Privacy
How COKLIO handles data when activities are created and played.
LEGAL INFORMATION — Information dated 5 November 2026. Family is free with a verified adult account; Pro requires a personal code. Payments, advertising and optional analytics are disabled.
Data controller
COKLIO — Belgian enterprise number BCE/KBO 0537.224.305. Business address: Rue Docteur Séverin 24, 5060 Sambreville, Belgium. Email: contact@coklio.com.
Accounts
An organiser account may contain a chosen name, email address and cryptographic password hash. The actual password is never stored in plain text.
Players and sessions
Participants use a display name and session token, without needing their own account or email address. Responses and any scores are stored on the server and accessible to authorised organisers.
Erasing your participation
The “Erase my participation” button removes the display name and answers associated with your token. Previously downloaded exports, encrypted backups and legal obligations require separate handling. Keep your token to use self-service erasure.
Children
Family activities must be prepared and supervised by an adult. Do not enter children’s full names, photographs or sensitive information.
Lawful bases
Contract and pre-contractual steps for requested accounts and services; legal obligation for accounting records; proportionate legitimate interest for security and abuse prevention; freely given, withdrawable consent for optional trackers if enabled later.
Correspondence and legal duties
Contact enquiries: manual review no later than 2 years after the last useful exchange; enquiries without follow-up: no more than 3 years. Legal duties may require separate retention. COKLIO does not automatically purge this correspondence.
Accounts, sessions and backups
Accounts are kept until deletion is requested, with review after 24 months without authenticated sign-in. For new sessions enrolled under the 5 November 2026 policy, display names and answers are deleted 90 days after closure. Older data remains access-restricted during separate review. New encrypted backup files are removed after 30 days only when a recent independent copy has been verified; otherwise rotation is blocked and intervention is required. Self-service erasure is available earlier.
Recipients and transfers
OVHcloud hosts the service in Gravelines (France) under a validated data processing agreement. Brevo sends account transactional emails only: logs are retained for 1 month and message previews are disabled. Its stated storage locations are European; support access and subprocessors may involve transfers outside the EEA under the processing agreement and standard contractual clauses. Microsoft 365 handles contact correspondence under its data protection addendum. No data sale or advertising use. Provider processing or support access may involve countries outside the EEA, subject to the safeguards in their processing agreements, including standard contractual clauses where required; exclusively European processing is not guaranteed.
Support requests
Requests from a verified account are used only for COKLIO support. Correspondence is reviewed manually under the periods stated above. Ordinary requests can be viewed, exported and erased in the follow-up area; privacy rights, incidents, disputes and legal duties require appropriate human handling. Approving an internal draft does not send a third-party message or an automatic reply.
Your rights
Contact contact@coklio.com for access, rectification, erasure, restriction, objection, portability where applicable and withdrawal of consent. Complaints may be submitted to the Belgian Data Protection Authority. Never share your password when making a request.
For enquiries, please contact contact@coklio.com.