us with a question, a complaint or a request about your data, we keep your email address, your name if you give it, and what you write, with our reply. We use that only to help you. Your email arrives in our mailbox at mijn.host.

You play a trail

• You start with a code. Your phone then receives a random device code, no name or number, so that we know which phone uses which place and a code is not started more often than places have been bought. If you enter a wrong code, we count that per phone and per IP address, so that nobody can guess codes.
• During the trail we keep what you do in the game: the team name you choose, the answers, the hints, the points and times, messages to a character or to the game master, your feedback if you give it, and, for a dare challenge, the confirmation that the team is of age.
• After the trail we send the buyer one email with the look-back (recap) of all their teams: for each team the team name, the points, the honorary titles and a link to view and share it. With the team name you can also enter an email address of your own; it is pre-filled with the buyer's. If you enter a different address, that address receives an email with only the look-back of your own team.
• Preferably choose a team name without surnames: it appears on the scoreboard and in the report.
• If you play with several phones in one team, each extra phone passes a self-chosen name and its location via Supabase to the team's phone. That name can appear at the end of the trail and on the look-back, with what that phone did. We keep the location of those phones just like the team's route points: we erase it twelve months after the trail.
• We also use the course of the game to improve trails: we look at where teams get stuck, get lost or drop out, and we read the feedback. The administrators also have the course of the game analysed by Claude, an AI assistant from Anthropic. Claude receives the course per team under a number (team 1, team 2): what you typed, how you walked and what you did on the phone. Photos, team names and email addresses never go to Claude. The administrators can also have Claude check game codes and orders: the code, the trail, the number of tickets, the amount and the date, never the name or email address of the buyer.

You lead a city battle

With the game master key you open the game master room; your phone remembers the key for twelve hours. There you see the teams, their points and requests for help, and, if you are not playing yourself, their location. Every intervention, such as awarding points or pausing a team, appears with your explanation in the log that all teams read.

You manage the site

For administrators and editors we keep the email address and the login details. If an administrator opens players' photos, we record who did so, when and from which IP address.

• Many trails use your phone's location: for warm and cold, to see whether you have arrived at a stop, for the map, and in a city battle to claim a stop. Your browser asks for permission first. If you do not give it, the parts that need location do not work; the rest of the trail does.
• Your location goes to our server when the game needs it, such as on arrival at a stop or with a claim. How far you were from the stop at that moment, we keep with the course of the game (see ‘How long we keep data’). If location is on, we also keep a point of your route now and then: at most one per 25 metres or per 45 seconds, and never more than 400 per trail. With that we make your team's route video at the end. That video is made on your own phone and you can download it; we do not keep it. We also keep your team's last known location, and that of each extra phone. Points outside the play area of the trail, the area around all stops plus one and a half kilometres, we do not keep. We erase the route points and those last locations twelve months after the trail. Shortly before that, we add up for each stop of the trail how teams walked, where they strayed or stood still and how long a stretch took. Those figures are anonymous: they belong to no team, no time and no location of players, and we keep them.
• If you close the trail, it stops. We do not follow you outside the trail. The direction of your compass stays on your phone.
• Other teams do not see your location. Only in a competition, with the binoculars, does an opponent briefly see you on the map, and the game master of a city battle sees all teams as long as he is not playing himself.

Photos

• For some tasks you take a photo. Your phone first asks for permission for the camera.
• The photo is in protected storage in Frankfurt. Your own team can see it, also at the end of the trail, in the travel booklet and on the look-back (see ‘What others see of you’); an administrator only with temporary access of thirty minutes that is recorded. For a task that teams do together, such as a group portrait or a relay, the other teams in the same competition also see your photo.
• An AI service from Google assesses whether the photo fits the task (see ‘Artificial intelligence’). We automatically delete the photo thirty days after it was uploaded, unless you give us permission to use it on our website (see below).
• If there are people in it who are not playing, ask whether that is all right, or take the photo so that they are not recognisable. We never use your photos for advertising or on our website without asking you separately.
• We ask that at the end of the trail, separately from everything else: ‘May we put your team photo on the Doen We! website?’ You choose ‘Yes, that’s fine’ or ‘Rather not’; if you choose nothing, the answer is no. It is about the photos from the tasks, and everyone in the photo has to agree. With the same tap an adult from the team confirms that this is so, and that for players under sixteen a parent or guardian agrees. If you say yes, we may put those photos on our own website, where anyone can see them, and we keep them until you withdraw your consent, at most two years. We record what you chose, when, and which text you saw. You can withdraw at any time by emailing support@doenwe.events; after that we no longer use the photos and delete them again within the normal period of thirty days.

Videos for dare challenges

• Dare challenges only appear in trails marked for that purpose, and are only for adults. As proof the team records a short video, with sound. Your phone then asks for permission for the camera and the microphone.
• From the video, your phone makes one image with a few frames. Only that image reaches us and goes to the AI jury; the video itself and the sound do not. By default we delete the image immediately after the judgment; if a trail keeps it anyway, we delete it after thirty days.

Speech

• At some stops you say a sentence out loud. Your browser first asks for permission for the microphone.
• Your browser sends the sound to its own speech service to convert it into text: for Chrome that is Google, for Safari Apple. That happens under their own privacy terms.
• We only receive the signal that the sentence was recognised. We do not receive sound or text.

• Some parts run on Gemini, an AI service from Google: the hints, the conversations with characters, the judgment on photos and dare challenges, the game direction that steps in if a team gets stuck, the commentary in a city battle and the report at the end. In the trail, each of those parts states that it is AI.
• Each time only what is needed is sent: the photo, for a dare challenge one image with a few frames from the video, what you type in a conversation, or, for the report and the commentary, what you did in the game, with the team name.
• We use the paid version of the service. Google then does not use the data to train Gemini or to improve its products. Google does keep requests and answers for 55 days to detect misuse; authorised Google staff can view them for that purpose. A photo or such an image can therefore exist at Google for longer than with us.
• Our own AI log only records that there was a request and how large it was, not the content. What you type or make in the game, we keep as game data; how long is set out under ‘How long we keep data’.
• AI looks at what is in an image: a building, an object, an arrangement, an action. It is never asked to recognise anyone, compare faces or estimate anyone's age, gender or emotion. We process no biometric data.
• What AI says is generated automatically and may be wrong. It decides only about points and hints in the game, never about anything with consequences beyond it; so there is no automated decision as meant in Article 22 GDPR. If you think a judgment is unfair, email us: a person will look at it and adjust it if necessary.
• Apart from the AI in the game, the administrators use Claude from Anthropic to analyse the course of the game (see ‘You play a trail’). That is not part of the game and decides nothing about you or your team; it produces suggestions to improve a trail, which a person assesses.

• Your team name, points and time appear on the trail's scoreboard. In a competition, in which teams play against each other at the same time, they also appear in the interim standings, and in a city battle also in the commentary for all teams. In a competition the other teams also see how far you are, and an opponent can sometimes briefly watch along with you.
• The scoreboard, your team passport and the look-back on your trail each have their own link. Anyone with that link can open them; search engines do not index them. The look-back also shows your photos, until we delete them after thirty days. If you don't want that, switch it off at the end of the trail. It also shows the names your extra phones chose, with what those phones did. So share the link only with people who may see it. After twelve months what you did disappears from those pages; only the score remains on the scoreboard, as an anonymous team. If you want that sooner, email us.
• For a task that teams do together, the other teams in the same competition see your photo (see ‘Photos’) and read what you write, with your team name next to it. This also appears in the report of the competition.
• If at the end of the trail you give permission to put your team photo on our website (see ‘Photos’), anyone who visits our website can see that photo.
• You make the travel booklet (a pdf) and the route video yourself on your phone. What you do with them is up to you; we share them with nobody.

The GDPR allows the use of personal data only on one of the grounds named in the law. These are ours.

Where we rely on a legitimate interest, we have weighed that your interests do not override it. You can object to it (see ‘Right to object’ under ‘Your rights’).

