Data Processing Addendum

For institution assessment records, the institution or lecturer typically acts as the party deciding why and how data is used. GradeOptimus acts as a service provider or processor for the platform workflow.

For GradeOptimus account administration, billing, security, and product operations, GradeOptimus may act as an independent controller where applicable.

Processing covers creation, delivery, review, grading, feedback, support, retention, export, and deletion of assessment data during the customer relationship and any agreed retention period.

• Lecturer and administrator account details.
• Student names, emails, identifiers, course enrollment, access codes, submissions, scripts, grades, feedback, and related assessment records.
• Question papers, answer keys, rubrics, marking guides, uploaded files, audit logs, and support records.

• Process institution assessment data only for the service, support, security, legal compliance, and documented customer instructions.
• Restrict access to personnel and providers with a legitimate need.
• Use reasonable technical and organizational safeguards.
• Assist with data subject requests where the institution is responsible for responding.
• Delete or return data after service termination where reasonably possible and legally permitted.

GradeOptimus may use infrastructure, AI, email, payment, analytics, security, and support providers to deliver the service. We should require subprocessors to protect data in a way consistent with their role and the sensitivity of assessment records.

Where data is hosted or processed outside the institution's country, GradeOptimus should use appropriate contractual, technical, and organizational measures for the transfer.