Data Processing Agreement

This page summarises the Data Processing Agreement (DPA) that governs Gater's processing of personal data on behalf of an institution. The signed DPA prevails over this summary.

1. Roles

The institution is the controller. Gater is the processor. Each party complies with applicable data protection law including the GDPR.

2. Scope of processing

• Subjects: candidates, institution staff, examiners.
• Categories: identity data, contact data, exam answers, proctoring artefacts, technical telemetry.
• Purpose: delivery and integrity of admission exams.
• Duration: for the term of the institution's subscription.

3. Subprocessors

We engage a defined list of subprocessors (hosting, email, payments). Institutions are notified of changes with at least 30 days' notice and may object.

4. Security measures

• Encryption at rest (AES-256) and in transit (TLS 1.2+).
• Role-based access, least privilege, MFA for staff.
• Tenant isolation via row-level security.
• Continuous logging, audit trail, and incident response procedures.
• Annual penetration tests and dependency vulnerability scanning.

5. International transfers

Personal data is hosted in the EU. Where any subprocessor processes data outside the EEA, transfers are covered by Standard Contractual Clauses.

6. Data subject requests

We assist the institution in responding to access, rectification, erasure, restriction, portability, and objection requests within reasonable timeframes.

7. Breach notification

We notify the institution without undue delay and in any case within 72 hours of becoming aware of a personal data breach.

8. Return and deletion

On termination, the institution can export data via the platform or request deletion. We delete or anonymise personal data within 90 days unless retention is required by law.

To request the signed DPA, email legal@examguard.app.