• To order you need a name and an email address, and sometimes a billing address if Stripe asks for it. You receive the code at the email address. Without it you cannot order.
• You can play without entering anything about yourself. Without location, the parts that need location do not work, without a photo or video you miss the points for that task, and without a microphone you cannot do a speech task.

• From the buyer: they buy the code and their email address is pre-filled next to the team name. If a team has not entered an address of its own, we use the buyer's for the email afterwards.
• From your teammates: they may take a photo that you are in and choose the team name.
• From the game master of a city battle: his interventions appear in the log.
• From Stripe: your name, email address, possibly billing address, and data about your payment, such as the payment method.

We sell your data to nobody. These parties work with us. Most do so on our behalf, as processor, bound by a data processing agreement; the parties marked as ‘independent’ are themselves responsible for what they do with the data.

What the independent parties themselves do with your data, you can read in their own privacy statements: Stripe, Google, OpenStreetMap, Esri, Unsplash, Apple and Anthropic.

If data goes to a country outside the European Economic Area, it does so only with the safeguards the GDPR requires: a decision of the European Commission that the country or the company offers adequate protection, such as the EU-US Data Privacy Framework, or the standard contractual clauses of the European Commission. You can ask us for a copy of those safeguards.

We give data to the authorities only if the law obliges us to.

We do not keep data longer than necessary. Afterwards we delete it, automatically where possible.

We only use cookies that are necessary for what you yourself ask for: playing a trail, paying, logging in. No advertising, tracking or analytics cookies. For such necessary cookies no consent is needed (art. 11.7a Telecommunications Act (Telecommunicatiewet)); that is why you see no cookie banner. We do tell you which ones they are.

You can erase cookies in your browser. Preferably do not do so in the middle of a trail: the app then no longer recognises your phone.

• Many teams play with children. Children do not have to fill in anything about themselves. We do not create accounts for children, do not ask for a date of birth, do not build profiles and do not target advertising at children.
• Have an adult choose on the phone whether location, camera and microphone may be on.
• Dare challenges are only for adults; the buyer ensures that only adults take part in such a team, and the team confirms in the trail that all players are 18 or older.
• At the end of the trail we ask for permission to put the team photo on our website. If a player under sixteen is in the photo, we also ask a parent or guardian for that permission: an adult from the team confirms with the same tap that it has been given.
• If a parent or guardian wants us to delete a child's data, we do so without further questions.

You can always ask us:

• which data we have about you (access);
• to correct something that is not right (rectification);
• to delete your data (erasure);
• to temporarily stop the use (restriction);
• to receive your data in a file that you can use elsewhere (portability);
• to object to a use that is based on our legitimate interest (see ‘Right to object’ below).

Right to object. If we use your data on the basis of our legitimate interest (see ‘On what legal basis’), you can object to it on grounds relating to your situation. We will then stop, unless we have compelling grounds that override your interests, or need the data for legal proceedings. Email your objection to support@doenwe.events.

If you gave consent, you can always withdraw it. What happened before that remains lawful.

Send your request to support@doenwe.events and state the code, the email address of the order or the team name, so that we can find your data. A request is free of charge. We respond within a month; if a request is complicated, it can take two months longer, and we will tell you so within that first month.

We never ask for a copy of your identity document. To be sure the request comes from you, we reply to the email address of the order, or ask something only you know, such as the code or the day of the trail.

If we delete data at your request, we ask Stripe and Brevo to do the same. Your score remains on the scoreboard as an anonymous team, so that other teams' positions do not shift. We must keep orders for seven years for the tax authorities; we delete those only after that, and we will let you know.

If you disagree with how we handle your data, please tell us first. You can also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) (autoriteitpersoonsgegevens.nl), or with the data protection supervisory authority in the country where you live.

All connections are encrypted. Codes, sessions and device codes are long random strings, and our cookies for your session and your phone cannot be read by scripts on the page. Photos are in protected storage, only administrators on a fixed list can access the back office, and anyone who views players' photos is recorded.

If something does go wrong with your data, we report it within 72 hours to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), and to you if the risk to you is high.

If anything changes in what we do with data, we will amend this statement. The date at the top shows when that last happened.