PRIVACY POLICY DETAILED

Smiley Owl Tech S.L (hereinafter Smowltech) domiciled at Arturo Campion 22 Street, 20018, Donostia / San Sebastián, Gipuzkoa, Spain and contact email dpo@smowltech.com.

You can contact our Data Protection Officer (DPO) through the following e-mail: dpo@smowltech.com.

Smowltech automatically processes personal data with the purpose of authenticating users and identifying and observing inappropriate behavior when carrying out remote tests, exams or certifications, mainly in the university education sector. The purpose of the processing is to provide the service contracted by the Institution/University (responsible for processing) of which you are a part. In no case will they be used for other purposes not determined by the Data Controller.

The user's data obtained by the platform are the following, depending on the package purchased:

Activity/user code. Smowltech receives all the information of the user's associated with an identifier from which it is not possible to extract the identity of the person, the relationship with the identity remains with the data controller. Smowltech does not obtain any information about the content of the user's online activity or quiz or the answers that the user provide.
First name, last name and email. Smowltech accesses this information in order to provide help to the user on the use of the system.
User system information: the system detects user system information such as the operating system and version or ip address that the student has used during their activity.
Browser lock: Detection of events by the student to try to exit the monitored activity.
Computer monitoring: Detection of the student's activity on their computer while carrying out the monitored activity, such as the programs in use, screenshots, detection of web browsing or use of commands.
Images and / or audios captured randomly by the user's devices, once the user has accepted the use of such devices.

Data controller: Smowltech acts at all times as data processor for the entities to which it provides the service for authentication and identification and analysis of inappropriate behavior. Smowltech offers a report with the results of the analysis carried out. Smowltech has signed the corresponding contracts in compliance with the regulations for the protection of personal data and applies the corresponding security measures, being actively responsible for guaranteeing the confidentiality of the data it processes.

The lawfulness of processing data for fraud prevention purposes in assessment tests is determined on a case-by-case basis by the data controller. In any event, features such as the camera, microphone, or screen monitoring will not function unless expressly enabled by the user. Additionally, Smowltech may request your consent to collect data for statistical analysis purposes.

Conservation period: The data will be automatically deleted once the retention period stipulated in the data processing agreement has expired (e.g., after the publication of final records or the resolution of complaints). Retention periods are determined in each case by the data controller, and Smowltech follows their instructions. Data processed under Smowltech's responsibility—data relating to the use of the tool—is anonymized as soon as it is collected and is subsequently recorded indefinitely for statistical purposes, subject to Smowltech's operational need for this statistical information. When a data controller determines the deletion of data, Smowltech receives the request linked to one or more students, designated by the alphanumeric pseudonym associated with the information, which is the only identifier formally registered by Smowltech. Upon receiving such a request, Smowltech marks the data as "inactive" and blocks it for a period of three years, in accordance with Article 32 of the Spanish Organic Law on Data Protection and Digital Rights (LOPDGDD). After this period, the data is permanently deleted.

Possibility to withdraw consent: In the event that consent has been granted, the user has the right to withdraw consent at any time, without affecting the legality of the treatment based on consent prior to its withdrawal. In any case, the data controller will also be informed of the withdrawal of consent so that he or she can make the appropriate decisions.

Users may exercise the rights that correspond to them in this matter by written communication to the registered office of Smowltech or to the email address indicated in the heading of this legal notice, including in both cases a photocopy of their ID or other identification document, to request the exercise of the following rights:

Right to request access to personal data: you can ask Smowltech if they are processing your data.
Right to request rectification (in case they are incorrect): allows you to correct errors, modify data that turns out to be inaccurate or incomplete and guarantee the certainty of the information being processed.
Right to deletion: allows you to request the deletion of the data being processed when they are no longer necessary for the execution or provision of the service..
Right to object to the treatment: right of the interested party not to carry out the processing of their personal data or to cease it, except for legitimate reasons or for the exercise or defense of possible claims, in which case we will keep them blocked for the corresponding period as long as they persist. legal obligations.
Right to request the limitation of the treatment: In certain circumstances, interested parties may request the limitation of the processing of their data, in which case they will only be kept by Smowltech for the exercise or defense of claims..
Right to data portability.
Right not to be subject to automated individual decisions (including profiling): right not to be subject to a decision based on automated processing that produces effects or significantly affects.

Models, forms and more information about the referred rights: Spanish Data Protection Agency website.

How to complain to the Control Authority: If a user believes there is a problem with the way Smowltech is handling his/her data, they can direct their claims to the Smowltech DPO or the appropriate data protection authority (data protection authority), being the Spanish Agency for Data Protection Spanish Data Protection Agency the one indicated in the case of Spain.