Privacy notice

1. Who is responsible?

Publimix is responsible for Dareback's processing of personal data.

This notice applies to the Dareback website, web app, played challenges, day, week and month challenges, and their galleries. Additional game or prize terms may apply to a specific challenge.

2. Which data do we use and why?

We use the information you or other participants enter for a game. Preferably choose a username; your real name is not required to take part.

We do not routinely collect players' dates of birth, telephone numbers, identity documents or home addresses. If additional information is needed for a prize, we only request what is necessary and explain the purpose.

Do not upload sensitive information that the challenge does not need. Photographs and files may contain metadata, such as capture details or a location. Dareback does not currently remove metadata automatically; remove it before uploading if you do not want to share it.

Participation without email

For an edition without mandatory email confirmation, we do not request an email address. Your participation is accessible through access details saved in the same browser. Recovery is not guaranteed without those details. Clearing a browser or using another browser may lead to a new entry; the system does not establish that each entry comes from a different person.

3. Who can see your submission?

In an ordinary game, you, the organiser and the designated assessor can view evidence, depending on your roles. People with valid personal access can view the game data associated with that access. Only share the public invitation where intended, and keep personal access details safe.

For day, week and month challenges, the administrator and designated assessors can view your submission for moderation and assessment. Not all submissions are public.

Your name, evidence and any winner announcement only appear in a public gallery, Hall of Fame or public Story with your publication consent and the required approval. Visitors may view, copy or share public material. An alias does not prevent someone in a photograph from being identifiable.

You can withdraw publication consent using the available game controls or by emailing info@dareback.com. We then stop publication on our own channels. Withdrawal does not retrospectively make previously permitted use unlawful. We cannot always retrieve copies others have already made outside Dareback.

Publication consent is separate from agreement to the game terms and consent to news or publication notifications. Gallery consent does not automatically permit a sponsor to use your material in its own advertising.

Your Dareback account

For login and registration we store your username, email address, confirmation of your address, and the time and version of your agreement to the terms. A personal confirmation link is valid for 30 minutes and can be used once. Your game choice is temporarily saved so you return to the right game after confirmation. You do not have to choose a password. The functional cookie dareback-account contains a random access key, is valid for up to 30 days and is not accessible to JavaScript. Logging out ends the current login session. Your email address is not displayed publicly.

Google sign-in and two domains

You can also choose to sign in with Google. We then receive your Google account identifier, confirmed email address and the name supplied by Google for account creation or linking. We request only the openid, email and profile sign-in permissions, with no access to your contacts, email messages or files. Google processes the sign-in request under its own privacy policy.

Dareback.com and Draaislag.nl use the same account and participation administration at Publimix. You sign in separately on each domain; browser storage and cookies are not automatically shared between domains. For new participation, we save the selected language and exact Dutch or English terms version. Emails about that participation follow the saved language. For optional notifications we also save your language preference.

Trying the photo reels before signing up

You can spin the year-round photo challenge without signing in. A random functional browser key (dareback-photo-starter, up to 30 days) and a session cookie (dareback_photo_starter) protect and support this route. We save the combination and a private access key on the server for up to seven days if it has not been linked to an account. Choosing to save it links the participation to your verified account, together with the exact terms and consent records. The saved conditions do not change with the season.

To improve this route we keep minimal internal counts of starts, spins, choices, completed sign-ins, saved combinations and submitted photos. A start is one spinning browser per domain per Netherlands calendar day, rather than a verified person. A derived random key prevents repeat actions from counting as extra starts. We use no external tracking service for these counts. The minimal visit records can be removed after 180 days; daily totals remain without a browser key. This is based on our legitimate interest in operating and improving an accessible service. Unlinked drafts and visit records are removed through an administrative cleanup; saved participations and photos follow the retention periods below. Publication notifications are optional per photo and can be stopped in the saved participation.

Agreement when joining a new game

From terms version 1.0, we actively request agreement to the general and publication terms for new participation. We record the participation, time, exact terms version and separate agreement actions. On submission, we also record the rights declaration and, where applicable, separate consent for your own identifiable image, voice or personal data. For new solo participation, agreement is recorded on the server under a random personal code while you are logged into your Dareback account; the challenge, activity and result remain in your browser until you submit an entry. Existing participation and submissions retain their original agreements. For questions, withdrawal or deletion, email info@dareback.com.

Read and download the full terms.

