GDPR Compliance Statement
Ethition Online Examination Platform
Last updated: 10 October 2026
1. Purpose and Status of the Statement
1.1 Purpose.
The present GDPR Compliance Statement (the “Statement”) is issued by Cordiia Software Technologies Private Limited, whose registered office is at No-850, Kamalpur, Balighai, Egra, Purba Medinipur, West Bengal, India 721422 (the “Company”), the owner and operator of Ethition, the online examination and assessment platform that comprises the website at https://ethition.com, the web application, and the mobile applications (together, the “Platform”). The Statement records the organisational and technical measures through which the Company meets the requirements of Regulation (EU) 2016/679 (the “GDPR”) and, where the context requires, of the GDPR as it forms part of the law of the United Kingdom (the “UK GDPR”). Capitalised expressions that are not defined here carry the meaning given in the Company’s Terms and Conditions.
1.2 Relationship to the Privacy Policy.
The Privacy Policy states which personal data the Company handles, for what purposes, on which legal bases, and with which recipients, and it lists the rights of individuals. The Statement does not restate those matters. It addresses the means by which the Company demonstrates compliance, the commitments it gives to Organisations as a processor, the handling of requests and incidents, and the position of a business that is established outside the Union.
1.3 Basis of Application.
The Company is established in India and has no establishment in the Union. It applies the standard of the GDPR to the personal data of individuals in the Union that it processes, whether the Regulation binds it directly under Article 3(2), because the processing is related to the monitoring of behaviour that takes place in the Union, or binds it through the contract that Article 28(3) requires between an Organisation established in the Union and the Company as its processor.
2. Accountability Measures
2.1 Principle.
Article 5(2) of the GDPR makes the controller responsible for compliance with the principles in Article 5(1) and requires it to be able to demonstrate that compliance, while Article 24 calls for appropriate technical and organisational measures that are reviewed and updated where necessary. The Company applies that discipline to the processing for which it is the controller, and it supports Organisations in demonstrating compliance for the processing that it carries out on their behalf.
2.2 Records of Processing.
The Company keeps the records of processing activities that Article 30(1) requires for the processing in which it acts as controller, together with the records that Article 30(2) requires for the categories of processing carried out on behalf of Organisations. The records are produced to a supervisory authority on request.
2.3 Data Protection by Design and by Default.
Article 25 requires measures that implement the data protection principles at the time of design and that ensure, by default, that only the personal data necessary for each purpose is processed. The Platform reflects that requirement in the following respects: a Candidate reaches an assessment through an enrolment link and need not open a public account; card details are entered on the pages of the payment gateways, and the Company does not store the full card number; webcam activity is analysed as the session proceeds and is not kept as video or audio; no feature verifies identity by face matching or infers emotions; and role-based access controls confine each Authorised User to the data that the assigned role requires.
2.4 Data Protection Officer.
The Company has designated a Data Protection Officer, who may be contacted at dpo@ethition.com. Article 38(4) allows data subjects to contact the officer on all issues related to the processing of their personal data and the exercise of their rights, and Article 39 assigns to the officer the tasks of informing and advising the Company, monitoring compliance, advising on impact assessments, and cooperating with supervisory authorities.
2.5 Personnel.
The Company binds every person whom it authorises to process personal data to confidentiality and permits that person to act only on the Company’s instructions, as Articles 28(3)(b) and 29 require.
3. Commitments to Organisations as Processor
3.1 Data Processing Agreement.
Clause 5.3 of the Terms and Conditions obliges the Company to conclude, on written request and in every Institutional Order Form, a data processing agreement that satisfies Article 28(3). The agreement binds the Company in the following respects, each of which corresponds to a point of that Article.
(a) Documented Instructions: The Company processes personal data only on the documented instructions of the Organisation, including with regard to transfers, unless Union or Member State law requires otherwise, in which case it informs the Organisation of that requirement beforehand unless the law prohibits it from doing so (Article 28(3)(a)).
(b) Confidentiality: Persons authorised to process the data are committed to confidentiality or are under an appropriate statutory obligation of confidentiality (Article 28(3)(b)).
(c) Security: The Company takes the measures required by Article 32, which section 12 of the Privacy Policy describes (Article 28(3)(c)).
(d) Sub-Processors: The Company engages another processor only with the authorisation of the Organisation, imposes on it the same data protection obligations, and remains fully liable to the Organisation for its performance (Article 28(2) and (4)).
(e) Assistance with Rights: The Company assists the Organisation, by appropriate technical and organisational measures, in answering requests from data subjects (Article 28(3)(e)).
(f) Assistance with Obligations: The Company assists the Organisation with security, the notification of breaches, impact assessments, and prior consultation, taking into account the nature of the processing and the information available to it (Article 28(3)(f)).
(g) Deletion or Return: At the choice of the Organisation, the Company deletes or returns all personal data at the end of the services and deletes existing copies, unless Union or Member State law requires storage (Article 28(3)(g)).
(h) Information and Audit: The Company makes available the information necessary to demonstrate compliance, allows for and contributes to audits, including inspections, conducted by the Organisation or an auditor mandated by it, and informs the Organisation if it considers that an instruction infringes data protection law (Article 28(3)(h)).
3.2 Changes of Sub-Processor.
Section 8.3 of the Privacy Policy lists the sub-processors in use. Where the Company intends to add or replace one, it gives the affected Organisations advance notice, as clause 5.4 of the Terms and Conditions requires, and an Organisation that objects on reasonable grounds may state its objection in writing to the Data Protection Officer. The Company considers each objection in good faith, and an Organisation that remains dissatisfied may exercise its right of cancellation under clause 9.4 of the Terms and Conditions.
3.3 Processing as Controller.
For the activities that section 2 of the Privacy Policy attributes to the Company as controller, the Company itself discharges the obligations of a controller, including the duty of transparency under Articles 13 and 14, which the Privacy Policy is designed to fulfil.
4. Handling of Requests from Individuals
4.1 Channels.
Requests under Articles 15 to 22 of the GDPR may be sent to dsar@ethition.com. An individual who wishes to reach the Data Protection Officer directly may write to dpo@ethition.com.
4.2 Classification.
Each request is entered in a register, acknowledged, and classified according to whether it concerns data for which the Company is the controller or Assessment Data for which an Organisation is the controller. A request of the second kind is routed to the Organisation under the data processing agreement, and the Company supplies the data and the assistance that the Organisation needs in order to reply within the period that Article 12(3) allows.
4.3 Verification of Identity.
Where the Company has reasonable doubts about the identity of the person who makes a request, Article 12(6) permits it to ask for additional information necessary to confirm that identity. The Company asks for no more than that purpose requires and does not keep the information for longer than the handling of the request demands.
4.4 Searches and the Rights of Others.
Before it replies, the Company searches the systems on which the data may be held, including those of its sub-processors. Article 15(4) provides that the right to obtain a copy shall not adversely affect the rights and freedoms of others, and the Company accordingly redacts or withholds any part of a record that would disclose the answers, scores, or alerts of another Candidate.
4.5 Form of the Reply.
The Company replies in a concise, transparent, intelligible, and easily accessible form, in clear and plain language, as Article 12(1) requires. Where the request is made by electronic means, the reply is given by electronic means, and data supplied under Article 20 is provided in a structured, commonly used, and machine-readable format.
4.6 Refusal.
If the Company does not act on a request, Article 12(4) obliges it to inform the individual, without delay and at the latest within one month of receipt, of the reasons and of the possibility of lodging a complaint with a supervisory authority and of seeking a judicial remedy.
5. International Transfers: Operating Safeguards
5.1 Transfer Map.
Section 9 of the Privacy Policy identifies the legal mechanisms for transfers. In operational terms, personal data of individuals in the European Economic Area passes from the Organisation to the Company in India, is held on Microsoft Azure servers in the United States, is handled by the Company’s mail server in India, and may reach the providers of marketing email and analytics that section 8.3 of the Privacy Policy names. The Company selects a Chapter V mechanism for each of those recipients and records it in the data processing agreement.
5.2 Standard Contractual Clauses.
Where the Organisation acts as controller, the data processing agreement incorporates Module Two (transfer controller to processor) of the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914, and Module Three (transfer processor to processor) where the Organisation itself acts as a processor. The annexes are completed with the description of the transfer, the technical and organisational measures, and the list of sub-processors.
