Data Processing Addendum (DPA), version 1.0

1. What this is.

This addendum is part of the agreement between AssessIQ and the organisation that signs up ("the Organisation"). It explains who is responsible for candidate data. It applies when the Organisation ticks the box at sign-up, or accepts it in writing.

2. Roles.

The Organisation decides why and how it tests people. For candidate data, the Organisation is the controller (data fiduciary) and AssessIQ is the processor. AssessIQ uses candidate data only to run the platform for the Organisation, on the Organisation's instructions. For the Organisation's own account data and for the public website, AssessIQ is the controller.

3. What data AssessIQ handles for the Organisation.

Candidate name and email; answers; start, pause and submit times; browser and device information; an IP address for security; activity events (for example leaving full screen, switching tabs, copy and paste); the result of the readiness check; and, only for a real exam with the camera on, photos and low-size video.

4. The Organisation's promises.

The Organisation (a) has a lawful basis for testing each candidate and gets any consent that the law requires; (b) gives each candidate a notice before the test (the platform shows a start-screen notice that names the Organisation); (c) uses the data only for lawful purposes; (d) is responsible for every decision about a candidate; (e) will not use the platform for anything illegal.

5. AI scores are advice.

Some written answers are scored with AI help. An AI score is advice only. A named person at the Organisation reviews it and decides what happens to the candidate. AssessIQ does not make decisions about candidates.

6. Camera.

A real exam may use the camera. The Organisation chooses to run real exams, and for a real exam the camera is on unless this section says otherwise. A mock test never uses the camera. For a school, the school admin decides whether the camera is on; if it is off, no photo or video is taken. The Organisation must tell each candidate before the test that the camera is used, and the candidate can choose "I do not agree, do not start". Photos and video are used only to review the exam and are not used to identify a person by face or to judge emotion.

7. Adults and schools.

The Organisation confirms that every candidate in a camera-on real exam is 18 years or older, or that the school or guardian has agreed to the camera for that candidate. For candidates who are children, the Organisation (for example the school) is responsible for getting the consent that the law requires.

8. How long data is kept.

Photos are deleted 90 days after they are taken, and video 7 days after it is recorded. For schools, photos and video are kept 7 days. If an attempt is flagged and a candidate appeals, the photos and video stay until the appeal closes, up to 90 days for schools and up to 1 year for other organisations. On an erasure request they are deleted sooner. Other candidate data is kept while the Organisation's account is active and is deleted when the Organisation asks, or after the Organisation's account is closed, as the privacy page describes.

9. Uploads.

The Organisation keeps ownership of what it uploads. It uploads at its own risk, for use within its own tests, and confirms that it owns the content or has the right to use and upload it. It gives AssessIQ a licence to store, process and run the service with that content. AssessIQ does not use one Organisation's uploads for other organisations.

10. Security and breaches.

AssessIQ keeps data safe with reasonable measures: encryption in transit, access control for each Organisation, an audit log and backups. If AssessIQ confirms a personal data breach, it tells the Organisation within 48 hours, so the Organisation can meet its own duties.

11. Sub-processors.

AssessIQ uses the sub-processors listed on the privacy page (server hosting, network security, email, optional Google sign-in, AI-assisted evaluation). AssessIQ gives notice on the website before it adds one. Sub-processors may not use data for their own purposes.

12. Requests from candidates.

If a candidate asks to see, correct or delete data, the Organisation sends the request to AssessIQ. AssessIQ helps the Organisation to answer it and confirms when data is deleted.

13. Liability and cost.

Section 11 (liability) and section 12 (misuse and indemnity) of the Terms apply to this DPA. The Organisation pays for claims, fines and costs that come from its own instructions, its missing notice or consent, its uploads, or its decisions about candidates. AssessIQ's total liability is limited as the Terms say.

14. Ending.

When the agreement ends, AssessIQ returns or deletes the Organisation's data within 30 days, unless the law requires it to keep some data.

15. New versions.

AssessIQ may publish a new version. The Organisation must accept it before it starts its next test.

16. Law.

Indian law applies, as in the Terms.