# CD ExamFocus privacy information template

This is a drafting aid, not legal advice. The organisation operating Moodle must adapt it with its data protection officer or legal adviser and align it with local law, institutional policy and the actual configuration.

## Short notice shown before a monitored quiz

This quiz uses CD ExamFocus focus monitoring. During the attempt, the system records when the quiz tab or window stops being active, when it becomes active again, the duration and the technical connection state. It does not record which website or application was opened and does not capture screen, camera, microphone, keystrokes, clipboard or browsing history. Authorised staff will review incidents in context; an incident is not automatic proof of misconduct. Further information: [PRIVACY INFORMATION URL].

## Full information

### Controller

[LEGAL NAME OF THE ORGANISATION], [POSTAL ADDRESS], [CONTROLLER CONTACT].

### Data protection officer

[DPO NAME/CONTACT, IF APPLICABLE].

### Purpose

To support the integrity, supervision and documented review of online assessments conducted through Moodle, including identifying attempts that may require human review and investigating technical incidents.

### Data processed

- Moodle user identifier and the identity displayed to authorised staff.
- Course, quiz and attempt identifiers.
- Random browser-session and event identifiers.
- Server/client timestamps associated with monitoring signals.
- Focus signal category and calculated time away.
- Current focus/connection state and most recent heartbeat time.

The plugin does not collect the destination website or application, browsing history, clipboard content, keystrokes, screenshots, camera, microphone, audio, video, biometric data or device content outside the Moodle page.

### Lawful basis

[INSERT THE BASIS DETERMINED BY THE CONTROLLER. DO NOT ASSUME CONSENT. DOCUMENT THE APPLICABLE EDUCATION/EMPLOYMENT/CONTRACT/PUBLIC-TASK OR LEGITIMATE-INTEREST ANALYSIS AND LOCAL LAW.]

### Recipients and access

Access is limited to Moodle users assigned the relevant report or export capability, normally authorised teaching, assessment, technical and compliance staff. [ADD PROCESSORS, HOSTING PROVIDERS, PUBLIC AUTHORITIES OR OTHER RECIPIENT CATEGORIES IF APPLICABLE.] CD ExamFocus itself does not send data to an external service.

### Retention

Completed monitoring records are retained for [NUMBER] days and then deleted by a scheduled Moodle task, unless a documented assessment review, complaint or legal obligation requires a controlled extension. CSV exports are subject to [INSTITUTIONAL RETENTION AND DELETION RULE].

### Decisions and safeguards

CD ExamFocus does not determine whether misconduct occurred. The organisation will not impose a grade penalty or disciplinary measure solely from a focus record. Authorised staff will consider technical context, duration, recurrence, classroom observations and the student's explanation. [DESCRIBE THE REVIEW/APPEAL PROCESS.]

### Rights

Depending on applicable law, data subjects may request access, rectification, erasure, restriction or objection and may lodge a complaint with the competent supervisory authority. Requests should be sent to [RIGHTS REQUEST CONTACT]. Some rights may be limited where processing is required by education or assessment law; the controller will explain any refusal.

### Further safeguards

- Monitoring is enabled only for selected quizzes.
- A grace period may suppress very short focus changes.
- Access and export require specific Moodle capabilities.
- Personal incident history is excluded from course backups.
- The controller reviews access, retention, false positives and necessity periodically.

Last reviewed: [DATE]. Policy/version owner: [ROLE OR PERSON].
