Regional data protection policy

Effective date: July 22, 2025

This Regional data protection policy ("Policy") supplements our Terms of service and Privacy notice, providing additional protections and rights for individuals in specific jurisdictions. ProctorEdu, Inc. dba OctoProctor ("we," "us," or "our"), is committed to complying with all applicable data protection laws based on your location.

1. Scope and application

This Policy applies when we process personal data of individuals located in jurisdictions with specific data protection requirements, including but not limited to:

• European Union (EU GDPR)
• United Kingdom (UK GDPR)
• Switzerland (Swiss FADP)
• Brazil (LGPD)
• United States state privacy laws (California CCPA/CPRA, Virginia VCDPA, Colorado CPA, and others
• Canada (PIPEDA and provincial laws)
• Australia and New Zealand

2. Our role in data processing

2.1 Data processing relationships

• When serving Testing Institutions: We act as a Data Processor (or Service Provider under US laws), processing personal data on behalf of Testing Institutions who act as Data Controllers
• When providing direct services: We may act as a Data Controller for account management and service delivery
• Sub-processing: When Testing Institutions are themselves Processors, OctoProctor acts as a Sub-processor

2.2 Lawful basis for processing

We process personal data based on:

• Contract performance: To deliver our proctoring services
• Legal obligations: To comply with applicable laws
• Legitimate interests: For service improvement and security (where permitted)
• Consent: Where required by law or for optional features

3. Data we process

3.1 Categories of personal data

During proctoring sessions, we may process:

• Identity data: Full name, test-taker identifier, email address
• Verification data: Government-issued ID images (where enabled)
• Biometric data: Facial recognition data for identity verification (where enabled)
• Session data: Video and audio recordings, screen captures, behavioral analytics
• Technical data: IP address, browser information, device identifiers
• Academic data: Test session metadata, timestamps, incident flags

3.2 Special category data

In jurisdictions where biometric data is considered a special category or sensitive personal data, we implement additional safeguards and obtain explicit consent where required.

4. Data location and transfers

4.1 Primary data location

All personal data is hosted on Amazon Web Services (AWS) infrastructure in Ireland (eu-west-1 region), ensuring data remains within the European Economic Area.

4.2 International data transfers

When data transfers outside the EEA are necessary:

• We use Standard Contractual Clauses (SCCs) approved by the European Commission
• For UK transfers, we implement the UK International Data Transfer Agreement (IDTA)
• For Swiss transfers, we apply the Swiss Federal Data Protection and Information Commissioner-approved mechanisms
• We conduct Transfer Impact Assessments where required

5. Data retention

5.1 Standard retention period

Client service retention: Personal data is retained for your Testing Institution's access for 6 months from the date of collection

Extended client service retention: With your explicit consent, we can extend retention for your Testing Institution's access to 12 months from the date of collection

Service improvement retention: When you provide explicit consent for us to use your data for service improvement purposes:

• Your Testing Institution continues to have access for the agreed period (6 or 12 months)
• We may retain an anonymized copy of your data indefinitely for research, analytics, and service improvement
• This anonymized data cannot be linked back to you as an individual
  

5.2 Retention exceptions

• Legal requirements: Data may be retained longer if required by law
• Active disputes: Data related to disputes or investigations may be retained until resolution
• Testing Institution policies: May specify shorter retention periods

6. Regional rights and protections

6.1 European Union, UK, and Switzerland

Individuals have the right to:

• Access: Obtain copies of personal data we process
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of personal data ("right to be forgotten")
• Restriction: Limit processing in certain circumstances
• Data portability: Receive data in a structured, machine-readable format
• Object: Object to processing based on legitimate interests
• Automated decision-making: Not be subject to solely automated decisions
• Supervisory authority: You may lodge complaints with your local data protection authority.

