GDPR and Exam Data

TrustExam is operated by Integrity Tech Inc., incorporated in Delaware, United States, at 320 High St, Palo Alto, CA 94301, USA. This page explains our approach to exam data and the GDPR requirements to address when planning an examination programme in the European Union or European Economic Area (EU/EEA).

It supplements our Website Privacy Policy. The exam organiser must provide a notice describing the actual processing for its programme. This overview does not replace that notice, a signed data processing agreement, or an assessment of the deployment.

1. Who is responsible for exam data?

The organisation deciding why and how an examination is conducted will generally be the data controller for that programme. Where TrustExam processes exam data on its behalf and under its documented instructions, TrustExam acts as a data processor. Roles depend on the actual processing, not simply the wording of a contract.

Integrity Tech Inc. separately determines the handling of enquiries submitted through this website. That activity is covered by the Website Privacy Policy.

2. What data can an exam involve?

Depending on the modules enabled, an examination may involve participant and session identifiers, answers or submitted code, identity-check photographs, camera or screen recordings, technical events, proctoring signals and review reports. The exact categories depend on the programme and its configuration; not every examination uses every feature.

Before collection, the organiser needs to explain the purposes, enabled checks, recipients, retention periods or criteria, and available rights. The deployment should collect only data needed for its stated purpose and limit access to people who need it. Programmes involving children or accessibility needs require particular assessment.

3. Lawful basis and identity checks

When GDPR applies, the controller must identify an appropriate Article 6 lawful basis for each purpose. Agreeing to exam rules is not automatically valid consent to every type of processing. If consent is used, it must meet the GDPR conditions and be withdrawable.

A photograph is not automatically special-category biometric data. If technical processing uses biometric data to uniquely identify a person, an applicable Article 9 condition is also needed. The necessity, proportionality and available alternatives for an identity check should be assessed before it is enabled.

4. AI, proctoring signals and decisions

TrustExam uses exam recordings, participant photographs and answers for conducting and reviewing the examination. We do not use them to train our own AI models or third-party AI models.

Automated checks can flag events or interrupt an attempt according to the exam configuration. A flag alone should not be treated as a final finding of misconduct. The organiser should define a meaningful review and appeal process, including how a participant can explain an event.

Where a solely automated decision has legal or similarly significant effects, the restrictions and safeguards in GDPR Article 22 must be assessed. Human review must be meaningful where required; a technical ability to generate a score or block an attempt does not by itself establish a lawful basis for the decision.

5. Retention and deletion

Retention periods for exam recordings and reports are set in the customer contract. For an EU/EEA deployment, the schedule should identify the relevant data categories, the retention period or objective criteria, the start of that period, any justified appeal or legal-retention requirements, and deletion or return arrangements, including backup handling.

Contractual retention must still meet applicable law and the purpose of processing. A contract is not a justification for keeping personal data indefinitely. Website enquiries follow the separate Website Privacy Policy.

6. Your rights and how to make a request

Where GDPR applies, you may have rights to access and correct your data, request erasure or restriction, object to processing, and receive portable data where the relevant conditions are met. If processing relies on consent, you can withdraw it without affecting the lawfulness of earlier processing. You can also complain to a competent data protection authority.

For exam data, contact the organiser identified in your exam notice. You can also write to info@trustexam.ai to ask for help identifying the relevant contact. Include the organiser, approximate exam date and the nature of your request. Please do not send identity-document copies, passwords or exam recordings in an initial email. Any necessary identity verification should use an appropriate channel.

The responsible controller must respond without undue delay, normally within one month. GDPR allows an extension of up to two further months where necessary because of the complexity or number of requests, with notice and reasons within the first month. Rights are subject to applicable conditions and exceptions. Challenging an exam result is a separate process under the organiser’s rules.

7. Data processing agreements and security

Before an EU/EEA deployment, the parties need an appropriate binding data processing agreement (DPA). It should cover instructions, confidentiality, security, subprocessors, assistance with rights requests and incidents, deletion or return, and audit information. A template must be completed for the actual service and agreed by the parties.

The deployment review should document hosting and access arrangements, authorised personnel, technical and organisational measures, and the subprocessors involved. Ask info@trustexam.ai for the information needed for your procurement and security review. This page does not establish a security certification or a completed GDPR compliance assessment.

8. International transfers

The proposed deployment must account for the locations of storage, backups, support access and subprocessors. Hosting data in the EU/EEA does not alone resolve all questions about access or transfers from other countries.

Where GDPR transfer rules apply, a valid transfer mechanism is required, such as an applicable adequacy decision or appropriate safeguards. Standard Contractual Clauses may be suitable in qualifying circumstances, together with the required assessment and any necessary additional measures. The mechanism must fit the actual parties and data flows; this page does not incorporate or execute transfer clauses.

9. Preparing an EU/EEA programme

Before launch, the organiser and TrustExam need to resolve the programme’s data flows, lawful bases, participant notice, retention schedule, DPA, security and transfer arrangements. A data protection impact assessment (DPIA) is required where processing is likely to create a high risk to people’s rights and freedoms.

The need for a data protection officer (DPO) and, for a non-EU organisation, an EU representative must be assessed against GDPR Articles 37 and 27 respectively. They are different roles. This page identifies our general privacy contact; it does not identify an appointed DPO or EU representative.

10. Contact and official guidance

Privacy and deployment enquiries: info@trustexam.ai. Integrity Tech Inc., 320 High St, Palo Alto, CA 94301, USA.

Further information: GDPR official text, EDPB guidance on individual rights, and European Commission guidance on Standard Contractual Clauses.

Related documents: Website Privacy Policy and Website Terms of Use.