# Terms of Service LAST UPDATED: 29th September 2026 These Terms of Service (**Terms**) form a legally binding agreement between: * **Synap Learning Limited**, a company registered in England and Wales under number 08862590, whose registered address is Castleton Mill, Castleton Close, Leeds, England, LS12 2DR (**Synap**, **we**, **us**); and * the business or organisation purchasing, subscribing to or otherwise authorised to use the Services (**Customer**, **you**). By entering into an Order Form, creating a paid Subscription, or otherwise accepting these Terms on behalf of Customer, the person doing so confirms that they have authority to bind Customer. The agreement between Synap and Customer (**Agreement**) comprises the applicable Order Form, these Terms, the Data Processing Agreement, the Professional Services Agreement where applicable, and the policies expressly incorporated below. These Terms are intended for business customers, not for consumers or candidates taking an assessment. Candidates, learners and other End Users are not parties to these Terms. An End User should refer to the privacy information supplied by the organisation that invited and/or authorised them to use the Services. Our [Candidate Privacy Notice](https://legal.synap.ac/candidate-privacy-policy) also provides a plain-English explanation of Synap's role and how candidate information is typically handled. It is provided for transparency and does not form part of the Agreement. ### 1. Definitions **Acceptable Use Policy** means the policy at [legal.synap.ac/acceptable-use-policy](https://legal.synap.ac/acceptable-use-policy). **Account Owner** means the Admin User designated by Customer as having primary authority to administer the Subscription and receive contractual or account notices. **Admin User** means an Authorised User given administrative permissions for a Portal. **Affiliate** means an entity that directly or indirectly controls, is controlled by, or is under common control with a party, where control means ownership of more than 50% of the voting interests or the power to direct its management. **Authorised User** means an Admin User, End User or other individual whom Customer permits to access the Services. **Customer Data** means data, content and materials submitted to or generated through the Services by or for Customer or its Authorised Users, excluding service telemetry and information for which Synap acts as an independent Controller as described in the Privacy Policy. **Documentation** means the then-current user documentation and guidance that Synap makes available for the Services, including through its help centre. **DPA** means Synap's [Data Processing Agreement](https://legal.synap.ac/data-processing-agreement-dpa). **End User** means a learner, candidate or other non-administrative user of a Portal. **Order Form** means an ordering document, online checkout, proposal or other written or electronic agreement identifying the Services, Subscription Term, fees or usage allowance. **Portal** means Customer's configured instance of the Synap platform. **Professional Services Agreement** means Synap's [Professional Services Agreement](https://legal.synap.ac/professional-services-agreement), which applies where an Order Form identifies Professional Services. **Services** means the hosted assessment, learning, proctoring, reporting and related services identified in an Order Form or made available as part of Customer's Subscription. **Subscription Term** means the period identified in the Order Form, including any renewal period. ### 2. Formation and changes #### 2.1 Electronic acceptance An Order Form and changes to a Subscription may be accepted by signature, online checkout, email or another electronic method made available by Synap. A Subscription change must be accepted by Customer's Account Owner, billing administrator or another person whom Synap reasonably believes has authority to make the relevant commercial commitment. #### 2.2 Changes to these Terms Synap may update these Terms to reflect legal, regulatory, security, technical or operational developments. We will give reasonable advance notice of a material change through the Services, by email to the Account Owner or by another appropriate method. A materially adverse change will not apply during a current committed Subscription Term unless it is reasonably necessary to comply with law, address a security risk or prevent abuse. Otherwise, it will apply from the next renewal. If an unavoidable mid-term change materially reduces Customer's contractual rights, Customer may terminate the affected Services before it takes effect and receive a pro-rata refund of unused prepaid fees. #### 2.3 Purchase orders A purchase order, supplier-portal entry or other administrative document issued by Customer does not amend or form part of the Agreement, and any additional or conflicting terms in it are rejected. A purchase-order number is not a condition of payment unless the applicable Order Form expressly states otherwise. ### 3. Services and licence #### 3.1 Right to use Subject to the Agreement and payment of applicable fees, Synap grants Customer a non-exclusive, non-transferable right during the Subscription Term to permit its Authorised Users to access and use the Services and Documentation for Customer's internal business purposes and for Customer's delivery of assessments, learning or related services to its candidates, learners, employees, clients and other intended users. Customer may not sublicense, resell or make the Services available as a standalone competing service unless an Order Form expressly permits it. #### 3.2 Service delivery Synap will provide the Services substantially in accordance with the Documentation and applicable Order Form and will use commercially reasonable efforts to maintain their availability. Any specific uptime commitment or service credit is governed by the [Service Level Agreement](https://legal.synap.ac/service-level-agreement). Support is governed by the [Support Policy](https://legal.synap.ac/support-policy). Beta, trial or free services may be subject to additional limitations identified when they are made available. #### 3.3 Changes to the Services Synap may improve or modify the Services during the Subscription Term. Synap will not materially reduce the core functionality purchased by Customer without reasonable notice, except where a change is required for law, security, third-party service continuity or prevention of misuse. Synap may replace a feature with materially equivalent functionality. ### 4. Customer responsibilities Customer is responsible for: * its Authorised Users and their compliance with the Agreement; * configuring the Services appropriately for its intended use; * keeping their account, billing and security information accurate; * protecting credentials and promptly notifying Synap of suspected unauthorised access; * the legality, accuracy and quality of Customer Data and Customer's instructions; * providing notices, obtaining permissions and identifying lawful bases and special-category conditions required for Customer's processing of data; * its assessment, employment, educational and other decisions concerning End Users; and * maintaining copies of Customer Data made available for export where Customer's own continuity or record-keeping obligations require them. * ensuring that it's use and configuration of the Services is lawful and ethical, including but not limited to ensuring that it's use of Synap Services is not in violation of any applicable laws. Customer must comply with the Acceptable Use Policy and must not: * copy, modify, frame, mirror or create derivative works from the Services except as the Services expressly permit; * reverse engineer, decompile or attempt to discover source code except to the limited extent that law prevents this restriction; * use the Services or Documentation to build a competing product or service; * sell, rent, lease or otherwise commercially exploit access to the Services except as expressly permitted by an Order Form; * * #### se and data segregation * #### configuration unsuitable for the proposed use.4.2 Sanctions and export controls * introduce malicious code or vulnerabilities; or * use the Services unlawfully or in a way that infringes another person's rights. Synap may remove or restrict access to material, an account or a feature where reasonably necessary to prevent harm, address a security risk, comply with law or respond to a material breach. Where practicable, Synap will notify Customer and limit the restriction to what is necessary. Nothing in this section makes Customer responsible for Synap's own breach of the Agreement or applicable law. #### 4.1 Sanctions and export controls Each party will comply with the trade sanctions and export-control laws applicable to it in connection with the Agreement. Customer must not access, use, export, re-export or make the Services available in violation of those laws, including to a prohibited person, destination or end use. Synap may restrict, suspend or decline to provide an affected Service to the extent reasonably necessary to comply with applicable sanctions or export controls. Where legally permitted and reasonably practicable, Synap will notify Customer and limit the restriction to what is necessary. ### 4.2 Multi-organisation use and data segregation Where Customer uses the Services to provide access to separate institutions, clients or other organisations, Customer is responsible for selecting and configuring an appropriate account structure. Separate Portals or Synap's Subportals functionality should be used where separate organisations require distinct administrative or data-access boundaries. Roles and permissions within a Portal are intended to provide granular access controls between Authorised Users operating within the same organisational environment. They are not designed or represented as a substitute for tenant-level segregation between independent legal entities. Customer is responsible for reviewing and testing its configuration and ensuring that each Authorised User is granted access only to appropriate data. Synap may recommend or require changes to Customer's account structure where it reasonably considers the configuration unsuitable for the proposed use. ### 5. Customer Data and data protection #### 5.1 Ownership, responsibility and limited licence As between the parties, Customer retains its rights in Customer Data. Customer grants Synap and its subcontractors a non-exclusive licence to host, copy, transmit, display and otherwise process Customer Data only as necessary to provide, secure and support the Services, comply with Customer's documented instructions and exercise Synap's rights under the Agreement. Customer is responsible for Customer Data submitted by or on its behalf, including materials uploaded by Admin Users, End Users and other Authorised Users through Customer's Portal. Customer represents and warrants that it has, or has ensured that the relevant uploader has, all rights, licences, permissions and lawful authority necessary to submit the Customer Data, permit Synap to process it under the Agreement and grant the licence above. Customer must not instruct or permit an Authorised User to upload material that unlawfully infringes another person's rights. Synap does not approve or endorse Customer Data and is not responsible for its content, accuracy or legality, or for Customer's use of it. Nothing in this section limits Synap's obligations concerning Customer Data under the Agreement or applicable law. #### 5.2 Data protection roles The DPA is incorporated into the Agreement. Customer may act as Controller or Processor for Customer Data, and Synap acts as Processor or Subprocessor as applicable. Each party remains responsible for the obligations that apply to its own processing. If these Terms conflict with the DPA concerning personal data, the DPA prevails. #### 5.3 Storage, backup and export The Services are not a dedicated archival service. Synap maintains backup and resilience arrangements described in its [Security Policy](https://legal.synap.ac/security-policy), but Customer should not rely on the Services as the sole copy of records that Customer must preserve independently. During the Subscription Term, Customer may use available functionality to export or delete Customer Data. Synap will use commercially reasonable efforts to restore Customer Data from an available backup following loss or corruption caused by a Service failure, but restoration may not recover changes made after the relevant backup. Return, deletion and backup expiry following termination are governed by the DPA. #### 5.4 Proctoring, identity verification and automated analysis Customer may choose to enable features intended to support assessment integrity, identity verification or review. Depending on the selected configuration, these features may capture or process identification documents, selfies, facial images, webcam or audio recordings, screen activity, room or environment scans, identity-verification results, gaze or behavioural signals, and related metadata (**Assessment Integrity Features**). Customer determines whether and for what purposes to enable Assessment Integrity Features. Customer is responsible for assessing their suitability for its intended use, providing legally required notices, identifying an appropriate lawful basis and any special-category condition, obtaining required permissions or consents, completing any required impact assessment, and providing an alternative process where required by applicable law or Customer policy. Synap will process related personal data in accordance with the DPA and Customer's documented instructions. Recordings and room or environment scans may incidentally capture other individuals, communications, possessions or background information that neither party intends to analyse. Customer must provide reasonable instructions to End Users about preparing an appropriate environment and avoiding unnecessary capture. Unless expressly identified in the applicable Documentation or Order Form, Synap does not use these materials to infer sensitive personal characteristics. Automated or algorithmic outputs, including identity-verification results, confidence scores, alerts and indicators, are intended to support Customer's review process. They do not constitute a final determination of identity, misconduct, eligibility, qualification or outcome, and Synap does not guarantee that they will identify every relevant event or avoid every false indication. Customer remains responsible for decisions concerning an End User. Customer must apply appropriate human review before making a materially adverse decision based substantially on an automated output, unless Customer has separately determined that solely automated decision-making is lawful and has implemented all required safeguards. ### 6. Security and confidentiality #### 6.1 Security Synap will maintain appropriate technical and organisational measures designed to protect the Services and Customer Data against unauthorised access, alteration, disclosure, loss and destruction. Further information is available in the Security Policy and DPA. #### 6.2 Confidential Information **Confidential Information** means non-public information disclosed by one party (**Discloser**) to the other (**Recipient**) that is identified as confidential or should reasonably be understood to be confidential given its nature and the circumstances. Customer Data is Customer's Confidential Information. The Services, non-public Documentation, security information, pricing and performance-test results are Synap's Confidential Information. Confidential Information does not include information that the Recipient can demonstrate: * is or becomes public without breach of the Agreement; * was lawfully known without restriction before disclosure; * is received lawfully from a third party without confidentiality duty; or * is independently developed without use of the Discloser's Confidential Information. The Recipient will use Confidential Information only to perform or exercise rights under the Agreement, protect it using at least reasonable care and disclose it only to personnel, professional advisers and subcontractors who need to know it and are bound by appropriate confidentiality duties. A Recipient may disclose information where legally required, provided it gives advance notice where legally permitted and reasonably cooperates with protective steps at the Discloser's expense. On request or termination, each party will return or delete the other's Confidential Information where reasonably practicable, subject to legal retention, routine protected backups and the DPA. These obligations continue for five years after disclosure or termination, and for trade secrets for as long as they remain protected as trade secrets. Obligations concerning personal data continue as required by applicable law and the DPA. ### 7. Third-party services #### 7.1 Customer-directed integrations Customer may choose to connect the Services to a third-party product or account. Customer authorises Synap to exchange the information reasonably necessary for that integration and is responsible for its relationship with the third-party provider. Synap is not responsible for a third-party product selected or controlled by Customer, or for Customer Data after Customer directs its export to that product, except to the extent a loss is caused by Synap's breach of the Agreement. #### 7.2 Synap providers Third parties engaged by Synap to provide part of the Services remain subject to Synap's obligations under the Agreement. Subprocessors are governed by the DPA and [Subprocessors List & Management Policy](https://legal.synap.ac/subprocessors-list-and-management-policy). ### 8. Fees, billing and renewal #### 8.1 Fees and taxes Customer will pay the fees in the Order Form. Unless stated otherwise, invoices are due within 30 days, fees are non-refundable except where the Agreement expressly provides otherwise, and fees exclude applicable taxes. Except for an amount disputed reasonably and in good faith under section 8.3 or a deduction required by law, Customer will pay amounts due without set-off, counterclaim, deduction or withholding. Customer is responsible for taxes arising from its purchase other than taxes based on Synap's net income. Synap may charge tax where legally required. #### 8.2 Card payments Where Customer provides a payment card, Customer authorises Synap and its payment provider to charge recurring subscription, usage and other agreed fees. Customer must keep payment information current and remains responsible for charges that cannot initially be collected. #### 8.3 Late payment and suspension Undisputed overdue sums may accrue interest at 1.5% per month or the maximum lawful rate, whichever is lower. Synap may suspend affected Services after at least five days' notice of an overdue amount. Synap will not suspend for an amount disputed reasonably and in good faith while Customer cooperates diligently to resolve the dispute. Suspension does not relieve Customer of the obligation to pay undisputed fees. #### 8.4 Renewal and cancellation A Subscription renews and may be cancelled as stated in the Order Form. Where no separate notice period is stated, Customer may give notice of non-renewal before the end of the current Subscription Term through available account-management tools or in writing. Cancellation takes effect at the end of the current Subscription Term. #### 8.5 Free trials Synap may end or restrict a free trial at any time. Free trials must not be used to deliver live or business-critical examinations unless Synap agrees otherwise in writing. Support and uptime commitments do not apply to free trials. Trial data may be deleted beginning seven days after the trial ends or payment fails. Customer is responsible for exporting anything it wishes to retain before then. Synap may suspend or delete abusive or duplicate trial accounts without advance notice where reasonably necessary to prevent misuse. Further billing information is available in the [Billing & Payment Terms](https://legal.synap.ac/billing-and-payment-terms). ### 9. Intellectual property Synap and its licensors retain all rights in the Services, Documentation, software, models, designs, interfaces and underlying technology, including improvements and derivative works. No ownership is transferred to Customer. Customer may provide suggestions or feedback. Customer grants Synap a worldwide, perpetual, irrevocable, royalty-free right to use feedback without identifying Customer or disclosing Customer Confidential Information. Synap may create and use aggregated or de-identified information that does not identify Customer or an individual, provided it does not attempt to re-identify it. ### 10. Warranties and disclaimers Each party warrants that it has authority to enter into the Agreement. Synap warrants that during the Subscription Term the Services will perform materially in accordance with the Documentation when used as authorised. If Synap breaches this warranty, it will use commercially reasonable efforts to correct the non-conformity. If it cannot do so within a reasonable period, Customer may terminate the materially affected Services and receive a pro-rata refund of unused prepaid fees. Correction or, where applicable, termination and refund are Customer's sole and exclusive remedies for breach of the performance warranty in this section. The warranty does not apply to a non-conformity caused by Customer Data, Customer's instructions or configuration, use contrary to the Agreement or Documentation, an unauthorised modification, or a third-party product or system not supplied or controlled by Synap. Except as expressly stated and to the fullest extent permitted by law, the Services, Documentation, beta features and trials are provided “as available”. Synap does not warrant uninterrupted or error-free operation, that every defect will be corrected, or that the Services will meet requirements not documented in the Agreement. Customer is responsible for decisions and results based on its configuration and use of the Services. Synap does not make assessment, employment, qualification or disciplinary decisions on Customer's behalf. **To the fullest extent permitted by law, all warranties, representations and conditions implied by statute, common law or otherwise are excluded, including any implied warranty or condition of merchantability, satisfactory quality, fitness for a particular purpose, title and non-infringement. This does not limit the express warranty or Synap IP indemnity stated in the Agreement.** ### 11. Limitation of liability #### 11.1 Liabilities that are not limited Nothing in the Agreement excludes or limits liability for: * death or personal injury caused by negligence; * fraud or fraudulent misrepresentation; * Customer's obligation to pay fees properly due; * breach of a liability that cannot lawfully be excluded or limited; or * deliberate infringement or misappropriation of the other party's intellectual property rights. #### 11.2 Excluded losses Subject to section 11.1, neither party is liable for loss of profit, revenue, anticipated savings, business opportunity or goodwill, or for indirect, special or consequential loss. This exclusion does not prevent recovery of amounts payable to a third party under an indemnity in section 12, reasonable costs of investigating and mitigating a personal-data breach caused by the liable party, or reasonable costs of restoring lost or damaged Customer Data, to the extent otherwise recoverable under the Agreement. #### 11.3 General cap Subject to sections 11.1 and 11.4, each party's total aggregate liability arising out of or relating to the Agreement will not exceed the fees paid or payable by Customer for the affected Services during the 12 months immediately before the event giving rise to the first claim. If that event occurs during the first 12 months of the Subscription Term, the cap is the fees paid or payable for the affected Services from the start of the Subscription through its first anniversary. #### 11.4 Higher cap Each party's total aggregate liability for breach of section 6 (Security and confidentiality), the DPA, and its obligations under section 12 (Indemnities) will not exceed two times the cap calculated under section 11.3. The higher cap is not additional to the general cap. Amounts paid under either cap reduce the amount available under the other for the same events. #### 11.5 Scope The limitations apply in aggregate across contract, tort including negligence, misrepresentation, restitution, breach of statutory duty and any other cause of action, and apply to the parties' Affiliates, personnel and subcontractors. The DPA may identify liabilities that cannot lawfully be limited. Nothing in these Terms restricts a data subject's rights or a regulator's powers. ### 12. Indemnities #### 12.1 Customer indemnity Customer will defend Synap against a third-party claim to the extent it alleges that: * Customer Data or materials supplied by Customer infringe that third party's intellectual property, privacy or other rights; * Customer's unlawful instructions, configuration or use of the Services caused the claim; * Customer materially breached the Acceptable Use Policy; or * Customer failed to provide a legally required notice, lawful basis, permission or assessment concerning its relationship with an End User. Customer will indemnify Synap for damages and reasonable external legal costs finally awarded or agreed in settlement of such a claim. This indemnity does not apply to the extent the claim was caused by Synap's breach of the Agreement, negligence or wilful misconduct. #### 12.2 Synap IP indemnity Synap will defend Customer against a third-party claim alleging that Customer's authorised use of the Services infringes: * a patent issued in the United Kingdom; * where Customer is established in the United States of America, a patent issued in the United States of America; or * a copyright, trade mark, database right or right of confidentiality. Synap will indemnify Customer for damages and reasonable external legal costs finally awarded or agreed in settlement. The indemnity does not apply to a claim arising from Customer Data, a Customer or third-party modification, combination with an item not supplied or approved by Synap, use contrary to the Agreement or Documentation, or continued use after Synap has notified Customer to stop because of the claim. If such a claim is made or reasonably likely, Synap may obtain the right for Customer to continue using the affected Services, modify or replace them with materially equivalent functionality, or terminate the affected Services and refund unused prepaid fees for the terminated period. #### 12.3 Procedure An indemnity applies only if the indemnified party: * gives prompt notice of the claim, with delay relieving the indemnifying party only to the extent materially prejudiced; * provides reasonable cooperation at the indemnifying party's expense; and * gives the indemnifying party control of the defence and settlement. The indemnifying party may not settle a claim in a way that admits fault by, imposes non-monetary obligations on, or fails to release the indemnified party without that party's prior written consent, not to be unreasonably withheld. The indemnities are subject to section 11 unless section 11.1 applies. ### 13. Term and termination #### 13.1 Termination for cause Either party may terminate the Agreement or an affected Order Form by written notice if the other party: * materially breaches the Agreement and, where the breach can be remedied, fails to remedy it within 30 days after notice; * clearly states or otherwise unequivocally indicates that it will not pay a material, undisputed payment obligation when due; * to the extent permitted by applicable law, becomes insolvent, enters administration or liquidation, ceases business, or is subject to an analogous event; or * repeatedly breaches the Agreement in a manner that reasonably demonstrates it cannot or will not comply. Synap may suspend access immediately where reasonably necessary to prevent a security threat, unlawful use or material harm. Where practicable, Synap will notify Customer and restore access when the issue is resolved. #### 13.2 Effect of termination Termination does not affect accrued rights or payment obligations. Customer must stop using the terminated Services and pay fees due through the effective termination date. Customer may export Customer Data during the Subscription Term and any post-termination period made available by Synap. Customer Data is returned or deleted in accordance with the DPA. Customer remains responsible for exporting records it needs to retain. If Customer terminates for Synap's uncured material breach, Synap will refund prepaid fees covering the terminated period. Otherwise, prepaid fees are non-refundable except where the Agreement states differently. Provisions intended by their nature to survive will do so, including payment, intellectual property, confidentiality, liability, indemnities, data return or deletion, and general terms. ### 14. Publicity Synap may identify Customer publicly as a customer only with Customer's prior written consent. Any permitted use of Customer's name or logo must follow reasonable brand guidelines and does not imply endorsement. ### 15. General #### 15.1 Subcontractors Synap may use subcontractors to provide the Services but remains responsible for their performance as required by the Agreement. Subprocessors are governed by the DPA. #### 15.2 Assignment Neither party may assign the Agreement without the other's prior written consent, not to be unreasonably withheld. Either party may assign it without consent to an Affiliate or in connection with a merger, reorganisation or transfer of substantially all relevant business or assets, provided the assignee is able to perform the Agreement and is not a direct competitor of the non-assigning party. Customer may not assign to a direct competitor of Synap without Synap's consent. #### 15.3 Notices Legal notices must be in writing and sent by email and, where the notice concerns termination for cause, indemnity or litigation, also by recorded delivery or recognised courier. Notices to Synap must be sent to . Notices to Customer may be sent to the Account Owner email and address stated in the Order Form. Routine service, billing and operational messages may be delivered electronically through the Services or email. #### 15.4 Force majeure Neither party is liable for delay or failure caused by events beyond its reasonable control, excluding payment obligations. The affected party will take reasonable steps to mitigate the effect and keep the other informed. If a material force-majeure event continues for more than 60 days, either party may terminate the affected Services on written notice. #### 15.5 Entire agreement and reliance The Agreement constitutes the entire agreement concerning its subject matter and supersedes prior proposals and communications. Each party acknowledges that it has not relied on a statement not included in the Agreement, but nothing excludes liability for fraud or fraudulent misrepresentation. Customer's purchase is not contingent on the delivery of future functionality or features. Roadmaps, demonstrations and statements concerning possible future functionality do not create a binding commitment unless expressly included in an Order Form. Except for an update or change made under section 2, an amendment or variation of the Agreement is effective only if it is recorded in writing or accepted electronically by authorised representatives of both parties. An oral statement, informal discussion or course of dealing does not modify the Agreement. #### 15.6 Order of precedence If documents conflict, the following order applies: 1. mandatory terms of an applicable international-transfer mechanism, for the relevant transfer; 2. the DPA, for personal-data matters; 3. the Order Form; 4. the Professional Services Agreement, for Professional Services; 5. these Terms; and 6. another incorporated policy. An Order Form overrides the DPA only where it expressly identifies the DPA provision being amended and the amendment is lawful. #### 15.7 No partnership; third-party rights The Agreement does not create a partnership, joint venture, fiduciary or agency relationship. Neither party may bind the other. A person who is not a party has no right to enforce the Agreement under the Contracts (Rights of Third Parties) Act 1999. #### 15.8 Waiver and severability A failure or delay to exercise a right is not a waiver. If a provision is invalid or unenforceable, it will be modified to the minimum extent necessary or deleted, without affecting the remaining provisions. #### 15.9 Insurer subrogation Nothing in the Agreement waives any right of subrogation that a party's insurer may have by operation of law or under the applicable insurance policy. Any insurer exercising such a right is subject to the same limitations, exclusions, defences and procedural requirements that would apply to the insured party. #### 15.10 Insurance During the Subscription Term, Synap will maintain insurance with reputable insurers in types and amounts that are commercially reasonable having regard to the nature and scale of the Services, including cyber liability and technology professional indemnity or errors and omissions coverage, together with any insurance required by applicable law. On reasonable written request, Synap will provide Customer with a certificate of insurance or other reasonable evidence of that coverage. Synap is not required to disclose full policy wording or commercially sensitive information. The existence or amount of insurance does not increase Synap's liability or alter any limitation, exclusion or remedy under the Agreement. #### 15.11 Governing law and dispute resolution The Agreement and any dispute or non-contractual obligation arising out of or in connection with it are governed by the laws of England and Wales. If Customer is established outside the United States of America, the courts of England and Wales have exclusive jurisdiction. If Customer is established in the United States of America, any dispute, controversy or claim arising out of or in connection with the Agreement, including its existence, validity or termination and any non-contractual obligation, will be finally resolved by arbitration under the Rules of the London Court of International Arbitration, which are incorporated into this section. The seat of arbitration will be London, England. The tribunal will consist of one arbitrator and the language of the arbitration will be English. Nothing in this section prevents either party from seeking urgent interim or injunctive relief from a court of competent jurisdiction or from bringing proceedings to recover an undisputed overdue payment. An arbitral award will be final and binding and may be enforced in any court of competent jurisdiction. Nothing in this section makes Customer respo #### 4.nsible for Synap's own breach of the Agreement or applicable law. # Privacy Policy How Synap uses personal information when acting as a controller for its website, business relationships, customer accounts and administration. LAST UPDATED: 29th September 2026 ## 1. About this policy This Privacy Policy explains how **Synap Learning Limited** uses personal information when we decide why and how it is processed. In data-protection law, this means Synap acts as a **Controller**. Synap Learning Limited is a company registered in England and Wales under company number 08862590. Our address is Castleton Mill, Castleton Close, Leeds, England, LS12 2DR. You can contact our privacy team at . This policy principally applies when you: * visit a website operated directly by Synap, including [synap.ac](https://synap.ac); * enquire about, buy, administer or support a Synap subscription; * act as an account owner, administrator or business contact for a Synap Customer; * communicate with us about our business, events, partnerships or services; or * otherwise interact with Synap in a business or professional capacity. ### Candidates and learners If an organisation has registered you to take an assessment or use a Synap Portal, that organisation normally decides why your candidate information is used and Synap processes it on its behalf. Please read that organisation's privacy notice, the information shown before your assessment and our [Candidate Privacy Notice](https://legal.synap.ac/candidate-privacy-policy). Our [Data Processing Agreement](https://legal.synap.ac/data-processing-agreement-dpa) governs Synap's processing of Customer Data on behalf of Customers. This Privacy Policy does not replace those arrangements. A person can fall into more than one category. For example, a Customer administrator who also visits our marketing website is covered by this policy for both activities. ## 2. Information we collect and how we use it The table below describes our principal Controller activities. The information we receive depends on your relationship with Synap and the services you use. | Activity | Information and sources | Purposes | Lawful basis | | ------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Customer and administrator accounts** | Name, business email, organisation, job title, account role, authentication and security records, Portal association, service configuration and account activity. We receive this from you, your organisation and our systems. | Establish and administer the Customer relationship; provide account access; attribute administrative actions; communicate about the service; maintain security and audit records. | Performance of a contract where you contract with us personally; otherwise our legitimate interests in providing and administering the service and the Customer's legitimate interests in managing its account; compliance with legal obligations where applicable. | | **Sales and business enquiries** | Name, business contact details, employer, role, correspondence, meeting notes, requirements, opportunity history and communication preferences. We receive this from you, your organisation, referrals, events and professional or publicly available sources. | Respond to enquiries; arrange demonstrations and meetings; prepare proposals; develop and manage business relationships; maintain accurate records of communications. | Steps requested before entering a contract; our legitimate interests in developing and managing our business; consent where required. | | **Service communications and support** | Contact details, support messages, call or meeting information, case history, technical details and limited extracts needed to investigate an issue. | Provide support and training; answer questions; diagnose problems; communicate operational, security and contractual information. | Performance of a contract; our legitimate interests and those of the relevant Customer in supporting and securing the service; compliance with legal obligations. Customer Data included in a support case remains subject to the DPA. | | **Website and service usage** | IP address, browser and device characteristics, operating system, referring pages, approximate location derived from IP address, timestamps, pages and features used, cookie identifiers and security events. We collect this from your browser, device and our service providers. | Operate and secure our websites and services; prevent misuse; diagnose faults; understand performance and use; improve navigation, content and services. | Our legitimate interests in operating, securing and improving our services; consent where required for cookies or similar technologies. | | **Billing and commercial administration** | Customer and billing contact details, subscription, order and invoice information, payment status, transaction references and tax information. Payment-card details are handled by our payment providers; Synap does not ordinarily store full card numbers or card security codes. | Process payments; administer subscriptions; maintain financial records; prevent fraud; manage debt and disputes. | Performance of a contract; compliance with tax, accounting and other legal obligations; our legitimate interests in managing payments and preventing fraud. | | **Marketing and events** | Name, organisation, role, contact details, interests, event participation, engagement with communications and marketing preferences. | Send relevant product and company information; invite contacts to events; measure and improve campaigns; maintain suppression records. | Consent where required; otherwise our legitimate interests in business-to-business marketing and developing our services. You may opt out at any time. | | **Feedback, research and testimonials** | Survey responses, interview notes, feedback and, with permission, your name, role, organisation, image or testimonial. | Understand and improve our services; conduct research; publish agreed testimonials or case studies. | Our legitimate interests in improving our services; consent for publication where appropriate. | | **Security, compliance and legal matters** | Account, device, access, correspondence, transaction, audit and incident information, together with information relevant to a complaint, dispute or legal request. | Protect people, systems and information; investigate suspected misuse; establish, exercise or defend legal claims; comply with law and regulatory requirements. | Our legitimate interests in protecting our business and users; compliance with legal obligations; establishment, exercise or defence of legal claims. | We may combine information collected through these activities where the purposes are compatible. If we intend to use personal information for a materially different purpose, we will provide appropriate information before doing so. ## 3. Information from other sources In addition to information provided directly by you, we may receive personal information from: * your employer or another Synap Customer; * colleagues who identify you as a relevant contact or authorised user; * payment, identity, communications and account-management providers; * event organisers, referral partners and professional advisers; * publicly available company websites and professional profiles; and * security, fraud-prevention and technical service providers. We do not treat publicly available information as exempt from data-protection requirements. ## 4. When information is required Some information is required to enter into or administer a contract, create a secure account, process payment or comply with law. If it is not provided, we may be unable to create the account, provide the requested service, process an order or meet a legal requirement. Other information, including optional profile fields, survey responses and most marketing preferences, is voluntary. We will identify material consequences at the point of collection where they may not be obvious. ## 5. Cookies and similar technologies We use cookies and similar storage or access technologies to operate our websites and services, keep users signed in, protect accounts, remember settings and understand usage. We may also use analytics or advertising technologies on our marketing website. Where consent is required, non-essential technologies are not used until the relevant choice has been made. You can change your choices through the available cookie controls. Our [Cookie