Online Invigilation/Proctoring Service Policies
These policies apply to users of the online invigilation/proctoring service.
Last updated 28 November 2022.
The definitions of “controller”, “processor”, “data subject”, “personal data”, “processing” and “process” used in this policy have the meanings given to them in Regulation 2016/679 of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (the General Data Protection Regulation).
Surpass Assessment is both a controller and processor of personal data in different circumstances. Where we are a controller or a processor, we keep records of our processing as required by Article 30 of the General Data Protection Regulation.
This policy is split into two sections. The first section is about our marketing data collection and processing in relation to which we are a data controller. The second section is about personal data that is and processed as part of Surpass Assessment’s online invigilation service, in relation to which we are a data processor on behalf of our online invigilation service customers (who are the data controllers).
If an individual agrees to be on and to remain on our contact list, from time to time we will send that individual:
Surpass Assessment provides online invigilation as a service to our customers. If our customer offers you (candidate) their test/examination through the online invigilation platform that Surpass Assessment provides (powered by ProctorExam) and if you choose to take such test/examination through the platform, you agree that you are being monitored over the Internet through your computer via your webcam and microphone during your exam session. Online invigilation means that you will log on to a test platform through the internet to take your assessment and you will be monitored, sometimes in real time, during your entire assessment session so that your face, voice, desk and workspace will be captured and a recording will be made of these for the purposes of assessment security and the integrity of the assessment process. It is your responsibility to ensure that only you will be recorded during an online invigilation testing session and that no one else will be physically in the room where you are testing and that no one speaks to you during your testing sessions.
The legal basis of our processing of personal data as part of our online invigilation service depends on our customers’ (as data controllers’) legal basis of processing and may be any one or all of the following:
– the data subject has given consent to the processing of his/her personal data for one or more specific purposes (and our customer relying on this basis receives this consent) (e.g. Article 6(a) of the General Data Protection Regulation); or
– processing is necessary for a legitimate interest of our customer (exam sponsor) to enable exam rules to be applied consistently and for cheating to be identified (e.g. Article 6(f) of the General Data Protection Regulation).
If you use our online invigilation service, to take assessments, we may also collect and record further information about you when you take your online invigilated exam, such as your name, email address, captured facial photo, captured ID photo/government issued ID, IP address, browser agents, browser and operating system identifiers, screenshots of your PC, your exam setting (home, office etc), all recorded video streams (computer, webcam and mobile), awarding organisation whose exam you are sitting and other assessment based data that may be collected, including information about browser version, appVersion, appName, product and appCodeName, video frame size, type and library used for encoding, framerate, jitter, packet loss and bandwith.
We will retain your personal data no longer than is necessary for the purposes for which it is processed. The length of time for which we retain information may also depend on the specific retention periods set out by your awarding organisation.
When you use our online invigilation services, we use selected third party service ProctorExam that is hosted in in Germany (Frankfurt Region) or USA (for North America based customers), to process your data on our behalf. As part of the provision of the service by Surpass Assessment to your awarding organisation, you agree that some or all of the above personal data may be processed outside the UK and EEA. In such circumstances, and if you are based in the UK or EU, we will, as required by GDPR, ensure that your privacy rights are protected by appropriate safeguards.
We do not share any data we obtain about you as part of the online invigilation service with third parties except in the limited circumstances detailed below:
Where our customers store personal information within our service, our customer is the data controller and determines and is responsible for the length of time during which personal information is retained. Surpass Assessment acts in accordance with the data controller’s instructions and may not retain personal information contrary to these instructions.
You have, or if you are a child your parent/guardian has, the right to access, correct, edit, or delete any of your personal information processed as part of the online invigilation service. For any such requests, please work directly with your awarding organisation/test sponsor (our customer), or you can contact us at firstname.lastname@example.org.
Our appointed representative in the EEA is:
1079 LK Amsterdam
Telephone: +31 20 2252200