Data Collection Policy

This page describes what data is collected when using ClearGrade and why, in a GDPR-aligned format focused on necessity and proportionality.

Legal context

This collection model is designed to support obligations under the Zambia Data Protection Act, 2021, GDPR where applicable, and relevant US education/privacy obligations for institutions that operate in the United States.

Student account data

• Full name, email address, and computer number.
• Password hash (never plain-text password).
• Verification and approval status.

Assessment data

• Exam attempts, start and submit times, deadlines, and lock status.
• Submitted answers and selected Section C questions.
• Generated submission PDF and marking-relevant metadata.

Proctoring and integrity data

• Incident logs: fullscreen exits, hidden window events, reconnects, and similar events.
• A still snapshot only when an incident requires evidence.
• Server-side verification verdict for captured snapshots where configured.

Operational and security logs

• Authentication events, route-level actions, and system event types.
• IP address and user agent for audit and abuse prevention.

Cookies and session identifiers

• Essential session cookie to maintain authenticated state.
• Course-scoped cookie path to prevent cross-course session reuse.
• Security flags such as HTTP-only and same-site are applied by default.

No third-party advertising cookies are used by default in the core platform.

What is not continuously collected

Continuous webcam video is not streamed to the server. Frames used for browser-side checks are processed locally and discarded unless an incident snapshot is explicitly captured.

Purpose limitation

Collected data is used for account administration, exam delivery, academic integrity review, and operational support. It is not intended for unrelated profiling or marketing use.

Contact for data-collection questions

Questions about collection scope, categories, or legal basis should be directed to your lecturer or institution contact:

• Email: [email protected]
• Office: Data Protection Officer / Registrar

Last updated: 23 August 2026

Institutions should adapt this policy to local legal requirements and publish the final approved wording to students before exam sessions.