> For the complete documentation index, see [llms.txt](https://synap.ac/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://synap.ac/docs/legals/candidate-privacy-policy.md). # Candidate Privacy Notice A plain-English guide to how Synap usually handles candidate information when an organisation uses our platform to deliver an exam or assessment. LAST UPDATED: 29th September 2026 ## Who this notice is for This notice is for people who have been registered to take an exam, assessment or learning activity on a Synap portal. It explains, in plain English, how Synap usually handles candidate information. It is not a substitute for the privacy notice provided by the organisation delivering your assessment, which we call your **Exam Provider**. Your Exam Provider may configure Synap differently, use only some features, or connect Synap to other services. For information specific to your assessment, read: * your Exam Provider's privacy notice; and * the information shown before you start, including any notice about proctoring, identity checks, recordings or third-party services. If those sources differ from this general guide, contact your Exam Provider for clarification before starting your assessment. ## Who is responsible for my information? Your Exam Provider normally decides why your candidate information is collected, which Synap features are used, who may review the information and how long it is kept. In data-protection language, it is normally the **Controller**. Synap Learning Limited provides the platform and normally handles candidate information on the Exam Provider's instructions. In that role, Synap is a **Processor**. Synap may use other carefully selected providers to help operate particular platform features; these are described in our [Subprocessors List & Management Policy](https://legal.synap.ac/subprocessors-list-and-management-policy). Where Synap separately decides how limited information is used for its own legal obligations or the security and administration of its service, Synap may act as a Controller for that specific use. ## What information might be handled? The information depends on how your Exam Provider configures the assessment. ### Account and profile information This may include your name, email address, candidate, student or employee number, organisation, course or cohort, account role, authentication information and other profile fields selected by your Exam Provider. Some portals use a pseudonymous reference instead of a name or email address. This information is used to create or identify your account, give you access to the correct activities, secure your account and associate your work and results with the correct record. ### Assessment and learning information This may include: * the assessments or activities assigned to you; * your questions, answers, uploaded files and other submissions; * start, finish and duration information; * marks, scores, grades, feedback and reviewer decisions; and * certificates, progress and learning records. Some answers may be marked automatically using rules set by the Exam Provider. Other answers may be marked by people, or by a combination of automated and human review. ### Device, network and security information Synap may process information such as your IP address, browser and operating system, device type, session times, authentication and security events, network performance and technical logs. This helps us operate the platform, provide compatible instructions, prevent misuse, investigate security events and diagnose technical problems. ### Accessibility and reasonable-adjustment information Your Exam Provider may record settings or instructions needed to support you, such as extra time, font-size or contrast preferences, rest breaks or other adjustments. In some cases, you can also set these preferences yourself. ### Support notes and other information Authorised users at your Exam Provider may ad If you contact Synap for support, we will normally respond in accordance with your Exam Provider's instructions, ask the Exam Provider for direction or put you in contact with them. If we reasonably believe that you or another person may face an immediate and serious risk to health or safety, and it is not practicable to obtain timely instructions, we may take reasonable steps to obtain assistance. This may include contacting emergency services or an emergency contact and sharing the minimum information reasonably necessary to help them respond.d notes, comments, annotations or support records about you. You may also provide personal information in free-text answers, uploaded files or communications. Please avoid including unrelated personal information unless it is needed for your assessment or support request. ## Proctored assessments Proctoring means monitoring an assessment to help protect its integrity. Depending on the configuration selected by your Exam Provider, Synap or a connected proctoring service may collect: * webcam video or images; * microphone audio; * a recording or images of your screen; * browser, tab, application or assessment-session events; * a room or desk scan; * connection and device information; and * timestamps, reviewer notes, flags and reports. The exact information collected should be shown before the assessment begins. Proctoring data is collected only for the relevant assessment session, although technical preparation checks may occur beforehand. Recordings may incidentally capture information that is not relevant to the assessment—for example, another person entering the room, items in the background, sounds, notifications or information visible on your screen. Synap and its automated tools do not set out to collect this incidental information or use it to infer sensitive characteristics. Where practical, prepare a private space, close unrelated applications and notifications, and ask your Exam Provider about any concern or adjustment before the assessment. Authorised reviewers may watch a session live or review recordings, events and reports afterwards. They may add notes or flag parts of the session for further review. ## Identity checks and biometric information An assessment may ask you to capture an identity document, a photograph or video of your face, or both. An identity check may involve: * checking that an image appears to contain an identity document; * extracting document fields such as your name, date of birth or document number; * checking that one face is present and that the image is suitable for review; * checking whether a real person appears to be present, sometimes called a liveness check; * comparing a selfie or video with the photograph on an identity document; and * producing a result, confidence score