This document is an internal draft and must be reviewed by legal counsel before publication.
1. Controller
The controller for personal data collected through the Examia platform is the company that publishes the service, identified in the legal notice: [TO BE COMPLETED: legal form and share capital], [TO BE COMPLETED: registered office address], [TO BE COMPLETED: company registration number].
Contact for any data question: support@examia.tech. Where applicable: [TO BE COMPLETED: data protection registration or DPO details].
2. Data collected
2.1 Identity and account data
Email address, name or display name, password stored as a hash (never in clear text), interface language, country and currency, account creation date, email verification status, notification preferences.
2.2 Payment data
Examia does not collect or store any card number or mobile-money account identifier: those are entered directly with the payment provider. Examia keeps only transaction metadata — identifier, amount, currency, status, timestamp, provider — and the proof uploaded for bank transfer or CCP payments.
2.3 Exam submissions
Texts written in the Written Expression simulator, audio recordings produced in the Spoken Expression simulator, transcripts of those recordings, the corrections and grids generated, estimated scores, and the history of answers to the comprehension papers.
2.4 Usage data
Pages viewed, practice sessions started and finished, time spent, progress, product events, technical logs and error reports.
2.5 Technical data
IP address, user agent, device type, operating system, and a device fingerprint hash (a derived, non-reversible value) used to enforce the two-simultaneous-device limit and detect account sharing.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Creating and running the account, providing the Service | Performance of the contract |
| Marking submissions and showing estimates | Performance of the contract |
| Handling orders, invoicing, refunds | Performance of the contract |
| Support and answering your requests | Performance of the contract |
| Audience measurement and product analytics | Consent |
| Promotional messages by email or messaging | Consent |
| Preventing fraud, account sharing and abuse | Legitimate interest |
| Service security, logging, backups | Legitimate interest |
| Keeping accounting records | Legal obligation |
Where processing relies on consent, you can withdraw it at any time, without affecting the lawfulness of processing already carried out.
4. Retention periods
Audio recordings are kept for 12 months; transcripts and written corrections are kept for as long as the account exists.
| Category | Period |
|---|---|
| Spoken Expression audio recordings | 12 months from submission |
| Transcripts, written texts, corrections and estimated scores | For as long as the account exists |
| Account and identity data | For as long as the account exists |
| Transaction metadata and accounting records | 10 years, legal obligation |
| Technical and security logs | 12 months |
| Audience measurement data | 25 months from collection |
| Record of tracker consent | 13 months |
When the account is deleted, data is erased or irreversibly anonymised, except records the law requires us to keep, which are isolated and made inaccessible for any other purpose.
5. Recipients and sub-processors
Data is accessible to authorised Examia staff, limited to what their role requires, and to sub-processors acting on documented instructions under a contract containing confidentiality and security commitments.
Sub-processors act in the following roles:
- authentication provider;
- application hosting and content delivery network;
- managed database;
- object storage, for audio recordings and uploaded files;
- transactional email;
- WhatsApp Business messaging, for notifications you have accepted;
- payment providers;
- product analytics;
- application error monitoring;
- AI marking providers.
The named, current list of these sub-processors is published and kept up to date; it can be obtained on request at support@examia.tech. Any new sub-processor is announced before it goes live.
Submissions sent to marking providers are not used by them to train their models: that use is contractually excluded.
No data is sold, rented or transferred to third parties for advertising.
6. Transfers outside the European Union
Some sub-processors are established outside the European Union, in particular in the United States. Those transfers are covered by the standard contractual clauses adopted by the European Commission, supplemented where necessary by additional technical measures such as encryption in transit and at rest and minimising the data sent.
A copy of the applicable safeguards can be requested at support@examia.tech.
7. Your rights
You have the following rights:
- access to your data and information about the processing;
- rectification of inaccurate or incomplete data;
- erasure of your data, within the limits of legal retention obligations;
- portability of the data you provided, in a structured, machine-readable format;
- restriction of processing in the cases provided by the regulation;
- objection to processing based on legitimate interest, on grounds relating to your particular situation;
- withdrawal of consent at any time for processing that relies on it;
- instructions about what happens to your data after your death.
Exercise these rights from your account settings where the tool exists, or by writing to support@examia.tech. We answer within one month, extendable by two months for complex requests. Proof of identity may be requested where there is reasonable doubt.
8. Self-service export and deletion
Two tools are available directly in your account settings:
- Data export — a JSON file containing your profile, written submissions, transcripts, corrections, session history and credit ledger. A time-limited download link is sent by email.
- Account deletion — subject to a double confirmation (in the interface, then through a link sent by email). It irreversibly anonymises the account: identifiers erased, submissions and corrections deleted, and residual statistical data no longer identifying you.
Deleting the account does not refund periods already paid for, under the conditions of the terms of sale.
9. Complaint to a supervisory authority
You may lodge a complaint with a data protection authority.
For France, the competent authority is the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, https://www.cnil.fr.
Candidates living elsewhere may address the data protection authority of their country of residence, in particular the Commission des données personnelles in Senegal, the regulator in Côte d'Ivoire, the CNDP in Morocco, the ANPDP in Algeria, or the Office of the Privacy Commissioner of Canada, according to the powers recognised by local law.
10. Security
The following measures are in place: encryption of communications and of data at rest, passwords stored as salted hashes, role-based access separation, logging of administrative actions, tested backups and dependency review.
Every resource is loaded by checking both its identifier and the owning account, so one user cannot reach another user's submissions.
In the event of a breach likely to create a high risk to your rights, you will be informed as soon as possible and the competent supervisory authority notified within the regulatory deadlines.
11. Minors
The Service is for people aged 16 and over. No data is knowingly collected from anyone younger. If we learn of such a collection, the account is deleted and the data erased.
12. Automated decisions
Score estimates are produced by automated processing. They have no legal effect and produce no decision affecting your rights: they are teaching indications and are in no way an official result. You may ask for a marking to be reviewed by writing to support.
13. Changes to this policy
This policy may change. Any substantial change is notified by email or in-Service at least thirty days before it takes effect. The last-updated date appears at the top of the page.
14. Related documents
See also the terms of use, the terms of sale, the cookie policy and the legal notice.
Contact
To exercise your rights or ask about how your data is processed, write to support@examia.tech, giving the email address linked to your account.