5.3 Assessment of Destination Laws.
Clause 14 of the standard contractual clauses requires the parties to assess whether the laws and practices of the country of destination prevent the importer from fulfilling its obligations. On request, the Company supplies an Organisation with information on the Indian provisions relevant to that assessment, among them section 69 of the Information Technology Act, 2000, which empowers the competent authority to direct the interception, monitoring, or decryption of information, and with a description of the supplementary measures that it applies, such as the access controls and logging described in section 12 of the Privacy Policy.
5.4 EU-US Data Privacy Framework.
Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 found that the United States ensures an adequate level of protection for personal data transferred to organisations participating in the EU-US Data Privacy Framework. On 3 September 2025, the General Court dismissed the action for annulment of that decision brought by Philippe Latombe (Case T-553/23), and the appeal against that judgment is pending before the Court of Justice as Case C-703/25 P at the date of the Statement. The Company therefore does not rely on the framework alone for transfers to its United States sub-processors; it requires standard contractual clauses or an equivalent safeguard in addition, and it will review the position if the decision is annulled, suspended, or amended.
6. Personal Data Breaches
6.1 Reporting and Escalation.
Suspected incidents are reported to security@ethition.com and escalated to the Data Protection Officer, who determines whether a personal data breach within the meaning of Article 4(12) has occurred.
6.2 Notice to Organisations.
The Company notifies the affected Organisation without undue delay after becoming aware of a breach affecting Assessment Data, as Article 33(2) requires of a processor. The notice describes, so far as the information is available, the nature of the breach, the categories and approximate numbers of data subjects and records concerned, the likely consequences, the measures taken or proposed, and the contact point of the Data Protection Officer. Under Article 33(4), information that cannot be given at the same time is provided in phases without further undue delay.
6.3 Breaches Affecting Data Controlled by the Company.
Where the Company is the controller, Article 33(1) requires notification to the competent supervisory authority within seventy-two (72) hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to the rights and freedoms of individuals, and Article 34(1) requires communication to the individuals concerned without undue delay where the risk is high.
6.4 Register.
In accordance with Article 33(5), the Company documents every personal data breach, including its facts, its effects, and the remedial action taken, whether or not notification was required.
7. Proctoring and Impact Assessment
7.1 Assessment by the Organisation.
An Organisation that enables a Proctoring Feature for Candidates in the Union determines the purposes and means of the monitoring and is therefore the party that Article 35(1) obliges to carry out an impact assessment where the processing is likely to result in a high risk. The monitoring of examination candidates, some of whom may be minors, combines several of the criteria listed in the Guidelines on Data Protection Impact Assessment (WP 248 rev.01) of the Article 29 Working Party, which the European Data Protection Board has endorsed, namely systematic monitoring, data concerning vulnerable data subjects, and the use of innovative technological solutions. The Organisation should also consult the list that its supervisory authority has adopted under Article 35(4).
7.2 Information Supplied by the Company.
On request, the Company provides the information that an Organisation needs for the assessment and for the notices that it owes to Candidates under Articles 13 and 14: a description of each Proctoring Feature and the data that it captures; the fact that webcam activity is analysed in real time and not kept as video or audio; the absence of any face matching and of any inference of emotions; the retention applied to alerts and event records; the sub-processors involved; and the security measures in place. The treatment of automated alerts under Article 22 is set out in section 6.2 of the Privacy Policy and in clause 6.3 of the Terms and Conditions.
9. Contact Channels
The following addresses serve the purposes stated below. The Grievance Officer of the Company is identified in section 13.1 of the Privacy Policy.
| Address | Purpose |
|---|---|
| privacy@ethition.com | General questions about the processing of personal data and about the Statement |
| dpo@ethition.com | Communications addressed to the Data Protection Officer |
| dsar@ethition.com | Requests to exercise the rights of individuals, including access, rectification, and erasure |
| security@ethition.com | Reports of security incidents and of suspected personal data breaches |
10. Review
The Company reviews the Statement whenever it changes a sub-processor, the hosting region, or a transfer mechanism, and whenever the legal position alters, including upon any decision of the Court of Justice in Case C-703/25 P. The date at the head of the document shows the latest revision.