or fraud indicator for an authorised reviewer. The check may use Synap technology or an optional identity provider listed on our Subprocessor page, such as Stripe Identity or Entrust (Onfido). The provider used for your assessment should be identified before the check. An ordinary photograph is not automatically biometric data. If technical processing extracts facial features so that an image can be matched to a person, the resulting information is biometric data. When it is used to identify or verify a particular person, it is generally treated as special-category biometric data under UK and EU data-protection law. Your Exam Provider is responsible for deciding whether an identity check is necessary and lawful, identifying an appropriate legal basis and special-category condition where required, and explaining any alternatives or consequences that apply to your assessment. ## Automated and AI-assisted review Some configured features can analyse recordings, images or session events and highlight information for a reviewer. Depending on the feature, this may include: * the absence or presence of a face, or more than one face; * screen, browser or application events; * possible objects, movements, sounds or changes in the assessment environment; * head-position or gaze-direction signals; * identity-document or facial-similarity checks; and * timestamps, confidence scores or sections of a recording that may warrant review. A flag or score is an indication for review, not proof of cheating, misconduct or identity fraud. Synap's automated and AI-assisted review features are intended to help authorised people prioritise and conduct their review. They are not designed to infer your emotions, intentions or state of mind. Your Exam Provider decides whether to enable these features, how outputs are reviewed and what action, if any, is taken. Final determinations about misconduct, assessment validity or other significant outcomes should be made under the Exam Provider's own procedures, with appropriate human review. Information shown before the assessment should identify any materially different use. ## Who may see or receive my information? Depending on the assessment, candidate information may be available to: * authorised staff, markers, proctors, invigilators or reviewers acting for your Exam Provider; * authorised Synap personnel where access is necessary to operate, secure or support the service; * Synap's Subprocessors for the relevant platform or optional feature; * another provider selected or connected directly by your Exam Provider; and * regulators, courts, law-enforcement bodies or other recipients where disclosure is required by law. Access is limited according to role and purpose. Synap does not sell candidate information or use candidate assessment, proctoring or identity data for targeted advertising. ## Where is my information processed? Exam Providers can use a Synap stack whose primary AWS and MongoDB workloads are hosted in either: * the **European Union**, in Ireland; or * the **United States**, in Virginia Backups may use another availability zone or region for resilience and disaster recovery, but remain within the selected EU or US data-residency boundary. Some supporting or optional services may process information in other locations. For example, a third-party proctoring or identity-verification feature may have its own regional configuration. Relevant locations and transfer safeguards are described in our [Subprocessors List & Management Policy](https://legal.synap.ac/subprocessors-list-and-management-policy), and assessment-specific information should be shown before a feature is used. ## How long is my information kept? Your Exam Provider normally decides the applicable retention period, taking account of its assessment, regulatory, appeals and record-keeping requirements. Synap keeps candidate information in accordance with the Exam Provider's configuration and instructions, our agreement with it, and any applicable legal requirements. Different categories may have different retention periods. For example, an Exam Provider may retain a result or certificate for longer than a proctoring recording or identity image. Optional providers may also apply documented retention and deletion arrangements for the feature they supply. Contact your Exam Provider if you need the retention period that applies to your assessment. ## How is my information protected? Synap uses technical and organisational measures designed to protect candidate information. These include encryption in transit and at rest, access controls, monitoring, staff confidentiality and security procedures. Synap maintains ISO 27001 certification, an independently audited information-security standard. No online service can promise absolute security. If you believe information connected with your assessment may be at risk, contact your Exam Provider promptly. ## Cookies and similar technologies Candidate portals use cookies and similar local-storage technologies where needed to keep you signed in, secure your session, remember settings and operate the assessment. Synap does not use advertising cookies on candidate exam portals. The separate Synap marketing website may use analytics or advertising technologies subject to the choices and information provided there. ## What choices and rights do I have? Your rights depend on the law that applies and the purpose for which your Exam Provider uses the information. They may include rights to ask for access, correction, deletion or restriction, to object to certain uses, or to ask for human review of certain automated decisions. Your Exam Provider is normally the best first contact because it controls the assessment, holds the context needed to identify your records and decides how to respond. Its privacy notice should provide contact details, applicable legal bases, your rights and how to complain to the relevant regulator. If an assessment requires proctoring, an identity check or another feature that causes concern, contact your Exam Provider before the assessment. It can explain whether an alternative or reasonable adjustment is available. Synap cannot change an Exam Provider's assessment requirements on its own, but we will assist them if asked to do so. ## How do I contact Synap? For questions or requests about your assessment data, first contact your Exam Provider. They will contact us if needed. You can contact Synap at . If your request concerns Customer Data controlled by an Exam Provider, we will direct or forward it to that organisation where appropriate. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://synap.ac/docs/legals/candidate-privacy-policy.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.