In short: the institute is in charge of the personal data it puts into ThinkTest. NVDRA Technologies processes that data only to provide the Service on the institute’s instructions, keeps it confidential and secure, uses vetted service providers, helps with requests and incidents, and returns or deletes the data when the institute leaves.
Scope and roles
These Data Processing Terms form part of the Terms of Service between NVDRA Technologies (“we”) and each institute that uses ThinkTest. They apply to personal data that the institute or its Users put into ThinkTest (“Institute Data”).
- The institute decides why and how Institute Data is processed (it is the “controller”).
- NVDRA Technologies processes Institute Data on the institute’s behalf (it is the “processor”).
- Data we use for our own purposes (NVDRA accounts, billing, security logs), and data people keep in their personal use of ThinkTest, is covered by our Privacy Policy, not by these terms.
Details of the processing
| Subject matter | Providing ThinkTest and the connected NVDRA applications chosen by the institute. |
|---|---|
| Duration | While the institute’s account is open, plus the return and deletion period below. |
| People concerned | Students (often children), teachers and institute staff. |
| Types of data | Names, classes and sections, questions, exam answers, marks, results and focus-loss counts. |
| Operations | Collecting, recording, storing, organising, displaying, transmitting (including by email and push notification), backing up, exporting and deleting. |
Processing only on the institute’s instructions
We process Institute Data only to provide, secure and support the Service, as set out in the Terms, these Data Processing Terms and the settings the institute chooses, or as required by law. If the law requires us to process it in another way, we will tell the institute first unless the law forbids it. If we think an instruction breaks the law, we will say so.
We do not sell Institute Data, use it for advertising, or combine it with other data to build profiles of people.
The institute’s duties
- Have a lawful basis, and consent where needed, for the data it enters.
- Tell its people clearly how it uses ThinkTest (it may link to our Privacy Policy).
- Enter only the data it needs, keep it accurate, and set roles so that each person sees only what they need.
- Keep its own sign-in details and devices secure, and remove access promptly when someone leaves.
Confidentiality and our staff
Only NVDRA staff who need access to provide support, maintain the Service or keep it secure may access Institute Data. They are bound by confidentiality and their access is recorded. Signing in as a User from the NVDRA Admin Panel is limited to senior administrators, needs a recorded reason, shows a visible banner, ends by itself and is kept in the audit log.
Security measures
- Encrypted connections (HTTPS) for all access, and one-way hashing of passwords.
- Role-based access within each institute, and separation of each institute’s data from others’.
- Private files stored outside the public web folder; signed and verified connections between NVDRA applications.
- Regular backups, security updates and monitoring, and audit logs of sensitive actions.
Service providers (sub-processors)
The institute authorises us to use service providers to help provide the Service, currently in these categories: hosting and backup; email delivery; and browser and phone push notification services. We give each provider only the data it needs, require it to protect the data, and remain responsible for its work. We will update the list in the Privacy Policy before adding a new category of provider, and a institute that objects on reasonable grounds may close its account and receive a refund of the unused part of its paid year.
Helping with requests
If someone contacts us directly about Institute Data, we will refer them to the institute and, where appropriate, tell it. The institute can answer most requests itself in ThinkTest. Where it cannot, we will help within a reasonable time.
Security incidents
If we become aware of a breach of security leading to accidental or unlawful loss, alteration, disclosure of or access to Institute Data, we will notify the institute without undue delay, and in any case within 72 hours of confirming it, with what we know about what happened, the data affected and what we are doing about it. We will help the institute inform the people affected and any authority where required.
Return and deletion of data
- While its account is open, the institute can export its records and delete records and files.
- When the institute closes its account, the data stays available for export for 30 days. We then delete it from the live system within a further 60 days. Backups are overwritten within 90 days.
- We may keep data longer only where the law requires us to, and only for that purpose. On request we will confirm deletion in writing.
Requests from authorities
If a court or authority asks us for Institute Data, we will check that the request is lawful, disclose only what is required, and tell the institute before disclosing, unless the law forbids it.
Information and audits
We will give the institute the information reasonably needed to show that we meet these terms, for example by answering a security questionnaire once a year. Any on-site audit must be agreed in advance, be reasonable in scope, and respect the confidentiality of other organisations’ data.
Contact
NVDRA Technologies
Email: support@nvdra.com