Policy](https://legal.synap.ac/cookie-policy) provides further information. Candidate exam portals do not use advertising cookies. Their essential and functional technologies are explained in the Candidate Privacy Notice and Cookie Policy. ## 6. How we share personal information We may share personal information with: * companies that provide hosting, communications, analytics, customer-support, customer-relationship, billing, payment, security and professional services to Synap; * the Synap Customer or organisation with which your account or business contact is associated; * advisers, auditors, insurers, banks and prospective investors or purchasers subject to appropriate confidentiality arrangements; * regulators, courts, law-enforcement bodies and other recipients where disclosure is required or permitted by law; and * a successor or relevant participant in a merger, acquisition, financing, reorganisation or sale of all or part of our business. We require service providers to protect personal information and use it only for the agreed purpose. Our [Subprocessors List & Management Policy](https://legal.synap.ac/subprocessors-list-and-management-policy) also identifies important platform and business-service providers. Not every provider listed there is a Subprocessor for every activity. We do not sell personal information for money. We do not use candidate assessment, proctoring or identity information for Synap's own targeted advertising. ## 7. International transfers Our marketing website and principal EU platform workloads are hosted in Ireland. Synap also operates a United States platform stack, and some service providers or their personnel process information in the United States or other countries. Where applicable law restricts an international transfer, we use an available lawful mechanism. Depending on the transfer, this may include: * UK or EU adequacy arrangements; * an applicable Data Privacy Framework certification, including the UK Extension where relevant; * the EU Standard Contractual Clauses with the UK Addendum where required; * the UK International Data Transfer Agreement; or * another mechanism permitted by applicable law. We also assess providers and apply contractual, technical and organisational safeguards appropriate to the processing. Contact if you would like further information about the safeguards relevant to a particular transfer. Customer Data transfers are governed more specifically by the DPA and Subprocessor page. ## 8. Retention We keep personal information only for as long as reasonably necessary for the relevant purpose, including to provide services, maintain security and audit records, comply with legal obligations and establish or defend legal claims. The period depends on the nature of the information and our relationship with you. In particular: * active Customer and administrator account information is generally kept for the duration of the relationship and a reasonable period afterwards; * contracts, invoices and core transaction records are generally retained for at least the period required by applicable tax, accounting and company law, ordinarily six years; * sales, support and business correspondence is retained according to its continuing relevance, contractual requirements and applicable limitation periods; * marketing information is retained while it remains relevant, unless you opt out; we may retain a minimal suppression record to respect an opt-out; * security logs and incident records are retained according to risk, investigation and assurance requirements; and * cookie and similar-technology periods are described in the Cookie Policy or relevant control. We delete or anonymise information when it is no longer needed. Residual copies in protected backups are overwritten through the applicable backup cycle and are not used for ordinary business purposes. ## 9. Security We use technical and organisational measures designed to protect personal information against unauthorised access, alteration, disclosure, loss or destruction. These include access controls, encryption in transit and at rest, monitoring, staff confidentiality and documented security procedures. Synap maintains ISO 27001 certification. Further information is available in our [Security Policy](https://legal.synap.ac/security-policy). No online system is completely secure. Please contact us promptly if you believe personal information connected with Synap may be at risk. ## 10. Automated decision-making Synap does not ordinarily use the personal information covered by this Policy to make solely automated decisions that have legal or similarly significant effects on website visitors, business contacts or Customer administrators. Product features that assist a Customer with assessment, proctoring or identity review concern Customer Data and are explained through the Candidate Privacy Notice, the Customer's own notices and information shown before the feature is used. If we introduce significant automated decision-making for a Controller activity, we will provide meaningful information about the information used, the rationale and likely consequences, together with applicable safeguards and rights. ## 11. Your rights Depending on where you live and the applicable law, you may have rights to: * obtain information about our use of your personal information and request access to it; * ask us to correct inaccurate or incomplete information; * ask us to delete information; * restrict or object to particular processing; * receive certain information in a portable format; * withdraw consent, without affecting earlier lawful processing; * object to direct marketing at any time; and * complain to a data-protection regulator. These rights are not absolute and may depend on the processing and lawful basis. We may ask for information reasonably necessary to verify your identity and locate the relevant records. To exercise a right, email . Where a request concerns Candidate or other Customer Data controlled by a Synap Customer, we will direct or forward the request to that Customer as appropriate. You may unsubscribe from marketing emails using the link in the message. We may still send necessary service, security or contractual communications. ### Complaints You can make a privacy complaint by emailing with the subject **Privacy complaint**. We will acknowledge a complaint within 30 days, investigate it appropriately and respond without undue delay. You may also complain to the UK Information Commissioner's Office through [ico.org.uk/make-a-complaint](https://ico.org.uk/make-a-complaint/) or to another competent supervisory authority, including in the country where you live or work. ## 12. Additional information for United States residents Privacy laws in certain US states may provide additional rights where they apply to Synap's processing. These may include rights to confirm whether information is processed, access, correct, delete or obtain a copy of it, opt out of certain sales, sharing, targeted advertising or profiling, and appeal a refusal of a request. Synap does not sell personal information for money. Some advertising or analytics disclosures on our marketing website may be treated as a “sale”, “sharing” or targeted advertising under particular state laws even where no money changes hands. Where applicable, you may use our cookie controls or contact to exercise an opt-out. Where required, we will treat a recognised opt-out preference signal as a request for the browser or device sending it. We will not discriminate against you for exercising an applicable privacy right. An authorised agent may make a request where permitted by law, subject to reasonable verification of the authority and request. Synap does not currently offer a financial incentive in exchange for personal information. ## 13. Children Our corporate and marketing services are directed principally to organisations and business users, not children. A Customer may use the Synap platform to provide assessments or learning activities to a child, but the Customer controls that candidate processing and must provide age-appropriate information and safeguards. The Candidate Privacy Notice provides a general explanation of Synap's role. If you believe a child has provided personal information directly to Synap for our own marketing or business purposes without appropriate authority, contact . ## 14. Changes to this policy We review this Policy regularly and may update it to reflect changes in our services, practices or legal obligations. We will update the date above and, where a change is material, provide an appropriate additional notice. ## 15. Contact **Synap Learning Limited**\ Company number: 08862590\ Castleton Mill, Castleton Close\ Leeds, England, LS12 2DR\ Email: # Support Policy LAST UPDATED: 29th September 2026 This Support Policy forms part of the [Synap Terms of Service](https://legal.synap.ac/terms-of-service) (**Agreement**) between Synap and Customer. Defined terms have the meanings given in the Agreement. ## 1. Standard Support ### 1.1 Support hours **Routine Support** is available from 09:00 to 17:00 UK time, Monday to Friday, excluding public holidays in England. **Emergency Support** is available 24 hours a day, seven days a week for genuine Priority 1 Incidents affecting production Services. Support is available through the in-Service live-chat facility or at . Customer should clearly identify an urgent report as **Priority 1** and provide current contact details. ### 1.2 Reporting an Incident An **Incident** is an error or abnormal behaviour of the Services. Customer will provide information and reasonable cooperation needed to investigate it, including where available: * the affected Service and functionality; * the number and type of affected users; * the business and assessment impact; * the approximate start time and duration; * steps to reproduce the issue; * relevant error messages, screenshots or technical logs; and * recent changes that may be connected with the issue. Customer should avoid including candidate responses, identity documents, proctoring recordings, special-category data, authentication credentials or other sensitive Customer Data unless it is specifically necessary for the investigation and an appropriate method has been agreed. ### 1.3 Priority and response targets Synap assigns the Priority based on the information reasonably available and may change it as the Incident develops. | Priority | Description | Initial response target | | ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------- | | **Priority 1 — Critical** | The production Service is unavailable or critically impaired for a substantial number of users, a live assessment is materially prevented from operating, or a serious security issue requires immediate action; no reasonable workaround is available. | 2 elapsed hours, 24/7 | | **Priority 2 — High** | Important production functionality is materially degraded for multiple users, but the Service remains substantially available or a workaround exists. | 1 UK business day | | **Priority 3 — Standard** | A non-critical defect, question or usability issue with no material effect on availability or core operation. | 3 UK business days | A response target is a target for acknowledgement and initial engagement, not a guaranteed resolution time. Resolution depends on the nature, reproducibility and cause of the Incident and on Customer's cooperation. Synap will use commercially reasonable efforts to investigate and resolve Incidents according to their Priority and will provide reasonable progress information for an active Priority 1 Incident. ### 1.4 Exclusions Synap is not required to provide support to the extent an Incident is caused by: * use contrary to the Agreement or Documentation; * Customer's equipment, software, network, configuration or third-party service; * a general internet, utility or telecommunications failure outside Synap's reasonable control; * Customer's failure to implement a documented fix or supported configuration; or * a force-majeure event under the Agreement. This exclusion does not apply merely because Synap uses a subcontractor to provide part of the Services. Synap remains responsible for its subcontractors as stated in the Agreement. Where practicable, Synap may still assist with an excluded issue on a reasonable-efforts basis or under an agreed Professional Services engagement. ## 2. Customer responsibilities Customer will: * maintain appropriate administrator and escalation contacts; * ensure Authorised Users first follow relevant Documentation and status information; * report Incidents promptly and accurately; * provide timely access, evidence and cooperation reasonably required for investigation; * maintain supported browsers, devices and integrations; and * make operational decisions and communicate with its End Users unless Synap has expressly agreed to do so. A delay caused by missing information, unavailable contacts or Customer-controlled systems may pause the applicable response target. ## 3. Enhanced support and event cover Synap may offer enhanced support, examination-event cover, extended preparation, monitoring or other professional assistance under a separate Order Form or the [Professional Services Agreement](https://legal.synap.ac/professional-services-agreement). The Order Form will identify the covered dates, hours, contacts, activities, assumptions and fees. Enhanced cover applies only during the stated period and does not create an ongoing support commitment. ## 4. Relationship with the SLA This Support Policy governs support handling and response targets. Availability commitments and service credits are governed by the [Service Level Agreement](https://legal.synap.ac/service-level-agreement). Unless an Order Form expressly states otherwise, response targets are service objectives and do not give rise to service credits. # Service Level Agreement This Synap Service Level Agreement ("SLA") accompanies the Synap Subscription Terms of Service, available at ] or a successor URL (the "Agreement") entered into between you ("Customer") and Synap. Capitalised terms used in this SLA that are not defined herein have the meanings given to them in the Agreement. 1. **Target Availability.** Synap will use commercially reasonable efforts to make each Service available with an uptime of 99.9% of each calendar month ("Target Availability"). 2. **Exclusions.** The calculation of uptime will not include unavailability to the extent due to: (a) use of the Service by Customer in a manner not authorised in this Agreement or the applicable Documentation; (b) general Internet problems, force majeure events or other factors outside of Synap's reasonable control; (c) Customer's equipment, software, network connections or other infrastructure; (d) third party systems, acts or omissions; or (e) Scheduled Maintenance or reasonable emergency maintenance. This SLA does not apply to any services which are considered 'Beta' or 'In Development'. 3. **Scheduled Maintenance.** Means Synap's scheduled routine maintenance of the Services for which Synap notifies Customer at least seventy two (72) hours in advance. Scheduled Maintenance will not exceed eight (8) hours per month. Please note, Scheduled Maintenance such as this is exceedingly rare - we do not routinely do this as in the vast majority of cases where an update is required, we can perform this on a 'rollover' basis without requiring downtime. 4. **Remedy for Failure to Meet Target Availability.** If there is a verified failure of a Service to meet Target Availability in two (2) consecutive months, then Customer may terminate the applicable Subscription Term by sending written notice of termination within thirty (30) days after the end of the second such month, in which case Synap will refund to Customer any fees Customer has pre-paid for use of such Service for the terminated portion of the applicable Subscription Term. This termination and refund right is Customer's sole and exclusive remedy, and Synap's sole and exclusive liability, for failure to meet the Target Availability. ### Additional * Synap's Trust Center : * Synap's Status Page: [^1]: [https://synap.ac/terms](https://intercom.com/legal/terms-and-policies) # Professional Services Agreement Standard terms applying when Synap provides consultancy, implementation, custom development, exam-day support or other professional services. This Professional Services Agreement applies where an Order Form identifies consultancy, implementation, custom development, exam-day support, strategic advice or other professional services (**Professional Services**). The Terms of Service and the applicable Order Form also apply. Capitalised terms not defined here have the meanings given in the Terms of Service. If there is a conflict, the Order Form prevails for the Professional Services it expressly covers, followed by this Professional Services Agreement and then the Terms of Service. ## 1. Scope The applicable Order Form will describe the Professional Services, fees and, where relevant, deliverables, estimated timetable, Customer dependencies and acceptance criteria. Synap is not required to provide work outside the agreed scope unless the parties agree a change under section 4. ## 2. Performance and cooperation Synap will perform the Professional Services with reasonable skill and care and in accordance with generally accepted industry standards. Synap may use suitably qualified employees and subcontractors and remains responsible for their performance as required by the Agreement. Customer will provide timely access, information, decisions, personnel, systems and other assistance reasonably required for the Professional Services. Customer is responsible for the accuracy and completeness of materials and instructions it supplies. Synap is not responsible for delay or non-performance to the extent caused by Customer or a third party under Customer's control. Any affected timetable will be extended reasonably, and Synap may charge reasonable additional fees where the delay causes additional work or cost, provided it notifies Customer in advance. Synap controls the manner and means by which the Professional Services are performed, subject to the agreed scope, timetable and any Customer security or access requirements identified in the Order Form. ## 3. Development and implementation services This section 3 applies to Professional Services involving implementation, configuration, integration, migration, custom development or other agreed deliverables. ### 3.1 Delivery and acceptance Where an Order Form includes deliverables or acceptance criteria, Customer will review each deliverable promptly after delivery. Unless the Order Form states another period, Customer has ten business days to either accept the deliverable or give Synap written notice identifying a material failure to meet the agreed acceptance criteria. A deliverable is accepted when Customer: * confirms acceptance in writing; * uses it in a live or production environment other than for agreed acceptance testing; or * does not give a valid rejection notice within the applicable review period. If Customer gives a valid rejection notice, Synap will use reasonable efforts to correct the identified non-conformity and resubmit the deliverable. The same review process will then apply to the corrected deliverable. A rejection does not affect Customer's obligation to accept and pay for any separable part of the deliverable that materially conforms to the agreed criteria. If an Order Form does not specify acceptance criteria, acceptance will be assessed against the material requirements expressly stated in that Order Form. 3.2 Changes A change to the scope, deliverables, assumptions, dependencies, timetable or fees must be agreed in a written change order signed or otherwise accepted electronically by authorised representatives of both parties (**Change Order**). For a minor change, Synap may agree that an email exchange between authorised representatives is sufficient. Synap is not required to begin a requested change until the parties have agreed its effect on scope, timing, fees and resources. Verbal discussions or instructions do not change the agreed scope unless confirmed in writing under this section. ## 4. Support and managed services Where an Order Form includes exam-day support, end-user support or other managed services, Synap will provide those services in accordance with the agreed scope and any documented instructions, scripts and escalation procedures supplied by Customer. Customer remains responsible for examination rules, candidate eligibility, accommodations, assessment decisions and other substantive decisions concerning End Users. When Synap receives an End User query outside its agreed authority, Synap may refer the End User to Customer, request instructions from Customer or facilitate contact between them. Customer must provide and maintain suitable escalation contacts. If Synap reasonably believes that an End User or another person may face an immediate and serious risk to their health or safety, and it is not practicable to obtain timely instructions from Customer, Customer authorises Synap to take reasonable, good-faith steps that Synap considers appropriate in the circumstances. These may include encouraging the person to contact local emergency services, contacting emergency services or an emergency contact on their behalf, and disclosing the minimum information reasonably necessary to obtain assistance. Synap does not provide medical advice and does not undertake to monitor End Users for medical or other emergencies or guarantee that an emergency will be identified or successfully resolved. Where practicable, Synap will record the action taken and notify Customer promptly afterwards. ## 5. Fees, expenses and third-party costs Customer will pay the fees and any approved expenses stated in the Order Form or Change Order. A quote for third-party services or disbursements is based on the supplier pricing available when the quote is issued. If an external supplier subsequently changes that pricing, Synap will notify Customer before incurring a material additional cost. The parties will then agree whether to approve the cost, adjust the scope or discontinue the affected item. Customer remains responsible for third-party commitments already approved and which cannot reasonably be cancelled. ## 6. Warranty and remedy Synap warrants that it will perform the Professional Services in accordance with section 2. If Customer reasonably believes Synap has breached this warranty, it must notify Synap with sufficient detail within thirty days after the affected Professional Services are performed or the relevant deliverable is accepted. Synap will, at its option, re-perform the non-conforming Professional Services or refund the fees paid for the non-conforming portion where re-performance is not reasonably practicable. To the fullest extent permitted by law, this is Customer's sole and exclusive remedy for breach of the warranty in this section. The warranty does not apply to a problem caused by Customer materials or instructions, a Customer or third-party modification, or use outside the agreed scope. Synap does not guarantee a particular commercial, regulatory, assessment or other outcome from the Professional Services. ## 7. Deliverables and intellectual property Customer retains ownership of Customer Data and materials it supplies. Customer grants Synap and its subcontractors a licence to use those materials only as reasonably necessary to provide the Professional Services and exercise Synap's rights under the Agreement. Synap and its licensors retain ownership of all software, models, tools, templates, methods, know-how and other materials developed or owned independently of the Professional Services, together with generic improvements and reusable components (**Background Materials**). Unless the Order Form expressly states otherwise, Synap owns the deliverables and all intellectual property rights in them. Subject to payment of the applicable fees, Synap grants Customer a non-exclusive, non-transferable and non-sublicensable licence to use the deliverables with the Services for Customer's permitted business purposes during its Subscription Term. A deliverable may include third-party materials subject to their applicable licence terms. Synap will identify any material third-party restriction of which it is aware and which materially affects Customer's intended use. ## 8. Liability and termination The limitations and exclusions of liability, confidentiality obligations, termination rights and other general provisions in the Terms of Service apply to the Professional Services. Termination does not affect fees for Professional Services already performed or approved third-party commitments that cannot reasonably be cancelled. # Cookie Policy This document outlines how Synap uses Cookies, and related technologies, across our web platforms This Cookie Policy explains how Synap Learning Limited ("**Company**", "**we**", "**us**", and "**our**") uses cookies and similar technologies to recognize you when you visit our Site at , or when you use our web-based Services (collectively "Websites"). It explains what these technologies are and why we use them, as well as your rights to control our use of them.\ In some cases we may use cookies to collect personal information, or that becomes personal information if we combine it with other information. \ **What are cookies?**\ Cookies are small data files that are placed on your computer or mobile device when you visit a website. Cookies are widely used by website owners in order to make their websites work, or to work more efficiently, as well as to provide reporting information.\ Cookies set by Us are referred to as "first party cookies". Cookies set by parties other than Us are referred to as "third party cookies". Third party cookies enable third party features or functionality to be provided on or through the website (e.g. like advertising, interactive content and analytics). The parties that set these third party cookies can recognize your computer both when it visits the website in question and also when it visits certain other websites. \ **Why do we use cookies?**\ We use first and third party cookies for several reasons. Some cookies are required for technical reasons in order for our Websites to operate, and we refer to these as "essential" or "strictly necessary" cookies. Other cookies also enable us to track and target the interests of our users to enhance the experience on our Online Properties. Third parties serve cookies through our Websites for advertising, analytics and other purposes. This is described in more detail below.\ The specific types of first and third party cookies served through our Websites and the purposes they perform are described below (please note that the specific cookies served may vary depending on the specific Synap Website or Service you visit, and whether you are an Admin or an End User of our Services): \ **How can I control cookies?**\ You have the right to decide whether to accept or reject cookies. You can exercise your cookie rights by setting your preferences in the Cookie Consent Manager. The Cookie Consent Manager allows you to select which categories of cookies you accept or reject. Essential cookies cannot be rejected as they are strictly necessary to provide you with services.\ The Cookie Consent Manager can be found in the notification banner and on our website. If you choose to reject cookies, you may still use our website though your access to some functionality and areas of our website may be restricted. You may also set or amend your web browser controls to accept or refuse cookies. As the means by which you can refuse cookies through your web browser controls vary from browser-to-browser, you should visit your browser's help menu for more information. \ In addition, most advertising networks offer you a way to opt out of targeted advertising. If you would like to find out more information, please visit or . The specific types of first and third party cookies served through our Websites and the purposes they perform are described in the table below (please note that the specific cookies served may vary depending on the specific Online Properties you visit):
**What cookies to you use?** **‍Necessary cookies** Necessary cookies allow us to offer you the best possible experience when accessing and navigating through our Websites and using their features. For example, these cookies help our infrastructure to load pages quicker, let us recognise that you have created an account and have logged into that account to access the content. Necessary cookies are usually first-party (set by Us), but there are some third-party cookies which we also deem as necessary, e.g. Segment and Intercom, which allows us to provide authenticated in-app chat support to our Admin Users or visitors to our Website. We do not place any non-essential cookies on our End Users devices. However, a Synap Customer may configure their Synap environment so that it does - e.g. a Synap Customer could install Intercom so that they can offer live chat support to their Students. This should be governed by its own Privacy Policy within the Customer's Synap environment. **Analytics cookies** We use analytics cookies to monitor usage of our Sites. This information helps us plan marketing campaigns, improve our site and develop new features. * Google Analytics * Google Tag Manager * Mixpanel * Fullstory **Advertising cookies** We use the following cookies to track information regarding the performance of our advertising campaigns, and for re-targeting purposes * Google Ads * Capterra \ **What about other tracking technologies, like web beacons?**\ Cookies are not the only way to recognize or track visitors to a website. We may use other, similar technologies from time to time, like web beacons (sometimes called "tracking pixels" or "clear gifs"). These are tiny graphics files that contain a unique identifier that enable us to recognize when someone has visited our Websites or opened an e-mail including them. This allows us, for example, to monitor the traffic patterns of users from one page within a website to another, to deliver or communicate with cookies, to understand whether you have come to the website from an online advertisement displayed on a third-party website, to improve site performance, and to measure the success of e-mail marketing campaigns. In many instances, these technologies are reliant on cookies to function properly, and so declining cookies will impair their functioning. \ **Do you serve targeted advertising?**\ Third parties may serve cookies on your computer or mobile device to serve advertising through our Site. These companies may use information about your visits to this and other websites in order to provide relevant advertisements about goods and services that you may be interested in. They may also employ technology that is used to measure the effectiveness of advertisements. This can be accomplished by them using cookies or web beacons to collect information about your visits to this and other sites in order to provide relevant advertisements about goods and services of potential interest to you. The information collected through this process does not enable us or them to identify your name, contact details or other details that directly identify you unless you choose to provide these. \ **How often will you update this Cookie Policy?**\ We may update this Cookie Policy from time to time in order to reflect, for example, changes to the cookies we use or for other operational, legal or regulatory reasons. Please therefore re-visit this Cookie Policy regularly to stay informed about our use of cookies and related technologies.\ The date at the top of this Cookie Policy indicates when it was last updated. # Security Policy ### Overview At Synap we take the protection of customer data extremely seriously. This Security Policy describes the organizational and technical measures we implements platform wide designed to prevent unauthorized access, use, alteration or disclosure of customer data. The Synap services operate on Amazon Web Services (“AWS”) infrastructure; this policy describes activities of Synap within its instance on AWS unless otherwise specified. As you continue to learn more about Synap we recommend you also review our [Terms of Service](/billing-and-payment-terms) and [Privacy Policy](/privacy-policy) Data processing activities by Synap are undertaken as part of specific requests from our clients - i.e. to provide technical support to users, or if we receive explicit instructions from a client to process data on their behalf (i.e. reporting/data analysis). Data collected includes users’ name and email address, so that the client can attribute actions taken on the platform to a particular user, and get in touch with them if necessary. No special category data is collected. ### Core Technical Infrastructure Synap Customer Data is hosted in the EU (Ireland) or in the US, according to the customer's assigned region. Data for EU-hosted customers stays in the EU. Data for US-hosted customers stays in the US. We do not copy Customer Data between those regions. Our database is provided by MongoDB Atlas in the same region as that stack Our databases are backed up every day and kept for 7 days before being deleted. All data - including backups - are encrypted in transit and at rest (HTTPS/AES-256). Card payments are processed by the client’s own payment processing gateway (e.g. Stripe/Paypal) ### Operational Security & Access to Data Only Synap employees have access to our data, and we will only access identifiable client data upon written request / authorisation from the client, or to fulfill an obligation outlined in our contract with the client. Our offices are controlled by keycard access to all floors and key access to individual offices. Only select, senior Synap employees have access to admin accounts on AWS, Database hosting and our internal dashboards. We have individual user accounts set up for all team members which provide them with the minimum access they need in order to perform daily tasks (configured with AWS Identity & Access Management controls). All company devices are locked with a password, and where available, multi-factor factor authentication. We hold ISO27001 certification, details of which are available on request. Secure configuration Our AWS account is configured so that minor or security-critical updates to software are installed automatically. Larger updates with the potential to introduce breaking changes are implemented as soon as possible, pending manual review & testing. We run the servers as immutable deployments and they are only configured to use necessary tools. Multi factor authentication is required for all critical accounts (i.e. those which store data and/or considered critical to operations). HTTPS/SSL is enforced over all connections, and data is encrypted with AES at rest. We have DDoS protection provided by AWS Shield Network security We have set up security policies in AWS which block connections from certain ports, and where appropriate, to only accept connections from certain IP addresses. AWS security check is run weekly which produces a report on potential threats & solutions to them. User education and awareness We provide security training to our staff when they join the organisation, with refreshers throughout the year. Our goal here is to ensure that all staff understand the basics of data security, what is expected/required of them, and how to take sensible steps to reduce the risk of a data/security breach. ### Incident management We have real-time monitoring set up which alerts our engineers as soon as one of our servers is unreachable or otherwise experiencing degraded performance . Secure database backups are taken daily, as well as prior to any major changes. Malware prevention Company devices have anti-malware / anti-virus software installed, and our office network also has protection built into the routers. Monitoring We have real time monitoring set up with Pingdom that measures traffic / impact on services. We also have weekly security routines configured with AWS which look for potential attack vectors / suspicious traffic. Removable media controls We do not use removable media devices. We have a policy in place to securely delete any local files containing user data as soon as they are done with. Home and mobile working Only Synap directors work on anything related to user data / servers etc from home. This takes place on devices with strong passwords, on a secure wifi network with hardware firewalls. Again, all accounts are also locked behind multi factor authentication. ### Cybersecurity Audit & Penetration Testing Synap holds and maintains ISO27001 certification, details of which can be requested from our [Trust Center](https://trust.synap.ac/) Synap is a registered data controller with the UK Information Commissioners Office (ICO), under the UK Data Protection Act 2018. Synap conducts regular internal penetration tests against the OWASP Top 10 criteria, as well as monthly external penetration tests against OWASP Top 10 and a wide variety of other attack vectors. The external penetration tests are conducted by a CREST certified platformthat checks against over 17,000 known attack vectors. We are committed to resolving any Critical, High or Medium severity issues flagged by penetration testing as soon as possible, usually within days of discovery. We aim to resolve Low priority issues within 1-2 months. ### Further Information More information available on request - please contact James Gupta (Director, Synap) at # Data Breach Management Policy This Synap Data Breach Management Policy accompanies the Synap Subscription Terms of Service, available at [https://synap.ac/terms](https://intercom.com/legal/terms-and-policies) or a successor URL (the "Agreement") entered into between you ("Customer") and Synap. ### Overview Synap is commited to ensuring that all data we process - on behalf of our customers and their end users - is managed appropriately, in accordance with industry best practices, and in compliance with the General Data Protection Regulation (GDPR), the Data Protection Act 2018 (DPA 2018) (collectively referred to as "Data Protection Legislation"). Every care is taken to protect personal data and to avoid a breach of such data. This policy outlines the measures Synap takes in response to an incident where data has been processed or disclosed in an unauthorised manner, or where there has been accidental loss, destruction or damage to personal data. Synap employees are made aware of this document and receive training on how to handle personal data and ensure that they are doing so in a way that maintains a high level of security. ### Scope This document outlines the measures Synap will take in response to a breach of Customer Data - where Customer Data means, any data belonging to a Synap Customer or their End Users. For the avoidance of doubt, this definition includes both 'content' that our Customers create and store on Synap (such as test questions and other e-learning material), and personal data, such as names and email addresses. Unless otherwise specified, the phrase 'data' or 'customer data' refers to both content data and personal data. This document outlines Synap's approach to data breaches - it is not a comprehensive overview of the security measures we have in place to prevent breaches in the first place. Please refer to our Security Policy for more information about these measures. #### Detecting & Reporting Incidents and Breaches All Customer Data processed by Synap is encrypted, both in-transit and at-rest, and is stored on Amazon Web Services (AWS) infrastructure, with several layers of security to prevent and detect unauthorised access. For a more detailed overview of these measures, please refer to our Security Policy. Customer Data is only handled by authorised Synap Representatives, who are directly involved in a particular customer's account. Synap Representatives who are handling Customer Data receive training on how to do so securely, and how to identify and respond to potential data breaches. In the event of a suspected - or 'near miss' breach - whether reported via automated tools, or by a Synap Representative, or by a Synap Customer - Synap will launch a priority investigation to confirm or exclude the breach. A senior manager from Synap - and a representative from the Customer's organisation should be informed as soon as possible. If the breach is or suspected to be 'in progress', then a senior engineer from Synap should be contacted immediately with a view to closing the source of the breach as soon as possible. An initial assessment of the suspected breach should be performed and communicated with the Customer. This assessment should include the following information: * Summary of the suspected incident - when did it happen, what is the suspected nature of the breach (accidental loss, malicious intent etc), and what data was involved. * To what extent can we confirm whether the breach did occur? If we cannot confirm it, what further investigations are necessary? * Is the breach still occurring, and if so what immediate steps are needed to stop it? * The nature of the data in question - e.g. is it personally identifiable data, e-learning material. If data is personally identifiable, then who are the people who have been affected, and what are the potential harms? * If the breach is an accidental loss, what are the recovery options? (time of latest backup etc) * If the breach is malicious, is it possible or likely that an unauthorised individual now has access to unencrypted Customer Data? What are the potential implications of this and how can they be minimised * Is there an obligation to report the breach to the UK Information Commissioner's Office (ICO)? #### Step 1: Containment and Recovery 1. The Data Protection Manager will ascertain the severity of the breach, whether any personal data is involved and whether the breach is still occurring. 2. If the breach is still occurring, the Data Protection Manager will establish what steps need to be taken immediately to minimise the effect of the breach and contain the breach from further data loss (e.g. restricting access to systems, closing down a system, encryption key rotation). 3. The Data Protection Manager will consider and implement appropriate steps required to recover any data loss where possible and limit damage caused (e.g. use of backups to restore data; changing passwords etc.) 4. The Data Protection Manager will consult with a Synap Director to determine if the severity and likely impact of the breach deems it necessary to inform the ICO. At the same time, depending on the nature of the breach, the Data Protection Manager may seek expert or legal advice and/or the Police if it is believed that illegal activity has occurred or likely to occur. 5. Where a significant breach has occurred, and Synap is acting as a data controller, the Data Protection Officer will inform the ICO within 72 hours of the discovery of the breach. Where Synap is acting as a data processor on behalf of a customer, Synap will instead notify the customer (as the data controller) without undue delay, and provide them with the necessary information to assess and fulfil any legal obligations to notify the ICO or affected data subjects. 1. For the avoidance of doubt, Synap will not notify any third party, including the ICO, in relation to a breach of customer-controlled personal data without prior written instruction from the customer, unless required to do so by applicable law. 6. The decision taken as to the reasons why a data breach is either reported or not reported is documented by the Data Protection Manager. 7. All the key actions and decisions are fully documented and logged in our Incident Management Log. #### Assessment of Risk Further actions may be needed beyond immediate containment of the data breach. A further assessment of the risks associated with the breach should be undertaken to identify whether any potential adverse consequences for individuals are likely to occur and the seriousness of these consequences. The Data Protection Manager will consider the points arising from the following questions: 1. What type and volume of data is involved? 2. How sensitive is the data? Could the data breach lead to distress, financial or even physical harm? 3. What events have led to the data breach? What has happened to the data? 4. Has the data been unofficially disclosed, lost or stolen? Were preventions in place to prevent access/misuse? (e.g. encryption) 5. How many individuals are affected by the data breach? 6. Who are the individuals whose data has been compromised? 7. What could the data tell a third party about the individual? Could it be misused regardless of what has happened to the data? 8. What actual/potential harm could come to those individuals? E.g. physical safety; emotional wellbeing; reputation; finances; identity theft; one or more of these and other private aspects to their life 9. Are there wider consequences to consider? 10. Are there others that might advise on risks/courses of action? #### Step 3: Evaluation and Response When the response to a data breach has reached a conclusion, the Data Protection Manager will undertake a full review of both the causes of the breach and the effectiveness of the response. If through the review, systematic or ongoing problems associated with weaknesses in internal processes or security measures have been identified as a cause of the data breach, then appropriate action plans will be drafted, actioned and monitored to rectify any issues and implement recommendations for improvements. #### Implementation of these Procedures The Data Protection Manager will ensure that staff are aware of these procedures for reporting and managing data breaches. Data Protection training for all staff is mandatory, including new employees and all staff will undertake refresher training annually. If staff have any queries or questions relating to these procedures, they should discuss this with the Data Protection Manager. # Subprocessors List & Management Policy LAST UPDATED: 29th September 2026 This page forms part of Synap's [Data Processing Agreement](https://legal.synap.ac/data-processing-agreement-dpa) (**"DPA"**). It identifies third parties that Synap may use to process **Customer Data** on behalf of a Customer and explains how Synap appoints and manages them. Terms defined in the DPA have the same meanings here. ## Sub-processor categories * **Core:** required to provide the Synap platform or standard service communications. * **Operational Support:** used for routine support, incident response, security work or defect investigation and may receive limited Customer Data where necessary. * **Optional Feature:** used only when Customer or an Authorised User enables, requests or configures the relevant feature. * **Customer-Approved Support:** used only for enhanced or ad-hoc support requested or approved by Customer. * **Account Data Service Providers:** used for Synap's own sales, billing, account management, analytics or administration. These providers are not Sub-processors under the DPA unless they process Customer Data on Customer's behalf. The authorisation and change-notification rules for each category are set out in Section 7 of the DPA. ## Locations, data residency and transfer safeguards Locations shown below identify the principal hosting or processing location. A regional hosting selection does not exclude limited ancillary processing elsewhere, including support access, security monitoring, service metadata or transactional email. The principal AWS and MongoDB workloads are hosted in Ireland for Synap's EU stack and in the United States for its US stack. Backups may be stored or processed in a different availability zone or region for resilience and disaster recovery, but remain within the same selected data-residency boundary (European Union or United States). Restricted Transfers are governed by Section 13 of the DPA. **DPF** links record a provider's published participation in the applicable Data Privacy Framework. Current status may be checked on the provider's linked statement or the [official US Department of Commerce list](https://www.dataprivacyframework.gov/list). Where the DPF is unavailable or inapplicable, Synap relies on the SCCs, UK Addendum or another lawful Transfer Mechanism. ## Appointment and review procedure Before appointing a Sub-processor, Synap assesses the provider in proportion to the nature and risk of the processing, including: 1. the processing purpose and categories, sensitivity and volume of Customer Data; 2. legal identity, relevant locations, retention and deletion arrangements; 3. technical and organisational security measures and independent assurance; 4. Restricted Transfer and onward-transfer safeguards; 5. use of further Sub-processors; and 6. incident response, service continuity and exit arrangements. Sub-processors must be bound by written data-protection and confidentiality obligations consistent with the DPA and applicable law. Synap reviews its Sub-processors at least annually and following material risk, service or legal developments. ## Core Sub-processors | Provider | Purpose and Customer Data | Principal location / regional behaviour | Transfer safeguards and information | | --------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Amazon Web Services (AWS)** — relevant AWS contracting entity | Cloud infrastructure, storage, networking and security services supporting the Synap platform; Customer Data stored in the Customer's assigned stack | EU stack: EU (Ireland). US stack: United States. Regional storage does not exclude limited global support or service metadata processing described in AWS terms | [AWS DPA](https://d1.awsstatic.com/legal/aws-gdpr/AWS_GDPR_DPA.pdf); [AWS DPF statement](https://aws.amazon.com/compliance/eu-us-data-privacy-framework/) (AWS is covered under Amazon.com, Inc.'s certification); SCCs or other DPA mechanism where required | | **MongoDB** — relevant MongoDB contracting entity | Managed database services containing platform account, assessment and results data supplied through the Services | Primary database processing is in the same region as the Customer's Synap stack: EU or US. Backups may use a different availability zone or region for resilience and disaster recovery, while remaining within the same selected legal hosting jurisdiction | [MongoDB DPA](https://www.mongodb.com/legal/data-processing-agreement); [MongoDB DPF statement](https://www.mongodb.com/legal/data-privacy-framework-statement); SCCs or other DPA mechanism where required | | **Twilio / SendGrid** — relevant Twilio contracting entity | Delivery of transactional service emails, including recipient address, message content and delivery metadata | United States and other locations described by Twilio; this service is not part of Synap's primary EU/US data-residency boundary | [Twilio DPA](https://www.twilio.com/en-us/legal/data-protection-addendum); [Twilio DPF information](https://www.twilio.com/en-us/legal/privacy); SCCs/BCRs or other DPA mechanism where required | | **Datadog** — relevant Datadog contracting entity | Service telemetry, logs, performance and security monitoring. Synap seeks to minimise Customer content and sensitive data in logs | Current Synap service processing is in the United States; provider personnel and sub-processors may operate in other disclosed locations | [Datadog DPA](https://www.datadoghq.com/legal/data-processing-addendum/); [Datadog privacy and DPF information](https://www.datadoghq.com/legal/privacy/); SCCs or other DPA mechanism where required | ## Operational Support Sub-processors These providers may receive limited Customer Data where necessary for support, security, incident response or defect investigation. Data is limited where practicable to pseudonymous identifiers, technical metadata, logs, support communications and relevant bug-report extracts. Exam content or responses, proctoring recordings, identity documents, biometric data, authentication credentials and special-category data must not be included unless specifically necessary, risk-assessed and handled through an approved process. | Provider | Operational purpose and Customer Data | Principal location / regional behaviour | Transfer safeguards and information | | ----------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Slack** — relevant Slack Technologies / Salesforce contracting entity | Internal support, incident, security and engineering communications. May contain pseudonymous Customer or user identifiers, technical metadata, limited logs and support extracts | United States and other locations described by Slack. Certain data-residency options may apply to data at rest but do not necessarily cover all metadata, support or ancillary processing | [Slack DPA](https://slack.com/terms-of-service/data-processing); [Slack GDPR, SCC and DPF information](https://slack.com/trust/compliance/gdpr); SCCs or other DPA mechanism where required | | **GitHub, Inc.** | Private source-code hosting, issue management, security work and software delivery. Issues or private repositories may contain limited pseudonymous identifiers, technical metadata or bug-report extracts necessary to reproduce and resolve a defect | United States and other locations described by GitHub; product-specific data-location options apply only where selected and documented | [GitHub Data Protection Agreement](https://github.com/customer-terms/github-data-protection-agreement); [GitHub privacy and DPF information](https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement); SCCs or other DPA mechanism where required | | **Shortcut Software Company** | Engineering project and defect management. Tickets may contain limited pseudonymous Customer or user identifiers, technical metadata, logs and bug-report extracts | United States | [Shortcut GDPR and DPF notice](https://www.shortcut.com/gdpr-privacy/); [Shortcut security information](https://www.shortcut.com/security/); SCCs or other DPA mechanism where required | ## Optional Feature Sub-processors These providers receive Customer Data only if the relevant feature is affirmatively enabled, requested or configured. | Provider | Optional feature and Customer Data | Principal location / regional behaviour | Transfer safeguards and information | | ----------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Rosalyn Inc.** | Live and AI-assisted proctoring; candidate identity, exam-session, video/audio and proctoring data as configured | United States | [Rosalyn Trust Center and privacy information](https://www.rosalyn.ai/trust-center); contractual safeguards and SCCs or other DPA mechanism where required | | **RunPod** | AI Review inference on Synoptic webcam recordings and associated technical data | EU for EU-hosted Customers; US for US-hosted Customers. EU-hosted footage remains in the EU during inference under Synap's current configuration | [RunPod DPA](https://www.runpod.io/legal/data-processing-agreement); [RunPod Trust Center](https://trust.runpod.io/); SCCs or other DPA mechanism where required | | **Stripe** — relevant Stripe contracting entity | Stripe Identity candidate identity verification, including identity-document images and fields, selfie/video, liveness and verification outputs. Synap may retain images and results according to the configured workflow and retention settings | Processing locations depend on the Stripe service and terms; the feature is not represented as EU-only | [Stripe DPA](https://stripe.com/legal/dpa); [Stripe DPF policy](https://stripe.com/legal/data-privacy-framework); SCCs or other DPA mechanism where required | | **Entrust (Onfido)** — relevant Entrust/Onfido contracting entity | Candidate identity and document verification, including identity-document images and fields, selfie/video, facial-similarity, liveness and verification or fraud outputs. Synap may retain images and results according to the configured workflow and retention settings | EU or US according to the configured regional endpoint; regional selection and ancillary processing remain subject to the applicable Entrust terms | [Entrust Identity Verification Services Agreement](https://www.entrust.com/legal-compliance/terms-conditions/idv/services-agreement); [Entrust product privacy information](https://www.entrust.com/legal-compliance/product-privacy); SCCs or another lawful Transfer Mechanism where required | ## Customer-Approved Support Sub-processors These providers receive only the Customer Data reasonably necessary for an enhanced exam-support, supervision or troubleshooting activity requested or approved by Customer. | Provider | Purpose and data | Principal location / regional behaviour | Transfer safeguards and information | | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | **Intercom** | Customer-approved communications and support case management; only the Customer Data needed for the case | United States / provider's disclosed locations | [Intercom DPA](https://www.intercom.com/legal/dpa); [Intercom DPF notice](https://www.intercom.com/legal/data-privacy-framework-notice); SCCs or other DPA mechanism where required | | **Twilio Segment** | Customer-approved diagnostic data routing and synchronisation for a support activity | EU data centre where configured; limited processing may occur in the United States or other disclosed locations | [Twilio DPA](https://www.twilio.com/en-us/legal/data-protection-addendum); [Twilio DPF information](https://www.twilio.com/en-us/legal/privacy); SCCs/BCRs or other DPA mechanism where required | | **FullStory** | Customer-approved session capture or replay used to diagnose an issue involving an Authorised User; configured to minimise captured content | United States / provider's disclosed locations | [FullStory DPA](https://www.fullstory.com/legal/dpa/); [FullStory DPF information](https://www.fullstory.com/legal/privacy-policy/); SCCs or other DPA mechanism where required | Customer may specifically approve another provider for a particular support activity after receiving the relevant processing information. ## Account Data Service Providers These providers process Account Data for Synap's business and administrative purposes. Synap acts as Controller for that processing. If a provider processes Customer Data on Customer's behalf, it will instead be treated as a Sub-processor for that processing. | Provider | Ordinary business purpose | Location / privacy information | | ------------------ | -------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Intercom** | Account communications, customer success and ordinary support | US / global; [DPA](https://www.intercom.com/legal/dpa), [DPF notice](https://www.intercom.com/legal/data-privacy-framework-notice) | | **Vitally** | Customer-success management, onboarding and training administration | United States; [privacy information](https://vitally.io/legal/privacy) | | **Attio** | Customer-relationship management and account administration | United States; [DPA](https://attio.com/legal/attio-data-processing-addendum), [privacy information](https://attio.com/legal/privacy) | | **Twilio Segment** | Routing and synchronisation of Account Data between Synap's business systems | EU data centre where configured, with other disclosed processing; [Twilio DPA](https://www.twilio.com/en-us/legal/data-protection-addendum), [DPF information](https://www.twilio.com/en-us/legal/privacy) | | **Calendly** | Meeting scheduling for sales, training, support and account management | United States / global; [Calendly privacy and DPF notice](https://calendly.com/legal/privacy-notice) | | **Stripe** | Payment processing for Synap Customers | Global; [Stripe DPA](https://stripe.com/legal/dpa), [DPF policy](https://stripe.com/legal/data-privacy-framework) | | **GoCardless** | Direct Debit payment processing | United Kingdom / provider's disclosed locations; [privacy information](https://gocardless.com/privacy/) | | **Chargebee** | Subscription management, invoicing and receipts | United States / global; [privacy and DPF information](https://www.chargebee.com/privacy/) | | **Mixpanel** | Product analytics concerning logged-in Authorised Users | US by default or EU where configured; [Mixpanel DPA and DPF information](https://mixpanel.com/legal/dpa/) | | **FullStory** | Session analytics concerning Authorised Users and diagnosis of common interface issues | United States / provider's disclosed locations; [DPA](https://www.fullstory.com/legal/dpa/), [DPF information](https://www.fullstory.com/legal/privacy-policy/) | ## Affiliates Synap currently has no Affiliates that process Customer Data. Any future Affiliate acting as a Sub-processor will be listed here and appointed under Section 7 of the DPA. # Data Processing Agreement (DPA) LAST UPDATED: 29th September 2026 This Data Processing Addendum, including its schedules and the Standard Contractual Clauses ("DPA"), is made by and between Synap Learning Limited, a private limited company registered in England & Wales ("Synap"), and the customer identified in the applicable Agreement ("Customer"), pursuant to Synap's Terms of Service and/or another written or electronic agreement between the parties ("Agreement"). This DPA forms part of the Agreement and governs Synap's processing of Personal Data under the Agreement. ### **1. Definitions.** Any capitalized term used but not defined in this DPA has the meaning provided in the Agreement. i. **"Account Data"** means Personal Data relating to Customer's commercial and administrative relationship with Synap, including the names and business contact details of Customer personnel and Authorised Users, account administration and authentication information, billing information, support communications, and security and service-usage records. Account Data does not include Customer Data merely because the same individual appears in both datasets. ii. **"Affiliate"** means any entity that controls, is controlled by, or is under common control with an entity, where "control" means ownership of, or the right to control, more than 50% of the voting securities of that entity. iii. **"Applicable Data Protection Legislation"** means the privacy and data-protection laws applicable to the relevant processing under the Agreement, including, where applicable, the GDPR, UK GDPR and Data Protection Act 2018, Swiss Federal Act on Data Protection, California Consumer Privacy Act, Australian Privacy Act 1988, Thailand Personal Data Protection Act and South Africa's Protection of Personal Information Act, in each case as amended, superseded or replaced. iv. **"Authorised User"** means a person Customer authorises to access or administer the Services. v. **"Controller"** means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of processing Personal Data. vi. **"Customer Data"** means Personal Data processed by Synap as a Processor on behalf of Customer in connection with the Services. vii. **"End User"** means an individual who accesses or uses the Services under Customer's account, including a candidate, learner, employee, marker, proctor, educator, manager or sub-administrator. viii. **"Data Privacy Framework"** or **"DPF"** means, as applicable to a particular transfer, the EU–US Data Privacy Framework, the UK Extension to the EU–US Data Privacy Framework or the Swiss–US Data Privacy Framework administered by the United States Department of Commerce, in each case as amended, replaced or superseded. ix. **"Europe"** means the European Economic Area ("EEA"), United Kingdom ("UK") and Switzerland. x. **"GDPR"** means Regulation (EU) 2016/679. xi. **"Personal Data"** means any information relating to an identified or identifiable natural person, or any equivalent concept defined by Applicable Data Protection Legislation. xii. **"Personal Data Breach"** means a breach of security leading to the accidental or unlawful destruction, loss, alteration or unauthorised disclosure of, or access to, Customer Data. It excludes an unsuccessful attempt that does not compromise Customer Data. xiii. **"Privacy Policy"** means Synap's then-current privacy policy for the Services, available at . xiv. **"Processor"** means an entity which processes Personal Data on behalf of a Controller. xv. **"Processing"**, **"Process"** and **"processed"** have the meanings given to them by Applicable Data Protection Legislation. xvi. **"Restricted Transfer"** means a transfer of Personal Data for which Applicable Data Protection Legislation requires an adequacy decision, appropriate safeguards or another lawful Transfer Mechanism. xvii. **"Standard Contractual Clauses"** or **"SCCs"** means: (a) for the GDPR, the standard contractual clauses in the Annex to European Commission Implementing Decision (EU) 2021/914 ("EU SCCs"); (b) for the UK GDPR, the EU SCCs together with the International Data Transfer Addendum issued by the Information Commissioner's Office under section 119A of the Data Protection Act 2018 ("UK Addendum"); and (c) for the Swiss Federal Act on Data Protection, the EU SCCs as recognised and adapted for Switzerland, in each case as updated, amended or replaced. xviii. **"Sub-processor"** means a third-party Processor engaged by Synap or a Synap Affiliate to process Customer Data in connection with the Services. It excludes Synap personnel acting under Synap's authority. xix. **"Third Party Request"** means a request, correspondence, inquiry or complaint from a data subject, regulatory authority or other third party. xx. **"Transfer Mechanism"** means an adequacy decision or regulation, an applicable DPF, the SCCs, approved binding corporate rules, or another mechanism lawfully permitting a Restricted Transfer under Applicable Data Protection Legislation. ### **2. Applicability and Scope.** i. Applicability. This DPA applies to Synap's processing of Customer Data on behalf of Customer and, where expressly stated, to Account Data for which Synap acts as an independent Controller. ii. Scope. The subject matter of the data processing is the provision of the Services, and the processing will be carried out for the duration of the Agreement. Schedule 1 (Details of Processing) sets out the nature and purpose of the processing, the types of Personal Data Synap processes and the categories of data subjects whose Personal Data is processed. iii. Synap as a Processor. The parties acknowledge and agree that regarding the processing of Customer Data, Customer may act either as a controller or processor and Synap is a processor. Synap will process Customer Data in accordance with Customer’s instructions as set forth in Section 3 (Customer Instructions). iv. Synap as a Controller of Account Data. The parties acknowledge that, regarding the processing of Account Data, Customer is a controller and Synap is an independent controller, not a joint controller with Customer. Synap will process Account Data as a controller to: (a) manage the commercial and administrative relationship with Customer; (b) operate, support and improve the Services; (c) authenticate Authorised Users and detect, prevent or investigate security incidents, fraud and misuse; (d) comply with Synap's legal or regulatory obligations; and (e) otherwise act as described in the Privacy Policy and permitted by Applicable Data Protection Legislation. ### **3. Synap as a Processor – Processing Customer Data.** **i. Customer Instructions.** Customer appoints Synap to process Customer Data only on Customer's documented instructions: (a) as set out in the Agreement and this DPA and as necessary to provide, secure and support the Services; (b) as otherwise agreed in writing; and (c) through Customer's and its Authorised Users' use and configuration of the Services (the **"Permitted Purposes"**). These instructions include applicable international transfers. If applicable law requires other processing, Synap will inform Customer before processing unless legally prohibited from doing so. **ii. Lawfulness of Instructions.** Customer will ensure that its instructions and use of the Services comply with applicable law and do not cause Synap to breach Applicable Data Protection Legislation. Synap will inform Customer if it reasonably believes an instruction infringes applicable law. **iii. Additional Instructions.** Instructions outside the Agreement or this DPA must be agreed in writing, including by email or another agreed electronic channel. **iv. Minors.** Where Customer uses the Services for individuals who are minors under applicable law, Customer will comply with applicable requirements concerning data protection, biometric data and parental or guardian rights. ### **4. Purpose Limitation.** Synap will process Customer Data only for the Permitted Purposes and as described in Schedule 1. ### **5. Compliance.** Customer shall be responsible for ensuring that: a) all such notices have been given, and all such authorizations have been obtained, as required under Applicable Data Protection Legislation, for Synap (and its Affiliates and Sub-processors) to process Customer Data as contemplated by the Agreement and this DPA; b) it has complied, and will continue to comply, with all applicable laws relating to privacy and data protection, including Applicable Data Protection Legislation; and c) it has, and will continue to have, the right to transfer, or provide access to, Customer Data to Synap for processing in accordance with the terms of the Agreement and this DPA. ### **6. Confidentiality.** Synap will ensure that persons authorised to process Customer Data are subject to contractual or statutory confidentiality obligations and process it only as authorised. ### **7. Sub-processors.** #### i. Sub-processor register and authorisation The [Subprocessors List & Management Policy](https://legal.synap.ac/subprocessors-list-and-management-policy) (the **"Sub-processor Page"**) is incorporated into this DPA by reference. It identifies Synap's Sub-processors, their category, processing purpose, relevant locations and safeguards. Customer gives Synap general written authorisation to engage the Core and Operational Support Sub-processors listed on the Sub-processor Page as at the effective date of the Agreement, and to add or replace them in accordance with paragraph iii. A Customer request or approval for an activity using a Customer-Approved Support Sub-processor constitutes a documented instruction to use that provider for the activity. Providers that process only Account Data for Synap's own business and administrative purposes are not Sub-processors under this DPA. If such a provider processes Customer Data on Customer's behalf, it will be treated as a Sub-processor for that processing. #### ii. Optional Feature Sub-processors An **"Optional Feature Sub-processor"** is used only where Customer or an Authorised User affirmatively enables, requests or configures the relevant optional feature. Synap will make available the provider's identity, processing purpose, principal categories of Customer Data, relevant processing locations and applicable transfer safeguards before or when the feature is enabled. Customer's affirmative enablement, request or configuration of the feature constitutes specific written authorisation, given electronically, for Synap to engage the identified Optional Feature Sub-processor. Synap is not required to notify Customers that have not enabled the feature when an Optional Feature Sub-processor is added to the Sub-processor Page. Where Customer has already enabled an optional feature, Synap will obtain specific authorisation for a replacement or additional provider, or follow paragraph iii, before that provider processes Customer Data. #### iii. Contractual safeguards, notice and objection a. Synap will bind each Sub-processor by written obligations providing at least the level of data protection required of Synap under this DPA, to the extent applicable to the services performed. Synap remains responsible for its Sub-processors as required by Applicable Data Protection Legislation. b. Except where paragraph ii permits specific authorisation, Synap will give Customer at least thirty (30) calendar days' prior notice before a new or replacement Sub-processor begins processing Customer Data. Notice will be sent to the Account Owner email address recorded in Customer's Synap portal. If an immediate change is reasonably necessary to address a security incident, legal or regulatory requirement, or provider service discontinuation, Synap will give as much advance notice as reasonably practicable and explain the shorter period. c. Customer may object during the applicable notice period on reasonable grounds relating to the protection of Customer Data. The parties will work in good faith to address the objection, including by considering a commercially reasonable alternative. If no reasonable resolution is available, Customer may stop using the affected feature or terminate the affected Services without an early-termination charge before the new Sub-processor begins processing Customer Data. ### **8. Impact Assessments and Consultations.** Synap shall, to the extent required by Applicable Data Protection Legislation, provide Customer with reasonable assistance (at Customer's cost and expense) with data protection impact assessments or prior consultations with data protection authorities that Customer is required to carry out under such legislation. ### **9. Security.** i. Synap has in place and will maintain throughout the term of this Agreement appropriate technical and organizational measures designed to protect Customer Data against Personal Data Breaches. ii. These measures shall at a minimum comply with applicable law and include the measures identified in Schedule 2 (Technical and Organizational Security Measures). iii. Synap may update the security measures to reflect technical and operational developments, provided that the overall security of the Services is not materially reduced. iv. Upon becoming aware of a Personal Data Breach involving Customer Data processed by Synap on behalf of Customer under this DPA, Synap will notify Customer without undue delay. To the extent known and reasonably available, the notification will describe the nature of the breach, the categories and approximate numbers of affected data subjects and records, the likely consequences, the measures taken or proposed to address and mitigate it, and a contact point for further information. Synap may provide this information in phases without undue further delay as its investigation progresses and will provide reasonable cooperation to enable Customer to meet its notification obligations under Applicable Data Protection Legislation. v. Synap's notification of or response to a Personal Data Breach shall not be construed as an acknowledgement by Synap of any fault or liability with respect to the Personal Data Breach. vi. Customer is responsible for: (a) configuring and using the Services in a manner appropriate to the risks associated with Customer Data; (b) securing the authentication credentials, systems and devices it uses to access the Services; and (c) maintaining copies of Customer Data that the Services make available for export where Customer's own continuity or record-retention requirements require such copies. This paragraph does not reduce Synap's security, availability, backup, return or deletion obligations under the Agreement or this DPA. ### **10. Return or Deletion of Customer Data.** During the term, Customer may use the available Service functionality to export or delete Customer Data. On termination or expiry of the Agreement, Synap will, at Customer's election, return or delete Customer Data in its possession or control without undue delay and no later than thirty (30) days after termination or expiry, unless applicable law requires retention. Deletion from active systems will be completed within that period. Residual copies in encrypted backups will be placed beyond ordinary use, protected from further processing and overwritten in accordance with Synap's documented backup-rotation schedule, ordinarily within ninety (90) days, unless applicable law requires longer retention. If Synap retains Customer Data because the law requires it, Synap will isolate and protect that data and process it only for the legally required purpose. ### **11. Audits.** i. Synap will make available to Customer the information reasonably necessary to demonstrate compliance with this DPA and the obligations applicable to processors under Applicable Data Protection Legislation. Synap may satisfy this obligation in the first instance through current independent audit reports, certifications, security documentation and responses to reasonable due-diligence questions. ii. Where that information is not reasonably sufficient, Customer may conduct an audit itself or through an independent auditor bound by confidentiality. Customer must give reasonable advance notice, conduct the audit during normal UK business hours, limit it to systems and records relevant to Customer Data, and avoid unnecessary disruption or access to another customer's data. Ordinarily, Customer may exercise this audit right once in any twelve-month period. iii. The frequency limit in paragraph ii does not apply where an audit is reasonably required following a Personal Data Breach affecting Customer Data, a reasonable and documented concern that Synap is materially failing to comply with this DPA, or a request or instruction from a competent supervisory authority. iv. Customer will bear its own audit costs and Synap's reasonable costs of providing assistance beyond the information described in paragraph i. Synap will bear its own reasonable costs where an audit identifies material non-compliance by Synap. Nothing in this Section limits a competent supervisory authority's powers. ### **12. International Transfers and Data Residency.** **i. Hosting region.** The hosting region agreed with Customer is the primary location of Customer's application database and stored files. Synap will not move them to a different hosting region without Customer's agreement. Limited processing elsewhere may occur for support, security, communications or other ancillary services, or through a Sub-processor listed on the Sub-processor Page, subject to this DPA and an applicable Transfer Mechanism. **ii. Transparency.** The Sub-processor Page identifies relevant processing locations and optional services. Customer is responsible for selecting a hosting region and configuration appropriate to its requirements. **iii. Order of Transfer Mechanisms.** Where more than one Transfer Mechanism is available for a Restricted Transfer, the following order applies: a. an applicable adequacy decision or regulation, including an applicable DPF; b. the applicable SCCs, including the UK Addendum or Swiss adaptations; c. approved binding corporate rules or another recognised Transfer Mechanism; and d. where legally available and appropriate, a statutory exception or derogation. Synap may maintain an additional Transfer Mechanism as a fallback. If the primary mechanism ceases to be valid or applicable, Synap will apply the next available mechanism before continuing the affected Restricted Transfer. **iv. Data Privacy Framework.** Synap may rely on an applicable DPF for a transfer to a United States recipient while the recipient's active certification covers the relevant framework and data. Synap will periodically verify certification status and use another valid Transfer Mechanism if the DPF is unavailable or inapplicable. **v. EU SCCs.** Where a Restricted Transfer governed by the GDPR is not covered by an applicable adequacy decision or DPF, the EU SCCs are incorporated into this DPA and completed as follows: a. Module One applies where Customer transfers Account Data to Synap and each party acts as an independent Controller for that data. b. Module Two applies where Customer is a Controller and Synap is a Processor. c. Module Three applies where Customer is a Processor and Synap is a Sub-processor. d. Clause 7 applies; in Clause 9, Option 2 applies and the notice period is the period stated in Section 7; and the optional wording in Clause 11 does not apply. e. For Modules One, Two and Three, Option 1 in Clause 17 applies and the EU SCCs are governed by Irish law. Under Clause 18(b), the courts of Ireland have jurisdiction. This applies only to the EU SCCs and does not alter the governing law of the Agreement. f. Annex I is completed by Schedule 1, Annex II by Schedule 2 and, for Modules Two and Three, Annex III by Schedule 3. **vi. UK transfers.** Where a Restricted Transfer governed by the UK GDPR is not covered by applicable UK adequacy regulations, the EU SCCs completed under paragraph v apply with the UK Addendum in Schedule 4. **vii. Swiss transfers.** Where a Restricted Transfer governed by the Swiss Federal Act on Data Protection is not covered by an applicable adequacy decision or the Swiss–US DPF, the EU SCCs apply with the adaptations required by Swiss law. The competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner, and data subjects in Switzerland may bring proceedings in Switzerland. **viii. Changes and successor frameworks.** If a Transfer Mechanism is amended, replaced, superseded, invalidated or no longer available, its lawful successor will apply automatically where permitted. Otherwise, Synap may implement a lawful replacement on reasonable notice, provided that the protection required by Applicable Data Protection Legislation is not reduced. The parties will execute any documentation reasonably required to give effect to it. ### **13. Co-operation and Data Subject Rights.** **i. Data subject requests.** Taking into account the nature of the processing, Synap will provide reasonable assistance to enable Customer to respond to requests by data subjects exercising rights under Applicable Data Protection Legislation. If Synap receives a request relating to Customer Data directly from a data subject, Synap will not substantively respond on Customer's behalf unless Customer instructs it to do so or the law requires it. Where Synap can reasonably identify the relevant Customer, Synap will promptly forward the request or direct the data subject to that Customer. Synap may take reasonable steps to verify the requester's identity before disclosing information. **ii. Regulatory and third-party requests.** If either party receives a Third Party Request concerning processing for which the other party is responsible, it will promptly notify the other party where legally permitted. The parties will cooperate in good faith to the extent reasonably necessary to respond and to meet their respective legal obligations. ### **14. Miscellaneous.** i. If there is a conflict, the order of precedence is: (a) the mandatory terms of the applicable Transfer Mechanism, for the relevant Restricted Transfer; (b) this DPA; (c) the Agreement; and (d) the Privacy Policy. ii. Except to the extent prohibited by Applicable Data Protection Legislation or inconsistent with the SCCs or UK Addendum, claims arising under this DPA are subject to the exclusions and limitations of liability in the Agreement. iii. Nothing in this DPA restricts the rights of a data subject or the powers of a competent supervisory authority. iv. Each party is responsible for the laws applicable to its own processing and will cooperate in good faith where overlapping requirements apply. v. Synap may update this DPA where reasonably necessary to comply with a change in Applicable Data Protection Legislation or an approved transfer mechanism. Synap will give reasonable notice of a material change and will not reduce the overall protection of Customer Data during the term except where required by law. vi. Except as amended by this DPA, the Agreement remains in force. vii. Synap's access to Customer Data is solely for the purposes permitted by the Agreement and this DPA and is not consideration for the Services. viii. To the extent permitted by law, neither party is responsible for an administrative fine imposed on the other party for that other party's infringement of Applicable Data Protection Legislation. This does not limit liability to a data subject or supervisory authority, or liability that cannot lawfully be excluded. This DPA takes effect when incorporated into the Agreement or on another date agreed in writing. No separate signature is required. ### **15. AI Systems and the EU AI Act.** i. Features involving automated analysis, computer vision or machine learning may constitute an "AI system" under Regulation (EU) 2024/1689 (the **"EU AI Act"**), depending on their intended purpose and use. Synap will assess and comply with obligations applicable to it as provider or deployer. ii. As at the date of this DPA, the EU AI Act requirements for high-risk systems listed in Annex III, including certain systems used to monitor or detect prohibited behaviour during tests in educational or vocational settings, are scheduled to apply from 2 December 2027. Synap maintains a proportionate compliance programme in preparation for applicable requirements. iii. Synap will provide information reasonably necessary to understand an AI-assisted feature's intended purpose, principal outputs and human-oversight requirements. Unless expressly stated in the applicable product documentation, such features are intended to assist human review, not make final determinations of cheating, misconduct, identity or another comparably significant outcome, and are not intended to infer emotions or intentions from biometric data. Customer is responsible for its deployment, configuration and use of the feature and for obligations applicable to its decisions. ### **Schedule 1** **DETAILS OF PROCESSING** **Annex I** **A. LIST OF PARTIES** **Data exporter** | Field | Details | | ------------------- | ----------------------------------------------------------------- | | Name | The party identified as Customer in the Agreement and this DPA | | Address | As set out in the Agreement | | Contact details | As set out in the Agreement | | Relevant activities | The activities described in Annex I.B below | | Signature and date | Deemed executed when Customer enters into the Agreement | | Role | Controller or Processor, as applicable to the relevant processing | **Data importer** | Field | Details | | ------------------- | ------------------------------------------------------------------------------------- | | Name | Synap Learning Limited (company number 08862590) | | Address | Castleton Mill, Castleton Close, Leeds, England, LS12 2DR | | Contact details | Synap Privacy Team — | | Relevant activities | The activities described in Annex I.B below | | Signature and date | Deemed executed when Synap enters into the Agreement | | Role | Processor or Sub-processor for Customer Data; independent Controller for Account Data | **B. DESCRIPTION OF PROCESSING AND TRANSFERS** | Processing detail | Description | | ------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Category A — Account and service administration** |

Data subjects: Customer personnel, Authorised Users and business contacts.

Personal Data Processed: names, business contact details, account roles, authentication and security records, billing and support information, and service-usage records.

Purpose: contract and account administration, billing, support, service improvement, security, abuse prevention and compliance with law. Synap ordinarily acts as an independent Controller for this category.

| | **Category B — Core assessment and learning services** |

Data subjects: candidates, learners, employees, customers, markers, proctors, educators, managers and other End Users.

Personal Data Processed: identifiers and contact details; authentication data; IP address and device/browser information; assessment enrolments, responses, marks, results, feedback and activity records; and information Customer chooses to collect using configurable fields.

Purpose: to provide and support the assessment, exam, training and learning functionality configured by Customer.

| | **Category C1 — Remote proctoring and media capture** |

Data subjects: End Users taking or preparing to take an activity for which Customer enables proctoring.

Personal Data Processed: webcam video or still images, microphone audio, screen recordings, room or environment scans, timestamps, proctor notes, integrity flags and associated event metadata.

Purpose: to help Customer deter, detect and review suspected cheating, fraud or other conduct affecting assessment integrity.

| | **Category C2 — Device and session monitoring** |

Data subjects: End Users taking or preparing to take a monitored or locked-down activity.

Personal Data Processed: operating system, browser and version, network and device information; open tabs, applications or processes where the enabled feature supports this; session events and activity logs.

Purpose: to provide the lockdown and monitoring configuration selected by Customer and identify events relevant to assessment integrity.

| | **Category C3 — Identity-document and selfie capture** |

Data subjects: End Users for whom Customer enables an identity check.

Personal Data Processed: images or video of an identity document and the End User's face; document fields; capture-quality, document-presence, face-presence and liveness outputs; and reviewer decisions.

Purpose: to enable Customer to review identity evidence and check that suitable evidence was captured.

| | **Category C4 — Biometric face comparison** |

Data subjects: End Users for whom Customer enables face comparison.

Personal Data: facial images, biometric templates or measurements derived from them, match or confidence scores, liveness outputs and reviewer decisions.

Purpose: to assess whether the person shown in a selfie or live capture is likely to be the person shown in an identity document or reference image.

| | **Category C5 — Gaze and attention estimation** |

Data subjects: End Users for whom Customer enables gaze or attention analysis.

Personal Data Processed: video frames and measurements or estimates such as facial or eye landmarks, head position, gaze direction, periods away from the screen, timestamps, confidence scores and associated flags.

Purpose: to identify configured gaze and attention patterns for Customer's authorised reviewers to consider in context.

| | **Category C6 — Automated and AI-assisted review** |

Data subjects: End Users whose activity Customer configures for automated analysis.

Personal Data Processed: the underlying Customer Data submitted to the enabled feature and generated indicators, classifications, similarity scores, confidence scores, flags, summaries or prioritisation outputs.

Purpose: to assist Customer's authorised reviewers by highlighting measurable events or patterns that satisfy configured criteria or confidence thresholds.

