The Irish Taxation Institute trading as “Irish Tax Institute” (Institute, our, us or we) is committed to protecting the privacy and security of your personal data.
This privacy notice describes how we collect and use the personal data of individuals who complete or take our examinations that are delivered and invigilated online (also referred to in this notice as ‘you‘ or the ‘test taker/exam candidate).
This notice, together with our General Data Protection Notice (external), sets out how and why we use your personal data.
The Institute is a “data controller” which means that we are responsible for deciding how we hold and use personal data about you.
When taking an examination online, your data will be collected by the assessment delivery application and by the online invigilation application.
Personal data is collected to ensure a fair examination system where all Institute students adhere equally to the Student Regulations as may be updated from time to time). Online examinations are currently delivered by two vendors, (i) Cirrus Assessment, who deliver the assessments online; and (ii) Proctorio, who provide an automated online invigilation system to ensure students’ compliance with the Student Regulations.
The following data is collected to allow you (as the test taker/exam candidate) to log into the system and to confirm your identity (Category A):
In addition, the following data is collected to ensure that you (as the test taker/exam candidate) follow our Student Regulations (Category B):
The following data is collected if, during the online examination, you require support for technical difficulties while using Proctorio services (Category C):
The following data is collected in order to run the examinations: (Category D):
We will only use your personal data in the following circumstances:
The table below describes the legal basis that applies to our purposes for processing your personal data. Depending on the circumstances, more than one legal basis may apply:
|Purpose for processing||Categories of personal data||Legal basis for processing|
|Verify your identity as the test taker/exam candidate, to ensure compliance by you with our Student Regulations, for any investigations and appeals and to contact and liaise with you in order to provide assistance during the online exams||A, B, C||Performance of a contract with you;
Necessary for our legitimate interests for running and maintaining our business, performance of our examination function and ensuring compliance with our Student Regulations.
|To run online examinations and ensure that you (as the test taker/exam candidate) undertake the examinations in accordance with our Student Regulations||D||Performance of a contract with you;
Necessary for our legitimate interests for running and maintaining our business, performance of our examination function and ensuring compliance with our Student Regulations
Examinations are marked by human markers who access exam scripts and mark the questions according to the marking standard specified by the Institute.
The online invigilation system will flag activities that could indicate suspected non-conformance with Student Regulations and in particular sections 10A and 11A. However, no automated decisions will be made based on these flags.
Based on the above, we believe that we will not be making any decisions based solely on automatic processing. However, we will notify you in writing if there are any changes in this regard.
We will share your personal data with third party service providers including Cirrus Assessment and Proctorio and their approved sub-processors or with other parties where required by law.
Any Categories A, C and D data is stored by Cirrus Assessment in Amazon Web Services (AWS) hosting environments in Ireland.
Any Categories A and B data recorded by Proctorio during the examination are stored on Microsoft Azure in the Netherlands and/or Germany. Proctorio utilizes zero-knowledge encryption, which means they have zero access to the encrypted data on their own servers. Proctorio does not know anything about the data stored in their servers. This unique design allows nothing to leave your computer until after it is encrypted. Data never becomes unencrypted until it is unlocked by an authorized Institute official. It is not just end-to-end encryption, it is a zero-knowledge system.
Any Category C data recorded by Proctorio is stored in the United States of America. Appropriate safeguards (namely standard contractual clauses under Article 46 of the GDPR) have been put in place to protect your personal data. Please contact us if you want to access or obtain a copy of these agreements.
We may share your personal data with your employers where they are paying your membership fees or course or examination fees to advise them of your examination results and of any contraventions by you of our Student Regulations (such as plagiarism or personation) and confirming with them (as well as ensuring) your compliance with our Student Regulations as well as providing them with any personal data or documents containing personal data that may indicate contravention of such regulations.
Our external exam markers and moderators will also have access to (anonymous) exam scripts for marking purposes.
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.
We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for. The retention periods below will normally apply to the examination process. However, we may retain your personal data for a longer period in the event of a complaint, appeal or investigation where a breach of our Student Regulations is suspected or if we reasonably believe there is a prospect of litigation in respect of our relationship with you.
|Type of Data||Retention Period|
|Examination scripts||1 month from the date that recheck results are issued|
|Video and audio recordings of you taking our exam
Recordings of your on-screen activities during our exams
Flags indicating suspected non-conformance by you with our Student Regulations
Your IP Address (last octet removed)
Your System Information (browser, cpu, ram, internet connection)
Any URLs viewed by you during the exams
|Whichever is the later, (i) 6 weeks following the date of the examination or (ii) in the case where an investigation into non-conformance with the Student Regulations is initiated, 1 month from the date that an appeal can be filed against the investigation’s findings or from the date of the decision of the appeal (whichever is the later)
|Images of the ID Document
Video recordings of you verifying your identity by showing the ID Document
|Whichever is the later, (i) 6 weeks following the date of the examination or (ii) in the case where an investigation into non-conformance with the Student Regulations is initiated, 1 month from the date that an appeal can be filed against the investigation’s findings or from the date of the decision of the appeal (whichever is the later)|
|Your name, student number, candidate number and exam grades
Records of module grades, Assessment sub-committee grids recheck grades, student transcript/results and conferring records etc.
Once any such examination review process has been completed, subject to the above, the Institute will delete (where applicable) the relevant data from its own systems.
Under certain circumstances, by law you have the right to:
Please click on link to find out more about these rights.
If you want to exercise any of the above rights, please contact Martin Carney in writing at Irish Tax Institute, South Block, Longboat Quay, Grand Canal Harbour, Dublin 2, or contact us by email us at firstname.lastname@example.org. If you wish to access your personal details you can use our Request Form.
It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your working relationship with us.
You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.
We may need to request specific information from you to help us confirm your identity and ensure your right to access the data (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We will respond to your request in writing, or orally if requested, as soon as practicable and in any event within one month of receipt of your request. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
If you have any questions about this event privacy notice or how we handle your personal data, please contact Martin Carney at email@example.com. You have the right to make a complaint at any time to the Data Protection Commission (DPC), the Irish supervisory authority for data protection issues. We would, however, appreciate the chance to deal with your concerns before you approach the DPC, so please contact us in the first instance.
We reserve the right to update this online examination privacy notice at any time and we will provide you with a new privacy notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal data.
If you have any questions about this privacy notice, please contact Martin Carney at firstname.lastname@example.org.
Last Updated: October 2022