ExamaholicsPrivacy
What we collect, why, and what you can ask us to do about it.
Draft pending legal review. This page states what the system actually does, verified against the code. It has not yet been reviewed by Zambian counsel, and the data-residency position in particular is unresolved — see “Where your data lives”. It must be reviewed before any institutional contract is signed.
Who is responsible
For a personal account, Examaholics Ltd is the data controller. For an exam sat at a university, the university is the controller and we process on their behalf under a written agreement.
What we collect
- Your account — name, email, and a hashed password. We never store the password itself.
- Your work — the answers you give, when you gave them, and the marks awarded.
- Exam integrity signals, during real exams only — whether the app was backgrounded, whether a screenshot was taken. Never during practice.
- Accommodations, where you request one, including any evidence you upload.
What we do not collect
- No camera or microphone access. There is no video proctoring.
- No location.
- No contacts, and no advertising identifiers.
- No exam content, scores or answers are ever sent to an analytics provider.
Where your data lives
Our servers are currently outside Zambia. The Data Protection Act 2021 places conditions on transferring certain personal data abroad, and we have not yet completed that assessment. We are stating this plainly rather than implying a position we have not established. The platform is built so the database can be moved to a Zambian or regional host without redesign.
Who else sees it
- Your lecturers and examinations officers, for exams you sit with them.
- Our staff, when supporting you — every such access is logged.
- Service providers who host the system, send our email, and record crashes. Each is bound by contract and none receives your answers or your marks.
Your rights
You can ask for a copy of your data, ask us to correct it, or delete your account. Exam records held on behalf of a university are subject to that university's retention rules — we explain why on the deletion page.