Privacy Policy

This policy covers the personal data the Scholasticus platform holds: the public website, the console, the exam application served on an institution’s own subdomain, and the services behind them.

Two different relationships run through the platform, and the roles are different in each:

Your institution is the controller

for the data of its members and candidates — who they are, what they answered, what was observed while they answered. It decides what is collected and why. We process it on its instructions, as its processor.

We are the controller

for the account relationship itself: the account you created, the billing contact for a workspace, our security records, and our correspondence with you.

Where we are the controller, that controller is a person rather than a company: Scholasticus is a name one individual established in Denmark trades under, and there is no company behind it. The Terms of Service set out who you are dealing with, and how to obtain that person’s name and address.

No data protection officer has been appointed. A request or a complaint is answered by that person, at [email protected].

For the account relationship, where we are the controller, we hold:

We never see or store card details. Payment is taken on the payments provider’s own hosted checkout, and what comes back to us is the identifiers above and whether the subscription is active.

Inside a workspace, where the institution is the controller and we are its processor, the platform holds:

What is in an exam, and what a workspace requires at sign-in, is decided by the institution. If it asks for more than the assessment needs, that is a matter for it and its own obligations — and the Acceptable Use Policy says not to.

While an exam is open, the platform records what a browser can honestly report and nothing else:

• Presence — whether a live connection was being held, and for how long it was not.
• Focus — whether the exam page was the foreground document, and when that changed.
• Reconnection — how many times the connection dropped and returned.
• Timing — when the attempt opened, when each answer was last written, and when it was submitted, timed by the server.
• The client’s own description of itself — browser, operating system, time zone — and the network address the request arrived from.
• Interventions — a message to a candidate, extra time, a block or a removal, and which administrator did it.

There is no camera, no microphone, no screen recording, no keystroke logging and no inspection of the device. No software is installed on a candidate’s machine. Nothing is inferred from these signals: they are stored as observations, and the platform draws no conclusion from them, assigns no score to them and takes no action on them.

Presence while an exam is running is held in a cache so that two hundred candidates’ heartbeats do not reach the database; the durable record of the attempt is what remains afterwards.

Four things are encrypted at rest with keys scoped to the workspace that owns them: submitted answers, saved drafts, the private values a workspace requires at sign-in, and a workspace’s billing email address. Passwords are stored as hashes and are never recoverable. Everything travels over TLS.

Inside a workspace, what a member can see is decided by the role the workspace gave them. Across workspaces, nothing is shared unless both agree to share it.

Our own access is limited to what running the platform requires — diagnosing a fault, restoring from a backup, investigating abuse — and we do not read exam content or answers except where one of those requires it and the institution has asked or been told.

Sign-in runs on an identity component we host ourselves, on the same infrastructure as the rest of the platform. Credentials are not sent to a third-party identity provider.

This website sets one cookie. It is called scholasticus-color-mode, it holds the word light or dark, and it is written only when you use the colour switch. It exists so that the console paints in the scheme you chose here. The same value is kept in your browser’s local storage. There is no analytics, no advertising and no third-party tracker on these pages.

The console and the exam application set a session cookie when you sign in, which is what keeps you signed in, and a short-lived cookie confirming that a sensitive operation was authorised. Both are necessary for the service to work and neither is used for anything else.

Rate limiting works from the network address a request arrived from, held briefly in a cache. It is how the platform stops one source from exhausting a shared resource.

Where we are the controller, we rely on these bases under the General Data Protection Regulation:

Performance of a contract

To give you an account, to run a workspace on the plan it is on, and to bill for it.

Legitimate interests

To keep the platform secure and available — session records, rate limiting, error reports, abuse investigation — and to understand in aggregate how the platform is used. We do not rely on this for anything that would surprise you.

Legal obligation

To keep the records Danish accounting and tax law requires, and to answer a lawful request from an authority.

Consent

Only where we ask for it, and it can be withdrawn. Nothing on this website depends on it.

For the data of members and candidates inside a workspace, the institution decides the basis and is the one that must tell you what it is. Where its assessment records rest on a public task, a contract or its own legitimate interests is its decision, not ours.

We do not sell personal data, we do not share it for advertising, and we do not use it to train models. It is processed by us, by the providers below on our behalf, and by nobody else — except where you or your institution direct it, or where the law requires it.