4. Cookies and storage in your browser

Dareback uses browser storage to save access to games, your overview and preferences. This is local storage and, where needed, session storage. It is not a player account. This data may remain until you delete it or your browser clears it; session storage normally disappears when the relevant browser session closes.

For short trial games and ordinary solo challenges, we save the challenge, spun conditions and your own result in local browser storage. After finishing, you can submit photographs, audio or video for public publication. On submission, the selected recordings, username, challenge, conditions and result are stored on the Dareback server. Recordings only become public after administrator approval. Previously stored local photographs and videos remain in IndexedDB in the same browser until you submit them yourself. They remain until you clear the website data or your browser clears its storage. Removing a solo challenge from the overview hides it; it does not delete this local data. Download your own copies before clearing browser storage or changing devices.

For day, week and month participation without email, we use the functional cookie dareback-featured-browser. It contains a random key that recognises the same browser. It may remain for up to one year and contains no name or email address. Logged-in administrators also have a session cookie.

The web app may temporarily store public website files in a technical cache. The update cache excludes API responses and administration pages. This storage supports Dareback's operation, not advertising tracking.

You can clear or block cookies and browser storage in your browser. This may cause you to lose access to played challenges. Removing games from your overview only affects the overview; it is not a request to delete all server data.

5. Suppliers, jury and sponsors

We use mijn.host for website, database and email hosting. They may process personal data on behalf of Publimix to provide their services. According to mijn.host's information, hosting and backup services are provided in the Netherlands. Processing by mijn.host is covered by the data processing agreement and supplier information from mijn.host.

Administrators and jury members only receive access for managing or assessing the relevant challenges. If a sponsor acts as a jury member, it can see the data needed for that assessment. Email addresses are not automatically shared with sponsors and participant data is not sold.

A prize may require limited data sharing with the awarding party. This is explained in the edition terms beforehand. Where separate consent is necessary, we request it first. We disclose data to competent authorities where legally required.

Externally loaded example photographs

Some example photographs on the website load directly from Pexels. Your browser then contacts the image service, which may process your IP address and technical request data. This concerns example photographs, not sending your submissions to Pexels.

The hosting provider may use service providers outside the European Economic Area for support, as described in the mijn.host subprocessor list. Information in a support request may, for example, be processed in the United States under the safeguards stated by mijn.host. We limit personal data in support requests to what is necessary. Pexels also uses international service providers; technical data may be processed outside the European Economic Area. The Pexels privacy policy contains information about storage, recipients and safeguards for international transfers. Those external services also have their own privacy rules. For other website links, you visit those websites yourself when you open the link.

6. How long do we keep data?

We do not retain data longer than needed for the stated purpose. The periods below apply to Dareback. Publimix deletes data from its own systems through administration or a separate cleanup process.

If longer retention is demonstrably needed for an ongoing dispute or legal obligation, we keep only the necessary data. We do not repurpose it for news messages or new publications.

In the current Dareback version, not all server data is automatically deleted within the periods above. Publimix therefore handles deletion through administration or a separate cleanup process.

7. Your choices and rights

You can ask us to access, correct or delete your personal data. Where the law provides, you can also request restriction of use or portability of your data. You may object to processing based on a legitimate interest.

Stop or change optional email notifications through the settings link in those emails. You can also withdraw consent by contacting us. Access emails and a result email for participation with email confirmation are separate messages about that participation.

Email your request to info@dareback.com, or write to Publimix at the address above. Preferably identify the challenge, your username and what you want to request. We may ask for limited additional information to verify that the data relates to you. Do not send a copy of your identity document without being asked.

We normally respond within one month. If a request is complex and needs more time, we tell you within that month and explain why. If we cannot fully fulfil a request, we explain the reason.

You can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). You can also contact Publimix first to seek a solution together.

8. Security, young people and changes

The service uses measures including HTTPS, personal access keys, restricted evidence storage and restricted administration. Publimix limits access to people who need it. Security can reduce risks but cannot guarantee complete protection.

Do not upload identifiable images or personal data about others without a valid reason and the necessary consent. If processing requires consent that must be given by a parent or legal representative for a young person, arrange this beforehand. Ask a parent or carer for help if unsure. The current software does not automatically verify age or parental consent.

A jury chooses winners under the challenge terms. Spinning the reels is a game feature; it does not automatically select a prize winner.

We may update this notice when the service or our policy changes. The current version appears on this page. For a new use requiring fresh consent, we request that consent beforehand.