Data processing agreement
How ExamLense processes personal data on an institution’s behalf, under the Data Protection Act, 2012 (Act 843).
Roles and scope
The institution is the data controller and ExamLense is its data processor. This agreement forms part of the terms of service and covers all personal data ExamLense processes for the institution.
- Whose data: candidates, and the institution’s staff who use the consoles.
- What data: names, contact details, identity document and face photographs, examination answers, proctoring evidence and console activity.
- Why: to verify identity, deliver and proctor examinations, support review, and keep the audit record.
- How long: for the term of the agreement, within the retention periods the institution sets.
Instructions
ExamLense processes personal data only on the institution’s documented instructions, which are the agreement and the settings the institution chooses, unless Ghanaian law requires otherwise. It does not use the data for its own purposes, for marketing or to train models, and it treats the data as confidential. Everyone at ExamLense with access is bound to confidentiality.
Security
ExamLense keeps in place the technical and organisational measures described on our security page to prevent loss of, damage to, or unauthorised access to personal data, and reviews them as risks change. These include encryption at rest and in transit, separation of every institution’s data, multi-factor authentication for staff, least-privilege access, and an audit log that cannot be edited.
Where data is held
Personal data is stored in the Amazon Web Services Europe (Ireland) region, eu-west-1. ExamLense will not move it elsewhere without telling the institution first.
Sub-processors
The institution authorises the sub-processors in the list of sub-processors. ExamLense binds each to obligations no weaker than these, remains responsible for what they do, and gives thirty days’ notice before adding or replacing one. An institution that objects on reasonable grounds may end the agreement and be refunded its unused credits.
Helping the institution
ExamLense passes on without delay any request it receives from a data subject and gives the institution the means and the help to answer within the forty days the Act allows, to correct or delete data, and to stop processing where a data subject asks. It also helps with enquiries from the Data Protection Commission.
Security compromises
Where there are reasonable grounds to believe personal data has been accessed or acquired by an unauthorised person, ExamLense notifies the institution as soon as reasonably practicable after discovery, with what is known of the nature of the compromise, the data and people affected, and the steps taken, so that the institution can notify the Commission and the data subjects.
Records and audit
ExamLense keeps records of its processing and makes available what the institution reasonably needs to show compliance. Once a year, or after a security compromise, the institution may audit this agreement on reasonable notice, in a way that does not expose other institutions’ data.
When the agreement ends
The institution may export its records. ExamLense then deletes the institution’s personal data within ninety days, except what the law requires it to keep, and confirms in writing when asked.