Online Invigilation/Proctoring Service Policies

Online Invigilation/Proctoring Service Privacy Policy

Last updated 28 November 2022.

We are Surpass Assessment. Depending on where you are, your Surpass Assessment company contact is Surpass Assessment Inc of 224 Valley Creek Boulevard, Suite 210, Exton, PA, 19341, USA, or BTL Group Limited (trading as Surpass Assessment) of Salts Mill, Victoria Road, Saltaire, Shipley, BD18 3LF, United Kingdom. We have created this privacy policy in order to demonstrate our commitment to customer privacy and the protection of personal data.

The definitions of “controller”, “processor”, “data subject”, “personal data”, “processing” and “process” used in this policy have the meanings given to them in Regulation 2016/679 of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (the General Data Protection Regulation).

Surpass Assessment is both a controller and processor of personal data in different circumstances. Where we are a controller or a processor, we keep records of our processing as required by Article 30 of the General Data Protection Regulation.

This policy is split into two sections. The first section is about our marketing data collection and processing in relation to which we are a data controller. The second section is about personal data that is and processed as part of Surpass Assessment’s online invigilation service, in relation to which we are a data processor on behalf of our online invigilation service customers (who are the data controllers).

Marketing data (Surpass Assessment is a data controller)

If an individual agrees to be on and to remain on our contact list, from time to time we will send that individual:

• information about our Surpass Assessment products
• information about Surpass Assessment related events (for example, news about the Surpass Conference)

The applicable privacy policy for the above activities can be found here.

Online invigilation service (Surpass Assessment as data processor)

Surpass Assessment provides online invigilation as a service to our customers. If our customer offers you (candidate) their test/examination through the online invigilation platform that Surpass Assessment provides (powered by ProctorExam) and if you choose to take such test/examination through the platform, you agree that you are being monitored over the Internet through your computer via your webcam and microphone during your exam session. Online invigilation means that you will log on to a test platform through the internet to take your assessment and you will be monitored, sometimes in real time, during your entire assessment session so that your face, voice, desk and workspace will be captured and a recording will be made of these for the purposes of assessment security and the integrity of the assessment process. It is your responsibility to ensure that only you will be recorded during an online invigilation testing session and that no one else will be physically in the room where you are testing and that no one speaks to you during your testing sessions.

The legal basis of our processing of personal data as part of our online invigilation service depends on our customers’ (as data controllers’) legal basis of processing and may be any one or all of the following:

– the data subject has given consent to the processing of his/her personal data for one or more specific purposes (and our customer relying on this basis receives this consent) (e.g. Article 6(a) of the General Data Protection Regulation); or

– processing is necessary for a legitimate interest of our customer (exam sponsor) to enable exam rules to be applied consistently and for cheating to be identified (e.g. Article 6(f) of the General Data Protection Regulation).

If you use our online invigilation service, to take assessments, we may also collect and record further information about you when you take your online invigilated exam, such as your name, email address, captured facial photo, captured ID photo/government issued ID, IP address, browser agents, browser and operating system identifiers, screenshots of your PC, your exam setting (home, office etc), all recorded video streams (computer, webcam and mobile), awarding organisation whose exam you are sitting and other assessment based data that may be collected, including information about browser version, appVersion, appName, product and appCodeName, video frame size, type and library used for encoding, framerate, jitter, packet loss and bandwith.

The video and audio recordings are standard test procedures for all awarding organisations’ online invigilated tests and your video and audio recording will be used for purposes of identity verification, online observation, incident resolution such as fraud prevention, test security and for the integrity of the test and testing process. For more information about how our customers (your awarding organisation) may collect and use your personal data we encourage you to review your awarding organisation’s privacy policy.

If your exam sponsor is also a Surpass Platform customer, all of the same personal data that we collect or receive as described in our Surpass Platform privacy policy applies for all awarding organisation’s online invigilated tests. Prior to the start of your online invigilated test you may be required to take a picture of yourself. The collection of such data is optional, but necessary if you choose to use the online invigilation function. You understand that the audio- and video-tapes of your testing sessions, as well as photos, will be supplied in certain circumstances to the relevant awarding organisation to assist with their test management of your test.

We will retain your personal data no longer than is necessary for the purposes for which it is processed. The length of time for which we retain information may also depend on the specific retention periods set out by your awarding organisation.

When you use our online invigilation services, we use selected third party service ProctorExam that is hosted in in Germany (Frankfurt Region) or USA (for North America based customers), to process your data on our behalf. As part of the provision of the service by Surpass Assessment to your awarding organisation, you agree that some or all of the above personal data may be processed outside the UK and EEA. In such circumstances, and if you are based in the UK or EU, we will, as required by GDPR, ensure that your privacy rights are protected by appropriate safeguards.

We do not share any data we obtain about you as part of the online invigilation service with third parties except in the limited circumstances detailed below:

• We (or our licensors) use third-party services in order to provide the online invigilation service – our third-party service providers are contractually prohibited from using any personal data for any purpose other than to provide the part of the online invigilation service for which Surpass Assessment has specifically contracted them to deliver service. A list of the third-party services that obtain personally identifiable information we currently use can be found here;
• In response to a court order, sub poena or legal process, to the extent permitted and required by law;
• Surpass Assessment may disclose student/candidate personal data on the online invigilation service to our customer (ie the certification / licensure body for which the candidate is sitting an examination/test), upon request from the customer. The awarding organisation requires your personal data so that tests can be correctly administered, and certification can be processed, granted and administered. For more information about how the awarding organisation may collect and use your personal data we encourage you to review your awarding organisation’s privacy policy;
• To child’s school or school district upon request, as required by the local laws e.g. FERPA.