Privacy Policy
Last updated: May 2025 · Version 1.0
Data controller
The educational institution that contracts Klarway's services acts as the data controller for students' personal data. Klarway acts as the data processor, processing data on behalf of the institution and in accordance with its instructions, under a Data Processing Agreement (DPA) signed between both parties.
Data we collect
To provide the proctoring service, Klarway processes the following categories of data:
- Identity data: full name, image of the identity document, photograph of the face.
- Biometric data: facial comparison for identity verification (processed with the special safeguards required by applicable regulations).
- Audiovisual data: video and audio recording during the exam.
- Behavioral data: detection of irregular activities through AI analysis of audio and photo/video.
- Technical data: device information, operating system, internet connection and active applications.
Purpose of processing
Data is processed exclusively to:
- Verify the student's identity before the exam.
- Monitor the assessment and detect irregularities.
- Generate session reports for the educational institution.
- Comply with applicable legal obligations.
Legal basis for processing
Processing is based on the educational services contract between the student and the institution, and in compliance with academic assessment integrity obligations. For biometric data, the student's explicit consent is obtained in accordance with the requirements of Article 9 of the GDPR and equivalent local regulations.
Data retention
Session data (video, audio, reports) is retained for the period established by the responsible educational institution, which will not exceed applicable legal deadlines. Once that period has elapsed, data is securely and irreversibly deleted.
International transfers
Klarway hosts its data on Google Cloud Platform (GCP) in selected regions to ensure regulatory compliance for each jurisdiction. International transfers, where applicable, are carried out with adequate safeguards in accordance with the GDPR and local regulations.
Data subject rights
Students have the right to access, rectify, erase, object to and request the portability of their personal data, as well as to request the restriction of its processing. These rights must be exercised with the responsible educational institution. For additional assistance, contact us at info@klarway.com.
Security
Klarway implements appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or disclosure. Klarway's quality management system holds a current ISO 9001 certification.
Policy updates
This policy may be updated periodically to reflect changes in our practices or legal requirements. We will notify you of any significant changes through the usual communication channels with your institution.
Contact
For enquiries about privacy and data protection, contact us at info@klarway.com.