Last updated: 9 October 2026
This Privacy Policy describes how Smowltech processes the personal data of the users of its website. It sets out what data we collect, the purposes for which it is processed and the means by which it is managed.
This policy does not cover the processing of personal data carried out by Smowltech through its proctoring applications. For further details on data processing in the context of our products, please see the SMOWL privacy policy.
1. Information for the user
Who is the controller of your personal data?
Smiley Owl Tech, S.L. (hereinafter, “Smowltech”), with Spanish tax number (CIF) B75073452 and registered office at calle Arturo Campión 22, 20018 Donostia / San Sebastián (Gipuzkoa, Spain), is the CONTROLLER of the USER’s personal data and informs the USER that this data will be processed in accordance with Regulation (EU) 2016/679 of 27 April (GDPR) and Spanish Organic Law 3/2018 of 5 December (LOPDGDD).
Contact address: Portuetxe Kalea, 53 B, office 112, 20018 Donostia / San Sebastián (Gipuzkoa, Spain).
Email: [email protected]
Why do we process your personal data and for what purposes?
Depending on the form or channel through which we obtained your personal data, we will process it confidentially for the following purposes:
|
Form or channel |
Purpose |
Legal basis |
|
“Watch a recorded demo” form |
To send the requested demo and respond to the enquiries submitted. |
Steps taken with a view to entering into a possible contract (art. 6.1.b GDPR). |
|
“Request a free demo” form |
To respond to enquiries or any other request made by the user through any of the contact channels made available on the controller’s website. |
Steps taken with a view to entering into a possible contract (art. 6.1.b GDPR). |
|
To carry out statistical analysis and market research. |
Legitimate interest of the controller (art. 6.1.f GDPR). |
|
|
“Talk to an expert” chat |
To respond to enquiries or any other request made by the user through any of the contact channels made available on the controller’s website. |
Steps taken with a view to entering into a possible contract (art. 6.1.b GDPR). |
|
To carry out statistical analysis and market research. |
Legitimate interest of the controller (art. 6.1.f GDPR). |
|
|
Newsletter subscription form |
To manage the subscription and send the subscriber weekly informational and commercial communications about SMOWL, online exam proctoring and digital assessment. |
Consent of the data subject (art. 6.1.a GDPR). |
|
Resource download form (guides, ebooks and other materials) |
To provide the requested resource and respond to any related enquiries. |
Steps taken with a view to entering into a possible contract (art. 6.1.b GDPR). |
|
To send weekly informational and commercial communications about SMOWL, where the user has expressly consented by ticking the corresponding box. |
Consent of the data subject (art. 6.1.a GDPR). |
The USER may withdraw consent and object to receiving commercial communications at any time, without affecting the lawfulness of processing based on consent before its withdrawal, by using the unsubscribe link included in each communication or by writing to [email protected].
How long will we keep your personal data?
Personal data will be kept for no longer than is necessary to fulfil the purpose of the processing or than required by legal provisions governing its retention. Once it is no longer necessary, it will be deleted using appropriate security measures to ensure the anonymisation of the data or its complete destruction.
Who do we share your personal data with?
No disclosure of personal data to third parties is envisaged, except where necessary for the development and execution of the purposes of the processing, to our service providers in the areas of communications, web form management, user chat support, customer and prospect relationship management and web analytics, with whom the CONTROLLER has signed the confidentiality and data processing agreements required by applicable privacy legislation.
Are international data transfers carried out?
No. The service providers the CONTROLLER works with host data on servers located within the European Union, so no personal data is transferred to countries outside the European Union.
What are your rights?
The USER has the following rights:
- The right to withdraw consent at any time.
- The right of access, rectification, portability and erasure of their data, and the right to restrict or object to its processing.
- The right to lodge a complaint with the supervisory authority (www.aepd.es) if they consider that the processing does not comply with applicable legislation.
To exercise these rights, the USER may write to the CONTROLLER stating the right they wish to exercise and enclosing a copy of a document proving their identity.
