PRIVACY POLICY DETAILED

Smiley Owl Tech S.L (hereinafter Smowltech) domiciled at Arturo Campion 22 Street, 20018, Donostia / San Sebastián, Gipuzkoa, Spain and contact email dpo@smowltech.com.

You can contact our Data Protection Officer (DPO) through the following e-mail: dpo@smowltech.com.

Smowltech automatically processes personal data with the purpose of authenticating users and identifying and observing inappropriate behavior when carrying out remote tests, exams or certifications, mainly in the university education sector. The purpose of the processing is to provide the service contracted by the Institution/University (responsible for processing) of which you are a part. In no case will they be used for other purposes not determined by the Data Controller.

The user’s data obtained by the platform are the following, depending on the package purchased:

Activity/user code. Smowltech receives all the information of the user's associated with an identifier from which it is not possible to extract the identity of the person, the relationship with the identity remains with the data controller. Smowltech does not obtain any information about the content of the user's online activity or quiz or the answers that the user provide.
First name, last name and email. Smowltech accesses this information in order to provide help to the user on the use of the system.
User system information: the system detects user system information such as the operating system and version or ip address that the student has used during their activity.
Browser lock: Detection of events by the student to try to exit the monitored activity.
Computer monitoring: Detection of the student's activity on their computer while carrying out the monitored activity, such as the programs in use, screenshots, detection of web browsing or use of commands.
Images and / or audios captured randomly by the user's devices, once the user has accepted the use of such devices.
Obtaining, through the images and audios, a biometric model of the user's characteristics in order to perform the authentication and subsequent verification of the user's identity.

Data controller: Smowltech acts at all times as data processor for the entities to which it provides the service for authentication and identification and analysis of inappropriate behavior. Smowltech offers a report with the results of the analysis carried out. Smowltech has signed the corresponding contracts in compliance with the regulations for the protection of personal data and applies the corresponding security measures, being actively responsible for guaranteeing the confidentiality of the data it processes.

The legal basis for the processing of data is the legitimacy based on the consent of the interested party provided for the purposes described above, which will be requested at the time of starting to use the system.

Conservation period: The personal data provided will be kept from the moment the user has given their consent until it is revoked. Likewise, as the data processor you will be subject to what is established by the Data Controller regarding the retention periods of the data, proceeding to its deletion once Smowltech stops providing service or the Data Controller himself has deleted the data. Biometric data is not preserved in any way since it is destroyed after authentication.

Possibility to withdraw consent: In the event that consent has been granted, the user has the right to withdraw consent at any time, without affecting the legality of the treatment based on consent prior to its withdrawal. In any case, the data controller will also be informed of the withdrawal of consent so that he or she can make the appropriate decisions.

Users may exercise the rights that correspond to them in this matter by written communication to the registered office of Smowltech or to the email address indicated in the heading of this legal notice, including in both cases a photocopy of their ID or other identification document, to request the exercise of the following rights:

Right to request access to personal data: you can ask Smowltech if they are processing your data.
Right to request rectification (in case they are incorrect): allows you to correct errors, modify data that turns out to be inaccurate or incomplete and guarantee the certainty of the information being processed.
Right to deletion: allows you to request the deletion of the data being processed when they are no longer necessary for the execution or provision of the service..
Right to object to the treatment: right of the interested party not to carry out the processing of their personal data or to cease it, except for legitimate reasons or for the exercise or defense of possible claims, in which case we will keep them blocked for the corresponding period as long as they persist. legal obligations.
Right to request the limitation of the treatment: In certain circumstances, interested parties may request the limitation of the processing of their data, in which case they will only be kept by Smowltech for the exercise or defense of claims..
Right to data portability.
Right not to be subject to automated individual decisions (including profiling): right not to be subject to a decision based on automated processing that produces effects or significantly affects.

Models, forms and more information about the referred rights: Spanish Data Protection Agency website.

How to complain to the Control Authority: If a user believes there is a problem with the way Smowltech is handling his/her data, they can direct their claims to the Smowltech DPO or the appropriate data protection authority (data protection authority), being the Spanish Agency for Data Protection Spanish Data Protection Agency the one indicated in the case of Spain.