6.2 Brazil (LGPD)

Brazilian residents have similar rights to EU residents, plus:

• Anonymization or blocking: Request anonymization or blocking of unnecessary data
• Review: Review decisions made solely by automated processing
• Transparency: Receive clear information about data sharing
• Supervisory authority: Autoridade Nacional de Proteção de Dados (ANPD)

6.3 United States state laws

Residents of California, Virginia, Colorado, and other states with privacy laws have the right to:

• Know/Access: Information about personal data collection and use
• Delete: Request deletion of personal data
• Opt-out: Opt-out of sale or sharing (Note: OctoProctor does not sell personal data)
• Correct: Request correction of inaccurate data
• Non-discrimination: Not be discriminated against for exercising rights
• Limit use: Limit use of sensitive personal data

California specific:

• "Shine the Light" requests for information about data sharing
• Opt-out of behavioral advertising (if applicable)

6.4 Canada

Canadian residents have rights under PIPEDA and provincial laws to:

• Access: Request access to personal information
• Correction: Correct errors or omissions
• Withdrawal of consent: Withdraw consent (subject to legal or contractual restrictions)
• Complaint: File complaints with the Privacy Commissioner

6.5 Australia and New Zealand

Residents have the right to:

• Access: Access personal information we hold
• Correction: Request corrections to personal information
• Anonymity: Deal with us anonymously where practicable
• Cross-border disclosure: Be informed about overseas disclosures

7. Children's data protection

7.1 Age restrictions

• Direct services: Not intended for individuals under 13 years of age
• Through Testing Institutions: May be used by individuals under 18 with appropriate consents

7.2 Special protections

For individuals under 18:

• Testing Institutions must obtain verifiable parental consent where required
• We implement age-appropriate privacy safeguards
• Anonymity: Deal with us anonymously where practicable
• Marketing and profiling activities are prohibited

8. Security measures

We implement comprehensive security measures including:

• Encryption: AES-256 for data at rest, TLS 1.2+ for data in transit
• Access controls: Role-based access with multi-factor authentication
• Monitoring: 24/7 security monitoring and intrusion detection
• Training: Regular data protection training for all staff
• Audits: Regular security assessments and penetration testing
• Incident response: Established procedures for security incidents

9. Data breach notification

9.1 Notification timeline

• To authorities: Within 72 hours where required by law
• To affected individuals: Without undue delay when high risk to rights
• To Testing Institutions: As soon as reasonably possible

9.2 Notification content

Breach notifications include:

• Nature of the breach
• Categories and approximate number of individuals affected
• Likely consequences
• Measures taken or proposed
• Contact details for more information

10. Third-party sub-processors

10.1 Current sub-processors

• Amazon Web Services (AWS): Infrastructure hosting (Ireland)

10.2 Changes to sub-processors

• We provide 30 days advance notice of sub-processor change
• Testing Institutions may object to new sub-processors
• We ensure all sub-processors meet equivalent data protection standards

11. Exercising your rights

11.1 How to submit requests

• Email: info@octoproctor.com
• Portal: Through your Testing Institution's administrator
• Mail: ProctorEdu Inc., 111 Pier Ave STE 100, Hermosa Beach, CA 90254, United States

11.2 Identity verification

We may request information to verify your identity before processing requests.

11.3 Response timeline

• Acknowledgment: Within 5 business days
• Response: Within 30 days (may be extended by 60 days for complex requests)

11.4 Fees

Rights requests are generally free, but we may charge a reasonable fee for excessive or repetitive requests.

12. Data protection contacts

12.1 Data protection officer

For data protection inquiries:

• Email: info@octoproctor.com
• Phone: +1 302 883-8885

12.2 EU/UK representative

[To be appointed if required based on business operations]

13. Updates to this policy

We have collected the following categories of personal information in the past twelve (12) months:

• Email notification to Testing Institution administrators
• Prominent notice on our website
• In-app notifications where applicable

14. Relationship with other policies

This Policy supplements and should be read in conjunction with:

• Our Terms of service
• Our Privacy notice
• Our GDPR compliance information
• Any Data processing agreement with your Testing Institution

15. Contact information

For questions about this Policy or your privacy rights:

• Email: info@octoproctor.com
• Phone: +1 302 883-8885
• Mail: ProctorEdu Inc., 111 Pier Ave STE 100, Hermosa Beach, CA 90254, United States