Contact details to exercise your rights: Smiley Owl Tech, S.L., Portuetxe Kalea, 53 B, office 112, 20018 Donostia / San Sebastián (Gipuzkoa, Spain). Email: [email protected]
Data Protection Officer contact details: [email protected]
2. Mandatory or optional nature of the information provided by the user
By ticking the relevant boxes and entering data in the fields marked with an asterisk (*) in the contact form or in download forms, USERS expressly, freely and unequivocally accept that their data is necessary for the provider to handle their request, while the inclusion of data in the remaining fields is optional. The USER warrants that the personal data provided to the CONTROLLER is accurate and is responsible for notifying any changes to it.
The CONTROLLER advises that all data requested through the website is necessary in order to provide an optimal service to the USER. If not all data is provided, the information and services supplied cannot be guaranteed to fully match the USER’s needs.
3. Cookies
This website uses first-party and third-party cookies. You can find out which cookies are used, for what purpose, for how long, and how to configure them or withdraw your consent in our Cookie Policy.
4. Information regarding minors
- Parental or legal guardian consent is required for the use of our services by minors under the age of 16. We do not knowingly collect, keep or use personally identifiable information from children under the age of 16.
- We encourage parents and legal guardians to monitor their children’s internet use and to help enforce this Privacy Policy by instructing them never to provide personal information through our Services without their permission.
- If we discover that a child under the age of 16 has provided us with personal information, we will take steps to delete that information.
5. Information security policy
At Smowltech we are committed to protecting the information of our clients, collaborators and business partners.
Our information security policy is aligned with the international ISO 27001 standard, ensuring the confidentiality, integrity and availability of data.
We implement appropriate technical and organisational measures to prevent unauthorised access, ensure the ethical use of information and comply with applicable legislation.
We continuously update our processes to respond to new threats and maintain the trust of our users.
Read our information security policy »
6. Our commitment to privacy
This section is informational and describes Smowltech’s general approach to privacy and data protection. The legal information required by the GDPR in relation to the processing of data on this website is set out in sections 1 to 5.
Our commitment
Earning the trust of our clients and of the users whose data we manage is an essential part of how we deliver our service. We want clients and users to know at all times why and what personal data is used. European guidelines set out the most ethical way to collect, process, disclose, store and delete personal data, and Smowltech, as a European company, is committed to GDPR compliance. In addition, having received European Community funding under the H2020 programme, we are subject to strict ethical standards regarding privacy.
We work with AWS (Amazon) so that we can place our servers in the regions our clients need in order to comply with data protection regulations. In the case of Europe, our servers are located in the European Union.
Privacy by design is the core of our business
We developed SMOWL with the importance of user privacy in mind and in compliance with all the safeguards required by European personal data protection legislation. To obtain the minimum possible amount of data and always preserve the user’s privacy and anonymity, we link the data collected to a platform user code rather than to names, surnames or email addresses.
What information is collected in our products?
The data collected depends on the type of service the client requires. Smowltech has defined a modular service that makes it possible to collect the minimum data needed to meet the client’s requirements, so we always work in proportion to the client’s needs and to the data to be collected. We will never ask users for information beyond what has been previously agreed by contract with the client.
Record of processing activities
We maintain a record of processing activities in accordance with personal data protection legislation, setting out the purpose for which data is processed, its type and its retention period, among other aspects.
Data Protection Impact Assessment (DPIA)
We carry out impact assessments in order to analyse, evaluate and manage the risks associated with the processing of personal data in the SMOWL system, which allows us to periodically improve everything relating to the security and privacy of our users’ personal data. We also have a template available to help new clients develop their own DPIAs.
Proactive accountability and security
We comply with the principles established in the legislation, with particular emphasis on privacy by design and by default across all technological development carried out. This entails proactive accountability that sets high security standards for all data processed in our systems. The institution will at no time have access to the student’s identity through the images: these are assigned exclusively to a code issued by the training centre for each student. We also always seek to obtain and process the minimum possible amount of user data to meet the intended purpose, in line with the data minimisation principle.
