Introduction to the privacy policy

Who are we?

Qoezion is a digital service that allows organizers to recruit and coordinate teammates (volunteers or staff) who contribute to the success of all types of events (sports, culture, charity, professional, etc.).

Qoezion aims to make life easier for both organizers and teammates by offering simple, intuitive and secure tools designed to help everyone to save as much time as possible, so that they can fully dedicate themselves to their events.

Please find hereunder the different addresses useful to the service:

• Qoezion application: https://app.qoezion.com
• Help center: https://help.qoezion.com/en
• Customer support portal: https://quick-off.atlassian.net/servicedesk/customer/portal

Privacy policy

This privacy policy provides information on the processing of personal data carried out within the framework of the platform Qoezion . It aims to provide you with useful information to understand how your data is processed and how you can exercise your rights.

Our company Quick-Off is attentive to the protection of personal data and is committed to processing your data in compliance with the laws and with the necessary transparency.

Therefore, we may have to modify, complete or update this document in order to comply with regulatory requirements.

Last updated: 3 August 2026.

If you have any question about this policy, you can contact us through the following form:
https://quick-off.atlassian.net/servicedesk/customer/portal/6/group/6/create/55

Definitions

Editor : the company Quick-Off is the editor of the digital service Qoezion .

Qoezion : digital service to recruit and manage staff and volunteers designed for event organizers.

The Organizer : the entity that has subscribed to the editor's services for the organization of its events.

The User : The person using Qoezion whether he or she is a volunteer, a staff member or an event organizer.

Collected data

What data are collected?

Within the framework of the use of Qoezion 's services, the editor collects personal data concerning its users.

The categories of collected data are the following:

• Identification data (in particular: first and last names, birth date, profile photo)
• Contact data (email address, phone number)
• Use data (specially visited web pages, technical traces)
• Geolocation data (position shared via the Qoezion Spot mobile application, only during your missions)

The next paragraphs detail the use of these data.

User account

When you create a new user account on Qoezion , we collect:

• First and last names
• Phone number (optional, to receive SMS notifications. You can disable SMS notifications from your user profile settings)
• Birth date (to make sure that you have the minimum age to access the service, and to apply to some events)
• Email (used for email notifications, to allow you to reset your password in case you forget it, and to allow you to receive the newsletter if you want)

The Qoezion account allows you to:

• Apply to events, access the teammate space of the events you participate in, contact organizers
• Create and manage your own events and organizations

Qoezion profile

With your Qoezion account, you can also add to your profile page:

• A profile photo
• A description of your experience in events

The Qoezion profile page lists the different events you have participated in. It is visible to the organizers of the events you are applying to.

Data related to events and organizers

When you apply to an event, you may be asked to provide additional personal data that the organizer needs in order to organize that event.

This data is shared with the organizer of that specific event. It is not shared with other organizers of the platform Qoezion , nor with the editor.

The organizer is accountable for the nature and use of the personal data collected via his or her application form. If you have any requests regarding the use and processing of data collected in the context of an event, you can contact the organizer directly using the messaging service provided by Qoezion .

Location sharing (mobile application)

During an event, the Qoezion Spot mobile application offers a location sharing feature: your position is transmitted to the event organizers only when you are on a mission and only when they need it. It serves a safety and coordination purpose (for example securing a crossing, staffing a first-aid post, or locating the nearest first responders).

When location sharing is active, the application collects your GPS position and its accuracy, as well as your device's battery level and charging status (to anticipate a possible loss of signal). These readings are timestamped.

Location sharing is enabled voluntarily, and you are asked for your consent at the start of each session. During an active session, your location is tracked and transmitted regularly—even when the app is running in the background (with the phone locked or the app closed)—to ensure that location sharing remains active throughout your assignment; your device constantly alerts you that location sharing is in progress (a persistent notification on Android, the system location indicator on iOS). Outside of an active session, no location data is collected. You can stop location sharing at any time, and it stops automatically at the end of the session.

Location sharing is set up and used under the responsibility of your event's organizers, who are the data controllers; Quick-Off only provides the tool. Your positions are shared with the organizers of the relevant event and, in the event of an incident and if necessary, with the competent authorities. They are not shared with other organizers.

To inform you when a location sharing session starts, the application may send you notifications. This involves collecting a technical notification identifier (token) specific to your device, routed through your mobile platform's notification service (Apple Push Notification service on iOS, or Google's Firebase Cloud Messaging on Android) and Amazon SNS. You can disable notifications from your device settings.

Measurement of web statistics

The Qoezion application (app.qoezion.com) does not use any third-party audience measurement tool or tracker for statistical purposes.

Only our showcase website uses Google Analytics to analyze its traffic and improve the browsing experience. This tracker is only set after your consent, given via the cookie management banner.

Cookies management

We have implemented a consent banner that complies with the General Data Protection Regulation (GDPR). You can accept or refuse the use of non-essential cookies.

The cookies used on our site include:

• Necessary cookies: essential for the proper functioning of the site.
• Analytics cookies: set only on our showcase website, via Google Analytics, and subject to your consent.

You can change your cookie preferences at any time via the cookie management tool.

Technical traces

For the legitimate purpose of preserving the stability, security and performance of the Qoezion platform, Quick-Off collects technical traces with Sentry .

This includes technical information such as the type and version of the operating system and web browser, the loading time, the description of the errors encountered and the IP address.

These traces are time-stamped and associated with the technical ID of the user's Qoezion account. An automatic data cleansing mechanism is used to prevent accidental collection of personal data contained in technical traces.

Legal Basis for Data Processing

In accordance with Article 6 of the GDPR, the processing carried out relies on the following legal bases:

• Creation and management of your account, access to the services and participation in events: performance of the contract (terms of use) and pre-contractual measures;
• Email and SMS notifications necessary for the service (applications, reminders, password reset): performance of the contract;
• Newsletter distribution and use of analytics cookies on the showcase website: your consent;
• Location sharing via the mobile application: your consent;
• Verification of the minimum required age: compliance with a legal obligation;
• Technical traces and security measures: Quick-Off's legitimate interest in ensuring the stability, security and improvement of the platform;
• Management of security incidents during an event: legitimate interest, or even protection of the vital interests of individuals.

Who will have access to your data?

The personal data collected is intended for the publisher, Quick-Off, solely for the purpose of providing the digital services offered by Qoezion, as well as for the organizers of the events in which you participate, each within their respective scope. Under no circumstances is this data sold or rented to third parties.

To provide its services, Quick-Off uses subcontractors that process personal data on its behalf, under agreements compliant with the GDPR:

• Hosting and infrastructure: Amazon Web Services (European Union, Paris)
• Sending of transactional emails: Mailjet
• Sending of SMS: ClickSend (when SMS notifications are enabled)
• Subscription and payment management: Stripe (only for organizers who have subscribed to a paid plan; does not concern teammates)
• Mapping: Google Maps
• Mobile application notifications: Apple (APNs), Google (Firebase Cloud Messaging) and Amazon SNS
• Technical monitoring: Sentry

If you choose to sign in using a third-party account, Google or Facebook processes the corresponding sign-in data.

Where are the data hosted?

The data are hosted in the AWS Europe (Paris) data center, in France.

Data transfers outside the European Union

Your data are primarily hosted and processed within the European Union. However, some subcontractors may process data outside the European Union, in particular ClickSend (Australia) as well as Google, Apple and Stripe (United States, the latter only for subscribed organizers). These transfers are governed by appropriate safeguards, such as the European Commission's standard contractual clauses and/or Data Privacy Framework certification.

Records of processing activities

In accordance with article 30 of GDPR, Quick-Off keeps records of processing activities describing the processing activities carried out as a data controller.

This register is made available to the supervisory authorities upon request.

Data security

Measures implemented to secure your data

Quick-Off implements adapted technical and organizational measures that comply with the regulations in force to protect personal data.

Personal data are encrypted in transit (TLS protocol) and at rest.

Access to these data is strictly limited to authorized people bound by an obligation of confidentiality.

An IT charter, attached to Quick-Off 's internal regulations, aims to ensure appropriate internal security.

Independent security audits are carried out to verify that the measures implemented to guarantee the security of data are effective.

Duration of data storage

Data related to a user profile are stored as long as the profile is active.

Qoezion automatically deletes accounts after 3 years of inactivity. The user is then informed by email and can reactivate their account and thus postpone the automatic deletion date.

Users can delete their account at any time, directly in the Qoezion platform.

The deletion of the Qoezion account does not mean that the data shared with event organizers will be automatically deleted: it is the user's responsibility to also request the deletion of his/her personal data from these organizers.

Location sharing data collected via the mobile application is kept for 30 days, then automatically and permanently deleted.

Connection logs are kept for 24 hours for IP addresses and 30 days for the activity history.

Technical traces collected for monitoring purposes (Sentry) are kept for 90 days.

Data collected in the context of an event is kept by the organizer, for the period of time determined by the organizer and under their responsibility.

Personal rights

Liabilities

The editor is responsible for the data regarding the activity of a user on the platform, as long as this activity is not directly related to an event the user applied to.

In the context of an event (application form, teammate space, messaging service), unless otherwise indicated, the organizer of this event is responsible for the data.

The data controller must take all necessary measures to ensure that the processing of its users' personal data complies with regulations, and to secure such data processing. The data controller subcontractors operate in compliance with regulations, or may be subject to legal sanctions in case of failure.

Exercising your rights

You have several rights regarding your data that you can exercise by sending a request to the data controller.

• Right of access and rectification
• Right of portability
• Right of objection
• Right of erasure
• Right to restriction of processing
• Right to withdraw your consent at any time, for processing based on it

You also have the right to lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL), the French supervisory authority, in particular if you consider that your rights are not respected: www.cnil.fr.

The data controller reserves the right to refuse any requests that are clearly abusive, in particular when they are too numerous, repetitive or systematic. This refusal will be motivated in writing.

You can exercise your rights using the following online form:
https://quick-off.atlassian.net/servicedesk/customer/portal/6/group/6/create/55

Or by post to the address below:

Quick-Off
For the attention of the DPO
5 boulevard François Mitterrand, 43120 Monistrol/Loire, France