Each is engaged under a data processing agreement and may process only what its function requires. The identity component is not on this list because it is not a third party: it runs on our own infrastructure.

We may also disclose data where the law compels it, to establish or defend a legal claim, or to protect somebody from harm. Where we are permitted to tell you that we have, we will. If the business is transferred, the data moves with it and this policy continues to apply until you are told otherwise.

The platform runs in the European Union, and the databases and the object storage that hold exams, attempts and answers are in the EU.

Some of the providers above operate outside the European Economic Area, or route requests through a global network: the edge, payments, email delivery and error monitoring. Where personal data reaches one of them outside the EEA, the transfer rests on an adequacy decision where the destination has one, and otherwise on the European Commission’s standard contractual clauses together with the measures the provider applies.

Ask us and we will tell you which providers are involved in a particular feature and on what basis.

We keep personal data for as long as the purpose it was collected for lasts, and no automatic clock deletes an exam record — because how long an institution must keep its assessment records is the institution’s decision and its legal obligation, not ours.

A deletion in the platform is a deletion, not a flag: the rows go, and what depended on them goes with them. That is why the Terms of Service tell you to export first.

Under the General Data Protection Regulation you may ask for access to your personal data, for it to be corrected, for it to be deleted, for its processing to be restricted, for it in a portable form, and you may object to processing based on legitimate interests. Where we have asked for consent, you may withdraw it.

Whom to ask depends on what it is about. For your assessment record — an exam you sat, an answer you gave, what was observed while you sat it — ask the institution that ran the exam: it is the controller, and it is the only party that can decide. If you ask us, we will pass the request to that institution and tell you we have done so; we will not refuse it and we will not answer it in the institution’s place.

For your account itself, ask us. You can also do much of it yourself: the console shows your account, lets you correct it, and deletes it — permanently — when you ask it to.

Write to [email protected]. We answer within one month, and will say so if a request is complex enough to need longer. We may ask you to confirm who you are, which is not obstruction: the alternative is disclosing somebody’s exam record to whoever asked for it.

If you are not satisfied with how we have handled a request, you may complain to the data protection authority in your country. Ours is Datatilsynet, the Danish Data Protection Agency, because that is where the controller is established — section 1 says who that controller is. We would rather you told us first, but that right does not depend on it.

The measures that matter, and that are actually in place:

• Everything travels over TLS, terminated at the edge and again inside the deployment.
• Answers, drafts, the private values a workspace collects at sign-in and a workspace’s billing email are encrypted at rest with keys scoped to that workspace. Passwords are stored as hashes.
• Files attached to exams sit in a private bucket that is not publicly readable, and are delivered through a signed URL that names one file.
• What a member can see is decided by the role their workspace gave them, and enforced on the server rather than in the browser.
• Rate limits and abuse detection protect shared resources, including during an exam.
• The database has a standby, so a failure is a recovery rather than a loss.
• Faults are reported to an error-monitoring service and acted on; access by us is limited to what running the platform requires.

No system is beyond compromise. If a breach affects your personal data and is likely to be a risk to you, we will tell Datatilsynet within 72 hours of becoming aware of it and tell the institutions and people affected without undue delay, with what we know and what we are doing about it.

The platform is provided to institutions, not offered directly to children, and there is no consumer sign-up for a person to bring a child onto it.

An institution may of course assess people below the age of digital consent in its country — a school running an exam is the obvious case. Where it does, that institution is the controller: it is responsible for the lawful basis, for any consent required, and for telling candidates and their guardians what is recorded. We process what it instructs and nothing more.

There is no automated decision-making and no profiling on the platform.

Nothing is graded automatically: a score and its feedback are recorded against the account that entered them. Nothing is decided from a connection record: a block or a removal is recorded against the administrator who applied it. No score, no risk rating and no suspicion level is computed from the signals in section 4, and none is available to an institution to act on, because none exists.

If that ever changes it will be described here first, with the logic involved and what it would mean for you, and no workspace will be opted into it by default.

We will update this policy as the platform changes. The version and the effective date at the top of the page change with it, and where a change materially affects you we will tell the institutions and account holders affected before it takes effect rather than leaving you to notice.

Questions, requests and complaints: [email protected]. We are Scholasticus, and a person reads that address.

The Terms of Service set out the agreement this policy sits inside, and the Acceptable Use Policy sets out what institutions may do with the records described here.