ToetsTester Privacy Policy

Company Details

Personal Data We Process

ToetsTester processes personal data because you use our services and/or provide this data to us yourself. We process, among other things:

From teachers

• First and last name
• Email address
• Account and login credentials

From students (indirectly, via exams)

• Name (if present on the exam)
• Answers to exam questions
• Exam and assessment data

Additionally, we process:

• IP address
• Data about your activities within our platform
• Internet browser and device type

In very exceptional cases, special personal data may indirectly appear in exam answers. ToetsTester does not intend to collect or use such data.

Minors

ToetsTester does not independently target minors. Student data is only processed in the context of education and through teachers or educational institutions.

When a teacher creates an account themselves, that teacher is the data controller. When ToetsTester is used within a school context, the educational institution is the data controller and we act as the processor.

Purposes and Legal Basis for Processing

ToetsTester processes personal data for the following purposes:

• Supporting teachers in (partially) automatically grading exams
• Generating feedback and scores
• Providing insight into exam results
• Improving our services (without using personal data for model training)
• Managing accounts and access to the platform

Processing is based on:

• Performance of a contract
• Legitimate interest
• Legal obligations (where applicable)

Automated Decision-Making

ToetsTester uses AI to provide recommendations and preliminary assessments when grading exams.

These assessments are not binding. The teacher remains ultimately responsible and reviews, modifies, or confirms the outcomes. ToetsTester supports the process but does not make autonomous decisions with consequences for students.

Retention Periods

We do not retain personal data longer than necessary:

• Account data: as long as the account is active
• Exam and student data: as long as necessary to provide the service

After account termination, data is deleted or anonymized, unless a legal retention obligation requires otherwise.

Sharing Personal Data with Third Parties

ToetsTester only shares personal data when necessary to provide the service or to comply with legal obligations.

We use:

• mijn.host.nl (hosting within the EU)
• Gemini and Glama (AI services outside the EU)

When personal data is transferred to parties outside the European Economic Area, this only happens with appropriate safeguards, such as standard contractual clauses, and within the framework of the GDPR.

Cookies and Similar Technologies

ToetsTester uses:

• Functional cookies (essential for platform functionality)
• Analytical cookies (Google Analytics and PostHog) to understand user behavior and improve the platform

These cookies are used to improve the website and platform. You can manage your cookie preferences through the cookie banner. For more information or to object to the use of analytical cookies, contact us at info@toetstester.nl.

Your Rights

You have the right to:

• view your personal data
• have data corrected or deleted
• object to processing
• withdraw your consent
• have data transferred

You can send a request to info@toetstester.nl. We will respond as soon as possible, within four weeks at the latest.

You also have the right to file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Security of Personal Data

ToetsTester takes appropriate technical and organizational measures to protect personal data, including:

• TLS encryption (https)
• AES-256 encryption of stored data
• Secure hosting
• Limited access rights
• Regular security updates

Do you suspect that data is not properly secured or that misuse is taking place? Please contact us at info@toetstester.nl.