Privacy policy
This policy explains which personal data arise when tech-exam is used, why they are processed, how long they are kept and who has access to them. It follows the Swiss Federal Act on Data Protection (FADP).
Controller
Lukas Roth Birrenbergstrasse 6 5620 Bremgarten Switzerland Questions about data protection as well as requests for access, rectification and erasure: info@tech-exam.ch
Responsibility
Where a school uses tech-exam to run its examinations, the school is the controller for the learners' data. We process them on its behalf and on its instructions. Learners and parents therefore address requests about examination data to the school; we support the school in handling them. For a teacher's account we are the controller ourselves.
Which data arise
From learners: first name, surname, email address, the submitted work and the assessments of it. From teachers: the name, email address and sign-in credentials of the account, its settings, and the content created in it — examinations, tasks, model answers, marking code and the teacher's own question collection. In addition, what is technically necessary: the timestamp of participation and of the last sign-in, and the identifier by which the device and the browser announce themselves when someone joins an examination. From it the teacher is shown the device and the browser — «Windows · Chrome», say, with more detail on hover — so that they can help when something goes wrong on a device during an examination. The identifier is deleted together with the participation. When a teacher signs in, the sign-in service additionally records when that happened and from which device address. No analytics or advertising services are embedded. We do not build profiles and do not analyse behaviour beyond the purpose of the examination.
Why we process them
To run examinations, assess them and return the results. To manage teacher accounts and enable sign-in. To keep the service running and to prevent misuse. The data are not used for any other purpose and are not sold. Part of the assessment arises automatically: closed questions and programming tasks are pre-marked according to the teacher's own specifications as soon as an examination is closed. The teacher sees every one of these marks, can change them, and decides whether and when they go back — what reaches the learners has always been released by a person.
On what basis
Examination data are processed on the basis of the school's public mandate, not on consent: someone required to sit an examination could not freely refuse consent. Teacher accounts rest on the usage relationship with us.
Where the data are held
The database, sign-in and file storage are located in Switzerland. The backups are held encrypted on a device in Switzerland. Three disclosures arise from our own operation and go abroad. First, the website and the application are delivered through GitHub Pages (GitHub, Inc., USA); the device's IP address is recorded there when a page is fetched. Second, email delivery — examination results, registration, password reset, messages from the contact form — runs through Resend, a provider based in the United States; sending takes place from a data centre in Ireland, and the delivery logs are held in the United States. The email address, the name and the examination result are transmitted, and for the contact form your address and your text. Third, when a teacher takes over or generates questions for their collection with AI support, what they hand over for that goes to an AI service in the United States: the uploaded examination document or the details of the desired topic. This path runs only when the teacher triggers it; data about learners never reach it. All three rest on the European Commission's standard contractual clauses, as adapted for Switzerland. The delivery service is additionally certified under the Swiss-U.S. Data Privacy Framework; the email sending service and the AI service are not. The AI service is contractually barred from using the transmitted content to train its models and states that it deletes that content within thirty days. Programming tasks are worked on in a programming environment developed and operated by ETH Zurich; the examination device loads it directly from there. ETH thereby learns the address of the device and the time of the request. The code written during the exam is handled and run inside that environment, without any name and without marks: the environment learns neither whose work it is nor how it is assessed. The environment is located in Switzerland. In a robotics task the environment additionally loads a simulator of the micro:bit project, an organisation based in the United Kingdom. Here too only the address of the device arises. The Federal Council recognises data protection there as adequate; this disclosure therefore needs no additional contractual safeguard. It happens only in tasks the teacher has set as robotics tasks — in any other task the simulator is not loaded. When a teacher runs automatic marking, their device fetches a program library once from a public distribution network for that purpose. That network is operated by an organisation based in the United Kingdom; the address of the device arises there. Here too the Federal Council recognises data protection there as adequate. Submissions do not leave the device — the marking happens on it. If a teacher adds reference material to an examination — a dictionary, a formulary — the examination device fetches it directly from whoever provides it. Where that leads is decided by the teacher with that entry; there too the address of the device arises. We transmit no examination data there.
What is stored on the device
For the platform to work at all, it stores a few things in the browser's memory — on the device in front of you, not with us. During an examination these are the drafts of the answers and a note of who is currently signed in: if the device crashes or the window is closed, the work is not lost because of it. Added to that are the chosen language and, for teachers, the sign-in, so that it does not have to be entered again on every visit. None of it serves observation, and none of it goes to third parties. At the end of an examination the device clears the drafts away itself — on a shared device nothing is left behind for the next person. This can be refused in the browser's settings; no draft then survives a crash, though.
Who has access
A teacher sees only their own examinations and the work submitted for them. Learners see their own work and, after it has been returned, their assessment, never the work of others. In addition there are providers that process on our behalf: the operator of the database, Supabase, with servers in Switzerland, the email delivery service, the delivery of the website, the forwarding of our contact address (data centres in the EU) and availability monitoring (EU). They are bound by contract and may process the data only for us; the agreements of the two largest are public: database and email delivery. The AI service is added only when a teacher triggers it; it never receives data about learners. The operator of the database is not domiciled in Switzerland. The data sit on its servers here, but its people can reach them from their own locations for operations and support; this too rests on the European Commission's standard contractual clauses, as adapted for Switzerland. The programming environment of ETH Zurich is not a service provider but an offering by a university that is embedded in the examination; it is not bound by our instructions. Only the address of the device arises there, no examination content. No data are passed on beyond that.
Retention and deletion
For each examination the teacher sets a retention period between 30 and 730 days; the default is 365. Counting starts when the examination opens. After that, submissions, assessments and participations are deleted automatically; the same deletion can be triggered manually at any time. Teacher accounts remain until they are deleted, which is possible at any time. If an account goes unused for twelve months, we delete it ourselves; two months and again two weeks beforehand we say so by email, and a single sign-in restarts the period. With the account go the examinations attached to it, together with submissions and assessments. In the backups a deleted submission is still contained for up to about a year; it drops out with the last state that contains it.
How we protect them
All connections are encrypted. The backups are encrypted as well; the key for them is not held on the same device. Access is separated by role, and that separation is enforced in the data storage itself, not only in the interface. A breach of data security is reported to the competent authority as soon as it is likely to result in a high risk to the persons concerned; those affected are informed where this is necessary for their protection.
If you write to us
Through the contact form you send us your email address, the subject you chose and your text. We use these details solely to reply: no advertising, no passing on to third parties. The message is delivered and not stored in addition; it stays in our mailbox until the matter is settled. It travels through the same dispatch service as our other emails and through a forwarding service with servers in the European Union. You can equally reach us at info@tech-exam.ch. For a request for access or erasure, both routes are equivalent.
Your rights
You may request access to the data held about you, have inaccurate data corrected, request erasure and ask for the data to be handed over in a common format. For examination data, please contact the school that ran the examination — it is the controller. For everything else, write to info@tech-exam.ch. We reply within 30 days. You may also turn to the competent data protection authority: for public schools in the canton of Aargau, the cantonal commissioner for public information and data protection; otherwise the Federal Data Protection and Information Commissioner.
As at September 2026. Material changes are published here.