This text is a draft. The details marked as to be completed have not been filled in yet.

Privacy notice

Effective 2026-11-06.

Who is responsible for your data

The organiser of a quiz, the business that shared it with you, is the controller of the details its players share: it decides why they are collected and how long they are kept. ARENA processes them on the organiser's behalf and only on its instructions.

ARENA is provided by BrandBeat7, of 409, Whitefield Road, Kondapur, Hyderabad, Telangana, India. Privacy contact: support@brandbeat7.com. Data protection officer: Not appointed.

What is collected when you play

• Your answers, how long you took to answer each question, and your score.
• A shortened hash of your network address and the arena_rk cookie, which limit repeat attempts.
• A token in your browser tab's session storage, which lets you continue an attempt you started; your browser removes it when you close the tab.
• Only if you tick the box on the capture step, which a quiz may show before your result and a live game after its final standings: your name, if you give one, your email, and a record of the consent text you agreed to and when.
• If you opened the quiz from a personal link the organiser sent you: the identifier of your contact record in the organiser's CRM account, so that your attempt and result are linked to it.

ARENA does not ask for your age. Quizzes on ARENA are not meant for children under 13.

Why it is used (legal basis)

Playing this quiz runs on legitimate interest. The organiser has a legitimate interest in running its quiz, scoring it and keeping statistics about its questions, and ARENA limits repeat attempts on its behalf. A quiz opened from a personal link runs on the organiser's legitimate interest in assessing the contacts it invites.

No name or email is stored without your consent. Saving your name and email, and passing them to the organiser so that it can contact you about your result, runs on the consent you give on the capture step. You can withdraw it at any time by asking the organiser; this does not affect what was done before.

Who receives your data

• The organiser, which sees attempts and results in ARENA's Studio.
• The organiser's own CRM account, the customer platform the organiser connects ARENA to: your name, email and result if you consent on the capture step, or your result if you opened the quiz from a personal link. What happens to them there is governed by the organiser's own terms with their CRM provider.
• The service providers BrandBeat7 uses to run ARENA (its sub-processors): Cloudflare, which hosts ARENA and handles every request; Neon, which hosts ARENA's database; Uptrace, which receives monitoring traces, logs and metrics that identify attempts by internal identifiers, after ARENA removes email addresses, phone numbers and tokens from them; and Anthropic, which provides AI-assisted quiz generation when BrandBeat7 has turned it on for the organiser, receives only the material the organiser submits for it, and receives no player data unless the organiser puts it in that material.

ARENA does not sell your data and does not use it for advertising.

Where it is processed

Your requests are handled on Cloudflare's network, usually at a location near you. ARENA's database is hosted in the United States. BrandBeat7 operates ARENA from India, and its staff may access the data from there to run and support the service. If you play from the European Economic Area or the United Kingdom, your data is therefore transferred outside it; the data processing agreement between the organiser and BrandBeat7, linked below, sets out the safeguards for these transfers.

How long it is kept

• The arena_rk cookie and the shortened hash of your network address are used for 24 hours and then removed by a daily job.
• An attempt not linked to you by a name, an email or a personal link is deleted 30 days after it ends.
• An attempt linked to you by a name, an email or a personal link is deleted 24 months after it started.
• Your name, email and consent record are kept while the organiser uses ARENA.
• If the organiser deletes your contact in their CRM, your name, email and consent record are deleted, and your attempts lose the link to you and are deleted 30 days later.
• When the organiser removes ARENA, ARENA's database records for that organiser are deleted 30 days later, except deletion records that hold identifiers only; reinstalling within those 30 days restores them.
• Monitoring traces, logs and metrics are kept by Uptrace for 28 days.
• Deleted data can remain in database backups for up to 7 days.
• Data sent to the organiser's CRM account stays there until the organiser deletes it.

If your data is erased

• When the organiser erases your data at your request, ARENA marks your record as deleted in the same step that records the request, and from then on no longer uses it: its attempts and results can no longer be opened, answered or exported, and nothing more is written to it.
• ARENA then promptly starts removing what it wrote about you to the organiser's CRM account: its fields and tags on your contact and the notes it added. It does not delete your contact or anything else the organiser holds there. A removal that fails is retried a limited number of times and stays visible to the organiser, who can retry it.
• The data ARENA still holds about you is purged (physically deleted) by a scheduled purge once exactly 7 days of 24 hours, counted in UTC, have passed since that deletion, never earlier; a repeated request or a retry does not restart the 7 days. A removal that failed in the CRM account does not keep your answers or consent records in ARENA any longer.
• After the purge ARENA keeps only internal identifiers, dates, the status of any removal not yet done, and a pseudonymous key derived from your email or contact identifier, so that it can finish that removal and stop old processing from recreating your data.
• The organiser handles your request within 30 days of it; the 7-day purge alone does not complete it.

Your rights

Depending on where you live, you may have the right to see, correct or delete your data, to object to its use on legitimate interest, to withdraw your consent, and to complain to a data protection authority. The organiser decides on these requests, so contact the organiser first. If you write to BrandBeat7 at support@brandbeat7.com about a quiz, BrandBeat7 passes your request on to the organiser that runs it.

Changes to this notice

BrandBeat7 updates this notice when ARENA's processing changes; the effective date at the top shows the current version. The terms between organisers and BrandBeat7 are in the data processing agreement.