Data protection – ELAO platform

Purpose of this page

This page explains how personal data is processed in connection with the use of the ELAO platform.

Its purpose is to inform Learnstudio’s clients and ELAO’s end users about the main processing activities carried out to organise, deliver, monitor, and analyse language assessments.

This page relates to the ELAO platform. It is separate from the privacy policy that applies to general browsing of the website.

Roles of the parties

Where ELAO is used by a company, a university, a training centre, or any other client organisation, that organisation generally acts as the controller of the personal data relating to its candidates, students, employees, learners, or other users.

In this context, Learnstudio generally acts as a processor by providing the ELAO platform and ensuring its technical operation, maintenance, hosting, security, and support.

For certain processing activities linked to its own contractual management, the security of its systems, invoicing, incident handling, or compliance with its legal obligations, Learnstudio may act as a controller.

Learnstudio’s identity and contact details

Learnstudio SRL VAT: BE1012453534 Parc Artisanal 11-13, Complexe Arrobas 4671 Barchon Belgium

General email: info@learnstudio.be Data protection contact: Quentin Naveau – quentin@learnstudio.be

What data may be processed?

Depending on the configuration chosen by the client, ELAO may process several categories of data.

Identification data

Depending on the client’s requirements and the settings activated on the platform, this may include the surname, first name, email address, an internal identifier, a group, a class, a department, a site, a programme code, a target language, or any other data needed to organise the assessments.

Assessment-related data

ELAO is used to determine a user’s language level in a target language. For this purpose, the platform may process the answers provided by the user, the duration of the assessment, the date on which it was taken, the overall score, scores by module, and the grammar points or areas for improvement identified.

Technical data

Certain technical data may also be processed to ensure the proper operation, security, and traceability of the platform. This includes technical identifiers, connection logs, and information required for support or maintenance.

Data linked to the ELAO+ speaking module

When the ELAO+ module is activated, voice recordings may be made to enable the assessment of speaking skills.

Data linked to proctoring

When the proctoring option is activated by the client, additional data may be processed in order to secure the delivery of assessments. This may include video streams from the webcam, audio streams, a screen capture when this feature is activated, and technical data such as timestamps, disconnection events, network losses, external window opening attempts, or unexpected interruptions.

The proctoring solution used does not aim to collect the candidate’s personal files, access their external applications, intercept their private communications, or carry out facial recognition, biometric, emotional analysis, or intrusive profiling activities.

Purposes of the processing

The data processed within ELAO is used for the following purposes in particular: organising language assessments; enabling tests to be taken; calculating results; generating analysis reports; allowing the client to consult and make use of its users’ results; ensuring the administration, support, maintenance, and security of the platform; preventing misuse and securing assessments when supervision or proctoring features are activated; and improving the quality of the service, in particular through anonymised data where possible.

As regards proctoring more specifically, the purpose is strictly limited to the supervision of the test, the detection of anomalies that could affect testing conditions and, where required, the verification of the candidate’s identity.

Legal basis

The applicable legal basis depends on the context in which the ELAO platform is used and on each party’s role in the processing.

In most cases, the processing activities carried out within ELAO are based on the performance of a contract or of pre-contractual measures, on the legitimate interest of the client in organising, managing, and securing its language assessments, on Learnstudio’s legitimate interest in ensuring the security, maintenance, and improvement of the platform, or on compliance with legal obligations where these apply.

Where proctoring features are activated, the associated processing activities rely on the legal basis chosen by the client organisation in light of its own context, the nature of the assessment, and the applicable regulations. This may include the performance of a contract, the legitimate interest in guaranteeing the integrity and fairness of the tests, or, in certain specific cases, a task carried out in the public interest.

Data recipients

Access to the data is restricted to individuals who need it to carry out their duties. This includes authorised staff within the client organisation, Learnstudio employees in charge of managing the platform, and technical or IT service providers involved in the operation, hosting, maintenance, or security of the platform.

Where applicable, certain providers may also be involved in specific services, such as the speaking module or proctoring, strictly to the extent necessary for their assignment.

Hosting and subprocessors

The ELAO application is hosted on the Microsoft Azure infrastructure, in datacentres located in Amsterdam, within the European Union.

Learnstudio may also use subprocessors for certain specific processing activities, in particular for cloud hosting and infrastructure, the processing of the ELAO+ speaking module, and proctoring.

For proctoring, Learnstudio may use Mereos. According to the documentation provided, Mereos hosts its solution on an AWS infrastructure located in Europe, in particular in France and Germany.

Specific case of the ELAO+ speaking module

When speaking skills are assessed through ELAO+, directly identifying user data such as surname, first name, or email address is not transmitted to the external provider. Only a pseudonymised technical identifier, generated by the European servers, is transmitted. Audio files may be hosted temporarily by a provider located in the United States. The link between this technical identifier and the user’s identity is kept on the European servers. Processing is limited to the time required for the assessment, and the transfer is governed by standard contractual clauses.

Specific case of proctoring

When the client activates a proctoring solution, additional processing activities may be carried out in order to verify the candidate’s identity, record certain session elements, detect technical or behavioural anomalies, and strengthen the integrity of the assessment.

The proctoring solution used by Learnstudio relies on assisted-detection mechanisms. Automated tools may flag factual events such as a prolonged absence of the candidate from the camera’s field of view, the presence of a second face, an unusual sound variation, or an attempt to access an external resource. These mechanisms do not, however, take any automated decision regarding fraud. Any alert must be reviewed through an authorised human intervention, which analyses the context before any potential qualification.

Further information on the processing of personal data in connection with proctoring is also available in the GDPR documentation provided by Mereos.

Retention periods

Retention periods depend on the nature of the data processed and the purpose pursued. Unless otherwise specified, data relating to the general use of ELAO is, as a rule, retained for twelve months after the end of the contractual relationship. Data processed in connection with proctoring is retained for a specific period defined contractually, after which it is deleted or anonymised.

Certain data may be retained for longer when it has been anonymised, in particular for the purpose of improving the service.

Security

Learnstudio implements appropriate technical and organisational measures to protect data against unauthorised access, loss, alteration, disclosure, or theft.

These measures include a restrictive management of access rights, the securing of the corporate network, intrusion-protection tools, the securing of physical access, and ongoing awareness training for business and IT teams.

As regards proctoring, the Mereos documentation indicates, among other measures, the encryption of exchanges using TLS 1.2 or TLS 1.3, encryption of stored data using AES-256, a strict separation between development, testing, and production environments, access restricted to authorised personnel on a least-privilege basis, logging mechanisms for sensitive operations, multi-factor authentication on the main internal systems, and security, training, and incident-management policies.

Rights of data subjects

Subject to the conditions laid down by the applicable regulations, every data subject may request access to their data, the rectification or erasure of their data, the restriction of processing, the right to object to processing where applicable, and the portability of their data where applicable.

Where Learnstudio acts as a processor, such requests should, as a rule, be sent first to the client organisation acting as controller. Learnstudio may, however, assist its clients in handling these requests.

In the context of proctoring, the tool used also helps the institution to respond to requests for access, rectification, erasure, restriction, and, where applicable, objection.

Contact

For any question relating to data protection in connection with ELAO, you may contact Learnstudio at the general address info@learnstudio.be, or contact the data protection contact directly:

Quentin Naveau quentin@learnstudio.be

Complaints

If a data subject considers that the processing of their data does not comply with the applicable regulations, they may lodge a complaint with the competent data protection authority.

Updates

This page may be updated at any time to reflect changes to the platform, to the processing activities implemented, or to the applicable regulations. The most recent version published on the website prevails.