With the aim of continuously improving security, annual audits are carried out. We also hold all the documents and contracts required to comply with European and Spanish data protection legislation.
Our privacy principles
- Collect only the personal information that is necessary, that is not excessive and that is not kept for longer than needed to provide the service.
- Ensure that information is processed fairly and lawfully.
- Provide transparency, collecting information only for specific and legitimate purposes.
- Work constantly to make products and services more secure.
- Provide communication channels so that we can easily be contacted.
- Anonymise data before making secondary use of it for statistical purposes.
- Ensure that information is kept secure and inaccessible to those who have no right to access it.
- Never store, export or sell personal information for any other purpose.
Applicable legal frameworks
- GDPR: General Data Protection Regulation, the core of European digital privacy legislation.
- FERPA: the US federal law protecting the privacy of student education records.
- CCPA: the California Consumer Privacy Act.
- The European Union Artificial Intelligence Act.
- Laws and legal frameworks applicable to SMOWL.
FERPA: protection and privacy of education records
FERPA (Family Educational Rights and Privacy Act) is a US federal law that protects the privacy of student education records. The law gives parents and students the right to review education records and request corrections, and it sets limits on who these records can be shared with without the explicit consent of parents or students.
At Smowltech we are committed to protecting the privacy of student education records during the proctoring process. We comply with data privacy regulations, including FERPA, the European Union GDPR and the California CCPA. We work closely with the educational institutions that adopt our proctoring solution to ensure regulatory compliance, and we provide training and guidance so that they understand how student information is handled.
We use encryption and store student data on secure AWS servers. Only the institutions that have adopted our proctoring solution can access their users’ data, and data is stored for the stipulated period. Our employees receive privacy and data protection training, and we notify our clients by email in the event of a privacy breach.
Data Protection Officer
A Data Protection Officer has been appointed to oversee compliance with the legislation. Please do not hesitate to get in touch by email: [email protected].
Frequently asked questions
For clients: what do I need to do to comply with the GDPR in my organisation?
- Sign a data processing agreement between your organisation and Smowltech setting out the obligations and responsibilities regarding personal data protection.
- Carry out a privacy impact assessment in order to analyse, evaluate and manage the risks associated with the processing of personal data and to determine the proportionality and necessity of the system.
- Include the SMOWL system in your organisation’s record of processing activities in order to determine the type of data processed.
- Determine the necessary legal basis and put in place the mechanisms to obtain consent, where applicable, so that your users or students can use SMOWL in accordance with data protection legislation.
- Develop appropriate procedures to respond to requests to exercise data subject rights (access, rectification, portability, erasure, restriction of processing and objection), as well as the system for notifying security breaches where applicable.
- Appoint a Data Protection Officer if you do not already have one.
How is my information kept confidential?
We recognise and take seriously our responsibility to protect the information entrusted to us. For this reason, at Smowltech we have adopted the measures necessary to prevent the alteration, loss, unauthorised processing of or access to personal data. As regards the confidentiality of processing, Smowltech ensures that any person authorised to process personal data is subject to the corresponding confidentiality obligation, whether contractual or legal.
Please note that, although Smowltech makes every reasonable effort to protect your personal information and prevent unauthorised access, internet security measures are not infallible. In any event, in the case of a security incident, Smowltech will notify you without undue delay and provide timely information relating to that incident.
7. Changes to this policy
Smowltech reserves the right to change this Policy from time to time by publishing an updated policy on this site, which will be reflected in the “last updated” date. We may also provide you with additional notice on the home screen or send you an email notification. Please review this Policy periodically, and especially before providing personal information. Your continued use of the Services after any change or revision of this Policy will indicate that you agree to the terms of the revised Policy.
8. Get in touch with us
If you have any concerns or questions about our Privacy Policy and the data processing we carry out, please do not hesitate to contact us:
Portuetxe Kalea, 53 B, office 112, 20018 Donostia / San Sebastián, Gipuzkoa, Spain
This document was last updated on 9 October 2026