The General Data Protection Regulation (GDPR) is the toughest privacy and security law in the world which stands for the data privacy. Though it was drafted and passed by the European Union (EU), it imposes obligations onto organizations anywhere, as long as they target or collect data related to people in the EU. The aim of this page is to help our customers comply with the GDPR and educate test-takers about their rights.
The two main roles described in GDPR are data processor and data controller. GDPR defines data controllers as an entity that determines the purposes for which and the means by which personal data is processed. The data processor processes personal data only on behalf of the data controller as per the requirements of the data controller.
OctoProctor acts as a data processor and processes data on behalf of its clients/organizations who act as data controllers. The data controllers specify the kind of data required from the data subject (test-taker) and OctoProctor collects the specified data before or during the assessment and then processing it as per data controller's instructions
Privacy and data protection are of the utmost importance to us and we take steps to protect personal data in accordance with global data protection laws.
From our website visitors, to professors and test-takers, we aim to provide all of our users with clear explanations about the information we collect, how that information is used, the contexts in which it may be shared, and provide all other disclosures and rights available under applicable privacy laws.
Visit OctoProctor Trust Center to learn about our security posture and request access to our security documentation.
A few of the steps that we undertake to achieve the compliance:
Our Data Proctection team will be happy to answer your questions or receive feedback. Please let us know if you encounter any issues:
Phone: +1 302 883-888-5
E-mail: info@octoproctor.com
We maintain security at the infrastructure level by vetting each provider we use and ensure that every point of connection between providers is correctly initiated and consistently maintained.5. Backing up data ensures that no single system failure will damage the security. So we take it seriously and have weekly backups which are created on a daily basis (overnight backups for the last seven days).
We have established specific data erasure procedures to comply with the new "right to be forgotten" obligations and understand when these and other data subject rights apply, as well as any exceptions, response times and notification requirements. Our standard retention policy is for data collected from regulated activities, including biometric data, to be retained for up to 360 days after the session, as well as identity data and data collected for authentication purposes (including those we use to create your identity information). The data might be deleted earlier upon request of the test-taker or the organization. The software provides an option of automated data deletion schedule.
As a person who uses the software, you're a data subject. The GDPR aims to give individuals more control over the data they loan to organizations. Here is the list of the data subjects' privacy rights:
