We collect only what the Platform needs. Morfejus controls account and Platform data; the relevant organiser controls participant data for their event. GPS is used only with device permission, and marketing messages are sent only if you choose them.
1. Who handles your data
Platform controller: Association “Morfejus”, registration No. 40008300196, Maurēnu iela 6–10, Aizkraukle, LV-5101, Latvia, controls website, organiser-account, security, support and Platform-feedback data.
Event controller: the relevant event organiser normally controls participant registration, results, answers, hints and event-enabled location use. Their name and email appear on the event page. Morfejus processes this data on the organiser’s behalf, except where it is required for Platform security, legal claims or Platform feedback. Contact us if you are unsure whom to approach.
2. Data we use
Website visitor
Session and language choice; IP address and server-generated device, browser, time and security logs; and information you send in a help request or email.
Organiser
Email, username, organisation, securely hashed password, last-login IP, account administration details, event content and settings, uploaded images and maps, checkpoints, translations, support messages and significant-action records.
Participant or team
Email, public username, team name and size; name or phone only if requested for that event; access code, registration time, answers, points, results, progress and hints; location and device information where enabled and permitted; event and Platform ratings, comments and language.
3. Why and on what basis we use data
| Purpose | Data | Legal basis |
|---|---|---|
| Accounts, login and event tools | Account, organisation and event content | Taking steps to enter and performing a contract |
| Registration, gameplay and results | Registration, code, answers, points and progress | Providing the requested service and the organiser’s legitimate interest in running the event |
| Checkpoint proximity or live map | Device location and accuracy | Your choice and device permission, which can be withdrawn |
| Security and abuse prevention | IP, session and technical logs | Legitimate interests of Morfejus and users |
| Support | Contact details and messages | Contract or legitimate interest in providing support |
| Quality improvement | Rating, comment and pseudonymous participant identifier | Legitimate interest; consent where requested |
| News | Consent, withdrawable at any time | |
| Legal duties and claims | Only data necessary for the case | Legal obligation or legitimate interests |
Scores may be calculated automatically under rules set by the organiser. This is not profiling or automated decision-making with legal or similarly significant effects.
4. Event and location data
Registration data is linked to the event and available to its organiser in results and statistics. For checkpoint proximity, the browser may request a one-time location reading. If live tracking is enabled, coordinates, accuracy, time, username and browser information may be sent regularly after permission and displayed to the organiser. Revoking browser or device permission stops further transmission, but some game features may then be unavailable.
7. How long data is kept
- Organiser account and event content: while active and then as needed for closure, disputes and secure backup overwrite.
- Participant registration, answers, hints and results: for the organiser-selected period, normally 7, 14, 30, 90, 180 or 365 days. If no automatic deletion is selected, until a justified organiser request or event-data deletion.
- Live location: only as needed to manage the event and no longer than its participant-data retention period.
- Event and Platform feedback: separately and pseudonymously while useful for quality analysis or until a justified deletion/objection request.
- Marketing email: until consent is withdrawn.
- Support and security records: as needed to resolve the matter, protect security and legal rights, then deleted or anonymised.
- Session data: until session end or technical expiry.
Data may be kept longer where law, a dispute or legal claims require it. Data no longer needed is deleted or anonymised.
8. Security
We use access separation, encrypted connections, password hashing, session and request security checks, protected database queries and backups. Organisers can access only data linked to their profile and events. No system is risk-free; please report suspected unauthorised access immediately.
9. Your rights
Depending on the circumstances, you may request access, correction, deletion, restriction, portability, object to processing and withdraw consent at any time. Withdrawal does not affect earlier lawful processing.
Contact the event organiser first about registration and result data. Contact Morfejus about organiser accounts, Platform security or Platform feedback. We may verify identity before responding. You may also complain to the Latvian Data State Inspectorate.
10. Children
The Platform may be used for school, youth and family events. Before collecting children’s data, the organiser must assess age, provide age-appropriate information, obtain guardian permission where required and collect only what the event genuinely needs. Contact the organiser or Morfejus if you believe a child’s data was submitted without a proper basis.
11. Transfers outside the EEA
Core data is processed in the European Economic Area where practicable. Opening an external map or third-party function may send technical information to another country. Where personal data is transferred outside the EEA, we use an applicable legal mechanism and appropriate safeguards.
12. Contact and changes
When making a request, say whether it concerns an organiser account or a specific event and include the event name or link. We update this policy when Platform functions or data use change; the current effective date is always shown here.