← Back to Trust & Security at Quilgo list

What data is collected

Quilgo collects only the data necessary to provide and secure online assessments, which includes:

  • User names and contact information
  • Records of user activity during assessments
  • Proctoring and monitoring data needed to uphold exam integrity
  • Aggregated and anonymized analytics for improving the platform

No sensitive personal data is processed under the Data Processing Addendum (DPA).

Who can access recordings?

Access to proctoring recordings and personal data is strictly limited to authorised users and personnel who have received explicit permission.

Quilgo implements role-based access controls and confidentiality obligations to ensure that only individuals who require access for operational, support, or security purposes can view assessment data. All access activities are logged unauthorised to prevent unauthorised access.

In some cases, approved subprocessors that provide infrastructure, storage, or support services may process data, adhering to equivalent security and confidentiality obligations.

How long is the data stored

Quilgo follows data minimization and storage limitation practices.

  • Test proctoring data is deleted after 3 months by default
  • Customers may request the deletion of personal data at any time
  • Upon termination of the agreement, customer data is deleted within 30 days following a written request

Retention periods may also be configured in accordance with the customer agreement and applicable legal requirements.

Custom data storage

Quilgo prioritises secure international data handling and relies on trusted infrastructure providers for its hosting and backup services.

Currently, our hosting locations include:

  • Amazon Web Services (AWS) in the EU
  • Google Cloud Platform (GCP) in the UK

Customers with specific compliance or regional data residency requirements are encouraged to contact Quilgo to discuss custom storage and processing arrangements. Before any subprocessor is utilised, we ensure they meet rigorous security, privacy, and confidentiality standards.