| **Special-category and other sensitive data.** Biometric data processed for the purpose of uniquely identifying an individual is special-category data under Article 9 GDPR; treatment under other laws depends on their applicable definitions. Other captured material may reveal protected characteristics. Customer is responsible for the applicable lawful basis and condition, privacy notice, impact assessment, necessity and proportionality. **Incidental capture.** Room scans, webcam, microphone and screen recordings may capture bystanders, private surroundings, accessibility or medical equipment, conversations, notifications or other unrelated content. Synap processes this material only as incidental to the Customer-configured feature and does not use it to infer protected characteristics. **Frequency.** Processing is continuous for Categories A and B and occurs when Customer or an Authorised User enables and uses the relevant Category C feature. **Instructions and transparency.** Customer's configuration forms part of its documented instructions. Feature-specific and just-in-time notices supplement, but do not replace, Customer's privacy notice or lawful basis. **Human and automated review.** Customer Data may be reviewed by authorised Customer or Synap personnel, a Sub-processor or an automated system, as configured. Automated outputs support review and may be incomplete or incorrect without context. Customer is responsible for final decisions and any legally required human oversight. **Retention.** Customer controls the retention of Customer Data through the Services and its documented instructions, subject to feature-specific defaults and maximum periods displayed in the Services, an Order Form or other documentation supplied before the feature is enabled. Identity and biometric evidence is retained only for the configured review period and is then deleted or redacted in accordance with the applicable feature settings. On termination or expiry, Section 10 applies. Backup copies are isolated from ordinary use and overwritten according to Synap's documented backup-rotation schedule. **Sub-processors.** Each Sub-processor may process only the categories of Customer Data and for the purposes necessary to provide its identified service, for the period it is engaged and subject to Section 7 and Schedule 3. **C. COMPETENT SUPERVISORY AUTHORITY** For the EU SCCs, the competent supervisory authority is determined in accordance with Clause 13: ordinarily the authority for the EEA country in which the data exporter is established; if the exporter is not established in the EEA, the authority for its Article 27 representative or, where no representative is required, the authority in an EEA country in which relevant data subjects are located. For the UK Addendum, the competent supervisory authority is the UK Information Commissioner's Office. For Swiss transfers, it is the Swiss Federal Data Protection and Information Commissioner. **Schedule 2** **TECHNICAL AND ORGANIZATIONAL SECURITY MEASURES** **Annex II** Synap maintains an ISO27001 certification, the relevant supporting documentation for which can be found on our Trust center at . In addition, further details of Synap's technical and organizational security measures to protect Customer Data are available at: * * * Where applicable, this Schedule 2 will serve as Annex II to the Standard Contractual Clauses. The following table provides more information regarding the technical and organizational security measures set forth below. | Technical and Organizational Security Measure | Evidence of Technical and Organizational Security Measure | | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Measures of pseudonymisation and encryption of personal data |
  • All data sent to or from Synap is encrypted in transit using TLS 1.2 or higher.
  • Customer Personal Data is encrypted at rest using 256-bit AES encryption
  • Where appropriate, Personal Data is pseudonymised so that only the minimum required fields are stored, processed or transferred.
| | Measures for ensuring ongoing confidentiality, integrity, availability and resilience of processing systems and services |
  • Synap has implemented a formal procedure for handling security events. When security events are detected, they are escalated to an emergency alias, relevant parties are paged, notified, and assembled to rapidly address the event. After a security event is contained and mitigated, relevant teams write up a post-mortem analysis, which is reviewed in person and distributed across the company and includes action items that will make the detection and prevention of a similar event easier in the future.
  • Customer's primary application database and stored files are hosted in the EU (Ireland) or the US according to Customer's assigned region. Disaster-recovery backups may use a different availability zone or region but remain within the same selected data-residency boundary (European Union or United States). Limited ancillary processing may occur elsewhere as described in Section 12 and the Sub-processor Page.
  • Synap uses AWS and MongoDB to provide scalable compute, storage, database, networking and security infrastructure designed for high availability.
  • Synap's data security, high availability, and built-in redundancy are designed to ensure application availability and protect information from accidental loss or destruction. Synap's Disaster Recovery plan incorporates geographic failover. Subscription Service restoration is within commercially reasonable efforts and is performed in conjunction with AWS’ ability to provide adequate infrastructure at the prevailing failover location. All of Synap's recovery and resilience mechanisms are tested regularly and processes are updated as required.
  • Synap's availability is monitored 24/7 via automated alerts, with senior on-call engineers being alerted as soon as an issue is detected.
  • Synap has no direct reliance on specific office locations to sustain operations. All operational access to production resources can be exercised - by authorized employees - at any location on the Internet. Synap leverages a range of best-of-breed technologies and other critical cloud tools to deliver uninterrupted remote work for all employees.
  • Encrypted backups are created and retained in accordance with Synap's documented backup and disaster-recovery procedures.
| | Measures for ensuring the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident |
  • Synap's mission-critical infrastructure is designed to meet a Recovery Time Objective of 30 minutes, and a Recovery Point Objective of 60 minutes.
  • Synap has a documented Incident Response / Disaster Management policy which is tested regularly.
| | Processes for regularly testing, assessing, and evaluating the effectiveness of technical and organizational measures in order to ensure the security of the processing |
  • Synap regularly tests their security systems and processes to ensure they meet the requirements of this security policy. Synap maintains a CyberEssentials certification, a copy of which is available on request.
  • Application security testing. Synap uses automated tools to scan applications, source code and dependencies for vulnerabilities on a regular basis. Independent penetration testing is performed at least annually, and identified vulnerabilities are prioritised and remediated using a documented risk-based process.
  • Synap uses industry-leading tools to assess our source code and open source dependencies for vulnerabilities
| | Measures for user identification and authorisation |
  • All access to systems processing Customer Data is protected by Multi Factor Authentication (MFA). Customer Administrator accounts can also be protected with MFA.
  • Synap restricts access to Customer Data to only those people with a “need-to-know” for a Permitted Purpose and following least privileges principles.
  • Synap regularly reviews at least every 180 days the list of people and systems with access to Customer Data and removes accounts upon termination of employment or a change in job status that results in employees no longer requiring access to Customer Data.
  • Synap mandates and ensures the use of system-enforced “strong passwords” in accordance with the best practices (described below) on all systems hosting, storing, processing, or that have or control access to Customer Data and will require that all passwords and access credentials are kept confidential and not shared among personnel.
  • Password best practices implemented by Synap's organisational password manager. Passwords must meet the following criteria: a. contain at least 10 characters; b. must contain lowercase and uppercase letters, numbers, and a special character; c. cannot be part of a vendor provided list of common passwords.
  • Synap does not operate any internal corporate network. All access to Synap resources is protected by strong passwords and MFA.
  • Synap monitors their production systems and implements and maintains security controls and procedures designed to prevent, detect, and respond to identified threats and risks.
  • Strict privacy controls exist in the application code that are designed to ensure data privacy and to prevent one customer from accessing another customer’s data (i.e., logical separation).
| | Measures for the protection of data during transmission |
  • Encryption of data in transit via TLS 1.2 or higher
  • Pseudonymisation and/or data minimisation as appropriate
  • Redaction or masking of sensitive information where supported by the relevant feature and configuration
| | Measures for the protection of data during storage |
  • Intrusion Prevention. Synap implements and maintains a working network firewall to protect data accessible via the Internet and will keep all Customer Data protected by the firewall at all times.
  • Databases, including backups, are encrypted with AES-256.
  • Synap operates a documented, risk-based vulnerability and patch-management process and applies security updates according to their severity, exploitability and operational impact.
  • Security Awareness Training. Synap requires annual security and privacy training for all employees with access to Customer Data.
  • Synap uses anti-malware software and keeps the anti-malware software up to date. Customer instances are logically separated and attempts to access data outside allowed domain boundaries are prevented and logged.
  • Endpoint security software
  • System inputs recorded via log files
  • Access Control Lists (ACL)
  • Multi-factor Authentication (MFA)
| | Measures for ensuring physical security of locations at which personal data are processed |
  • Synap's services and data are hosted in AWS facilities in the EU (Ireland) or the US according to Customer's assigned region and are protected by AWS's physical and environmental security controls.
  • Synap personnel do not have physical access to AWS data centres. Physical access is controlled by AWS in accordance with its audited security programme.
  • Synap restricts logical production access to authorised personnel with a documented business need, using least-privilege and time-bound access where appropriate.
| | Measures for ensuring events logging |
  • See “Measures for the protection of data during storage” above.
| | Measures for ensuring system configuration, including default configuration |
  • Change and Configuration Management. Synap uses continuous automation for application and operating systems deployment for new releases. Integration testing and unit testing are done upon every build with safeguards in place for availability and reliability. Synap has a process for critical emergency fixes that can be deployed to Customers within minutes. As such Synap can roll out security updates as required based on criticality.
  • Access Control Policy and Procedures
  • Change Management Procedures
| | Measures for internal IT and IT security governance and management |
  • Information-security management procedures informed by guidance from the UK National Cyber Security Centre (NCSC), including the Cyber Essentials framework
  • Information security policy
  • Data Breach Management Policy
| | Measures for certification/assurance of processes and products |
  • ISO27001 certification, with continuous monitoring and endpoint protection in place. More information available at
  • External penetration testing performed at least annually
  • Disaster recovery / Data breach simulation exercises with an external agency performed annually
| | Measures for ensuring data minimisation |
  • Data collection is limited to the purposes of processing (or the data that the Customer chooses to provide).
  • Security measures are in place to provide only the minimum amount of access (least privilege) necessary to perform required functions.
  • Return and deletion are governed by Section 10 of this DPA.
  • More information about how Synap processes personal data is set forth in the Privacy Policy available at , and our Candidate/End User privacy policy available at
| | Measures for ensuring data quality |
  • Synap has a process that allows data subjects to exercise their privacy rights (including a right to amend and update their Personal Data), as described in Synap's Privacy Policy.
  • See “Measures for ensuring ongoing confidentiality, integrity, availability and resilience of processing systems and services” above.
| | Measures for ensuring limited data retention |
  • See “Measures for ensuring data minimization” above.
| | Measures for ensuring accountability |
  • Synap has implemented data protection policies
  • Synap follows a compliance by design approach
  • Synap maintains documentation of its processing activities
  • Synap has designated personnel responsible for privacy and data-protection governance
  • Synap maintains the certifications and assurance activities identified under “Measures for certification/assurance of processes and products” above.
| | Measures for allowing data portability and ensuring erasure |
  • Secure Disposal. Return or deletion. Synap will delete Customer Data from active systems without undue delay and, where a deletion request is technically complete and valid, no later than 30 days. Residual encrypted backup copies are isolated from ordinary use and overwritten under Synap's documented backup-rotation schedule, ordinarily within 90 days.
  • Archival copies. Where applicable law requires Synap to retain Customer Data, Synap isolates and protects it from ordinary use and processes it only for the legally required purpose.
  • Synap has a process that allows data subjects to exercise their privacy rights (including a right to amend and update their Personal Data), as described in Synap's Privacy Policy.
| | Technical and organizational measures to be taken by the \[sub]-processor to provide assistance to the controller and, for transfers from a processor to a \[sub]-processor, to the Customer. |
  • Vendor & Services Providers. Prior to engaging new third-party service providers or vendors who will have access to Synap Data, Synap conducts a risk assessment of vendors’ data security practices.
  • Synap will restrict the onward sub-processor’s access to Customer Data only to what is strictly necessary to provide the Services, and Synap will prohibit the sub-processor from processing the Personal Data for any other purpose.
  • Synap imposes contractual data protection obligations, including appropriate technical and organizational measures to protect personal data, on any sub-processor it appoints that require such sub-processor to protect Customer Data to the standard required by Applicable Data Protection Legislation.
  • See Subprocessors List & Management Policy, available at
| **Schedule 3** **LIST OF SUB-PROCESSORS** **Annex III** For Modules Two and Three of the EU SCCs, Option 2 in Clause 9 applies. The authorised Sub-processors, their locations, services and relevant processing activities are listed at . Changes to the list are governed by Section 7 of this DPA. Synap will provide at least thirty (30) calendar days' prior notice of a new or replacement Sub-processor, except where use of that Sub-processor requires Customer to affirmatively enable an optional feature and the relevant information is provided before or when the feature is enabled. **Schedule 4** **UK INTERNATIONAL DATA TRANSFER ADDENDUM** This Schedule incorporates the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner's Office under section 119A of the Data Protection Act 2018. **Part 1: Tables** **Table 1 — Parties and start date** | Field | Exporter | Importer | | ------------- | --------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | | Start date | The effective date of this DPA | The effective date of this DPA | | Party details | Customer, at the address and with the company details stated in the Agreement | Synap Learning Limited (company number 08862590), Castleton Mill, Castleton Close, Leeds, England, LS12 2DR | | Key contact | As stated in the Agreement | Synap Privacy Team — | | Signature | Customer is deemed to sign this Addendum by entering into an Agreement incorporating this DPA | Synap is deemed to sign this Addendum by entering into the Agreement | **Table 2 — Selected SCCs, modules and clauses** The "Approved EU SCCs" are the EU SCCs identified in Section 1 of this DPA, including their Appendix Information, as completed by this DPA. The following modules apply according to the parties' roles in the relevant Restricted Transfer: * Module One: Controller to Controller, for Account Data where applicable. * Module Two: Controller to Processor. * Module Three: Processor to Processor. Module Four does not apply. Clause 7 applies. For Modules Two and Three, Option 2 in Clause 9 applies using the notice period in Section 7 of this DPA. The optional wording in Clause 11 does not apply. **Table 3 — Appendix information** | EU SCC appendix | Location | | ----------------------------------------------- | --------------------- | | Annex IA: List of parties | Schedule 1, Annex I.A | | Annex IB: Description of transfer | Schedule 1, Annex I.B | | Annex IC: Competent supervisory authority | Schedule 1, Annex I.C | | Annex II: Technical and organisational measures | Schedule 2 | | Annex III: List of Sub-processors | Schedule 3 | **Table 4 — Ending the Addendum when the Approved Addendum changes** Neither party may end this Addendum solely under section 19 of the Mandatory Clauses when the Approved Addendum changes. This does not affect any termination right under the Agreement or applicable law. **Part 2: Mandatory Clauses** Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with section 119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses, is incorporated into and forms part of this Schedule 4. **Schedule 5** **UNITED STATES DATA PROTECTION TERMS** ### **1. Application and interpretation** This Schedule applies only to the extent that a United States privacy, education-record or biometric-privacy law applies to the relevant processing. Terms defined by an applicable law have the meanings given by that law. If this Schedule conflicts with the remainder of the DPA, this Schedule controls only for the processing governed by that law. ### **2. US state comprehensive privacy laws** Where Customer is a "controller" and Synap is a "processor", or the equivalent roles apply under a US state comprehensive privacy law, Synap will: a. process Personal Data only on Customer's instructions and for the limited purposes described in the Agreement, this DPA and Schedule 1; b. ensure that each person processing the data is subject to a duty of confidentiality; c. maintain reasonable administrative, technical and organisational security measures appropriate to the nature of the data; d. engage Sub-processors only in accordance with Section 7 and impose materially equivalent data-protection obligations on them; e. provide reasonable assistance with authenticated consumer-rights requests, data-protection assessments, security obligations and regulator inquiries, taking account of the nature of the processing and information available to Synap; f. delete or return Personal Data as provided in Section 10; and g. make available information reasonably necessary to demonstrate compliance and permit assessments in accordance with Section 11. Customer determines the purposes and means of processing and is responsible for providing required notices, obtaining any required consent, responding to consumers and ensuring that its instructions comply with applicable law. ### **3. California Consumer Privacy Act** To the extent that the California Consumer Privacy Act, as amended by the California Privacy Rights Act (**"CCPA"**), applies and Customer is a "business", Synap will act as a "service provider" or "contractor", as applicable. The specific business purposes for which Customer discloses Personal Information to Synap are to provide, secure, support and improve the Customer-configured Services described in the Agreement and Schedule 1. Customer discloses Personal Information to Synap only for those limited and specified purposes. Synap will: a. not Sell or Share Personal Information; b. not retain, use or disclose Personal Information outside the direct business relationship with Customer or for any purpose other than the specified business purposes, except as otherwise permitted by the CCPA; c. not combine Personal Information received from or on behalf of Customer with Personal Information received from another person or collected through Synap's own interaction with a consumer, except as permitted by the CCPA; d. comply with obligations applicable to service providers or contractors and provide the same level of privacy protection required by the CCPA; e. notify Customer if Synap determines that it can no longer meet those obligations; f. permit Customer, subject to Section 11, to take reasonable and appropriate steps to help ensure that Synap uses Personal Information consistently with Customer's obligations and to stop and remediate unauthorised use; and g. reasonably assist Customer with consumer requests, risk assessments and cybersecurity-audit information to the extent required by the CCPA and reasonably available to Synap. Synap certifies that it understands and will comply with the restrictions in this Section. Where Synap receives deidentified information, it will take reasonable measures to prevent reidentification, publicly commit to maintaining the information in deidentified form and not attempt to reidentify it except as permitted by law. ### **4. FERPA** This Section applies only where Customer is an educational agency or institution subject to the Family Educational Rights and Privacy Act (**"FERPA"**) and Customer provides Synap with personally identifiable information from education records. Where Customer relies on FERPA's school-official exception, Customer designates Synap as a school official with a legitimate educational interest in providing the Services. Synap will: a. remain under Customer's direct control, exercised through the Agreement, this DPA, Customer's documented instructions and Service configuration, with respect to the use and maintenance of the relevant education records; b. use personally identifiable information from education records only to perform the institutional service or function described in the Agreement and for the purposes for which Customer disclosed it; c. not redisclose that information except to an authorised Sub-processor bound by consistent restrictions, as instructed by Customer, or as otherwise permitted by FERPA; d. restrict access to personnel and Sub-processors with a legitimate need to perform the Services; e. provide reasonable assistance to enable Customer to facilitate a parent or eligible student's lawful access to or correction of education records maintained by Synap; and f. delete or return the information in accordance with Section 10. Customer is responsible for determining whether a FERPA exception applies, identifying Synap appropriately in its annual FERPA notice where required, and ensuring that its disclosure and instructions comply with FERPA. ### **5. United States biometric privacy laws** This Section applies to the extent that Synap processes a biometric identifier, biometric information or biometric data governed by an applicable United States biometric-privacy law, including the Illinois Biometric Information Privacy Act, Texas Business and Commerce Code Chapter 503, Washington Revised Code Chapter 19.375, or a successor or similar law (**"US Biometric Laws"**). Each party will comply with the obligations directly applicable to it. Customer, as the party determining whether to enable the feature and the purposes for which it is used, is responsible for determining whether a notice, written release, consent or other authorisation is required and for obtaining it before capture or processing begins. Synap will provide reasonably available information about the feature to support Customer's notice. Synap will: a. process covered biometric information only to provide the Customer-configured identity or integrity feature and on Customer's documented instructions; b. not sell, lease, trade or otherwise profit from covered biometric information; c. not disclose or redisclose covered biometric information except to an authorised Sub-processor necessary to provide the feature, as instructed or authorised by Customer or the individual, or as otherwise required or permitted by applicable law; d. protect covered biometric information using reasonable care and at least the same degree of protection Synap applies to other confidential and sensitive information; e. retain covered biometric information only for the configured and documented purpose and delete it under the applicable retention settings and Section 10, and in all cases no later than required by applicable law; and f. maintain and make publicly available a retention and destruction policy where an applicable US Biometric Law requires it. The definitions under the applicable US Biometric Law control. ### **6. Other US requirements** If another US federal or state privacy law applies to Customer's use of the Services and requires additional processor or service-provider terms, the parties will reasonably cooperate to enter into the necessary terms. Synap may update this Schedule under Section 14 to reflect amendments, successor laws and newly effective generally applicable requirements, provided that the update does not materially reduce the protection of Customer Data. # Accessibility & Section 508 Learn about Synap's Accessibility and relevant attestations towards WCAG / Section 508 (U.S.) standards Synap is committed to delivering exams in an equitable and accessible way. We regularly test our products against accessibility standards to ensure that users with specific needs and accommodatios can use the platform in a fair way. We base our assessments on WCAG criteria, which are an internationally recognised set of guidelines regarding the accessibility of web content for users with physical, sensory and/or cognitive impairments. In addition, we are very open to feedback from our Customers and their End Users as to how we can make the platform better. Please find below a Voluntary Product Accessibility Template (VPAT) report attesting to Synap's conformity with the WCAG 2.1 guidelines. * Synap Web - [Student Exam Platform - WCAG 2.1 / Revised Section 508 Report ](https://drive.google.com/file/d/1XdB1gtNOXjvEM0KQwNPmdOe4snzi0Q_y/view?usp=sharing) An updated version of this VPAT, based on the updated WCAG 2.2 criteria is being developed and expected to be published in July/August 2026. Based on the findings of this report, the Synap Web - Student Exam Platform is conformant with Level AA of the WCAG 2.1 guidelines. It is worth pointing out that Level AAA includes several criteria that may be difficult for Synap Customers to achieve without significant consideration and/or changes to their assessment policies (e.g. the use of untimed exams, and requiring exam content to be easily understood). For this reason we generally suggest that Synap is compliant with Level AA, as when used in conjunction with most commonly accepted examination practices, or without significant and explicit consideration regarding how a set of online assessments should be adapted, it is likely that it would fail to meet Level AAA criteria. {% hint style="info" %} To summarise the above, if you are delivering exams to students using Synap, you can expect WCAG 2.1 Level AA (and by extension, U.S. Section 508) compliance 'out of the box' as long as you use our authoring tools appropriately. \ \ If Level AAA compliance is important to you, then Synap does provide the foundational structure and tools for this, however you will need to take additional steps to ensure your content, and the configuration of your exam maintains that level of compliance. {% endhint %} Please note that this evaluation does not cover Administrator areas of the platform though this part of the site uses the same underlying methodologies and technologies as the Student platform. ### Notes on U.S. Section 508 The Revised 508 Standards incorporate by reference the WCAG 2.0 Level AA Success Criteria, and apply the WCAG 2.0 Level AA success criteria and conformance requirements to both web and non-web electronic content. Our understanding of this is that conformance with WCAG 2.0 (and by extension 2.1, which is a superset of 2.0) Level AA, meets the criteria set out by Section 508. Please seek independent legal advice about this if Section 508 is applicable to you. # Candidate Privacy Notice A plain-English guide to how Synap usually handles candidate information when an organisation uses our platform to deliver an exam or assessment. LAST UPDATED: 29th September 2026 ## Who this notice is for This notice is for people who have been registered to take an exam, assessment or learning activity on a Synap portal. It explains, in plain English, how Synap usually handles candidate information. It is not a substitute for the privacy notice provided by the organisation delivering your assessment, which we call your **Exam Provider**. Your Exam Provider may configure Synap differently, use only some features, or connect Synap to other services. For information specific to your assessment, read: * your Exam Provider's privacy notice; and * the information shown before you start, including any notice about proctoring, identity checks, recordings or third-party services. If those sources differ from this general guide, contact your Exam Provider for clarification before starting your assessment. ## Who is responsible for my information? Your Exam Provider normally decides why your candidate information is collected, which Synap features are used, who may review the information and how long it is kept. In data-protection language, it is normally the **Controller**. Synap Learning Limited provides the platform and normally handles candidate information on the Exam Provider's instructions. In that role, Synap is a **Processor**. Synap may use other carefully selected providers to help operate particular platform features; these are described in our [Subprocessors List & Management Policy](https://legal.synap.ac/subprocessors-list-and-management-policy). Where Synap separately decides how limited information is used for its own legal obligations or the security and administration of its service, Synap may act as a Controller for that specific use. ## What information might be handled? The information depends on how your Exam Provider configures the assessment. ### Account and profile information This may include your name, email address, candidate, student or employee number, organisation, course or cohort, account role, authentication information and other profile fields selected by your Exam Provider. Some portals use a pseudonymous reference instead of a name or email address. This information is used to create or identify your account, give you access to the correct activities, secure your account and associate your work and results with the correct record. ### Assessment and learning information This may include: * the assessments or activities assigned to you; * your questions, answers, uploaded files and other submissions; * start, finish and duration information; * marks, scores, grades, feedback and reviewer decisions; and * certificates, progress and learning records. Some answers may be marked automatically using rules set by the Exam Provider. Other answers may be marked by people, or by a combination of automated and human review. ### Device, network and security information Synap may process information such as your IP address, browser and operating system, device type, session times, authentication and security events, network performance and technical logs. This helps us operate the platform, provide compatible instructions, prevent misuse, investigate security events and diagnose technical problems. ### Accessibility and reasonable-adjustment information Your Exam Provider may record settings or instructions needed to support you, such as extra time, font-size or contrast preferences, rest breaks or other adjustments. In some cases, you can also set these preferences yourself. ### Support notes and other information Authorised users at your Exam Provider may ad If you contact Synap for support, we will normally respond in accordance with your Exam Provider's instructions, ask the Exam Provider for direction or put you in contact with them. If we reasonably believe that you or another person may face an immediate and serious risk to health or safety, and it is not practicable to obtain timely instructions, we may take reasonable steps to obtain assistance. This may include contacting emergency services or an emergency contact and sharing the minimum information reasonably necessary to help them respond.d notes, comments, annotations or support records about you. You may also provide personal information in free-text answers, uploaded files or communications. Please avoid including unrelated personal information unless it is needed for your assessment or support request. ## Proctored assessments Proctoring means monitoring an assessment to help protect its integrity. Depending on the configuration selected by your Exam Provider, Synap or a connected proctoring service may collect: * webcam video or images; * microphone audio; * a recording or images of your screen; * browser, tab, application or assessment-session events; * a room or desk scan; * connection and device information; and * timestamps, reviewer notes, flags and reports. The exact information collected should be shown before the assessment begins. Proctoring data is collected only for the relevant assessment session, although technical preparation checks may occur beforehand. Recordings may incidentally capture information that is not relevant to the assessment—for example, another person entering the room, items in the background, sounds, notifications or information visible on your screen. Synap and its automated tools do not set out to collect this incidental information or use it to infer sensitive characteristics. Where practical, prepare a private space, close unrelated applications and notifications, and ask your Exam Provider about any concern or adjustment before the assessment. Authorised reviewers may watch a session live or review recordings, events and reports afterwards. They may add notes or flag parts of the session for further review. ## Identity checks and biometric information An assessment may ask you to capture an identity document, a photograph or video of your face, or both. An identity check may involve: * checking that an image appears to contain an identity document; * extracting document fields such as your name, date of birth or document number; * checking that one face is present and that the image is suitable for review; * checking whether a real person appears to be present, sometimes called a liveness check; * comparing a selfie or video with the photograph on an identity document; and * producing a result, confidence score or fraud indicator for an authorised reviewer. The check may use Synap technology or an optional identity provider listed on our Subprocessor page, such as Stripe Identity or Entrust (Onfido). The provider used for your assessment should be identified before the check. An ordinary photograph is not automatically biometric data. If technical processing extracts facial features so that an image can be matched to a person, the resulting information is biometric data. When it is used to identify or verify a particular person, it is generally treated as special-category biometric data under UK and EU data-protection law. Your Exam Provider is responsible for deciding whether an identity check is necessary and lawful, identifying an appropriate legal basis and special-category condition where required, and explaining any alternatives or consequences that apply to your assessment. ## Automated and AI-assisted review Some configured features can analyse recordings, images or session events and highlight information for a reviewer. Depending on the feature, this may include: * the absence or presence of a face, or more than one face; * screen, browser or application events; * possible objects, movements, sounds or changes in the assessment environment; * head-position or gaze-direction signals; * identity-document or facial-similarity checks; and * timestamps, confidence scores or sections of a recording that may warrant review. A flag or score is an indication for review, not proof of cheating, misconduct or identity fraud. Synap's automated and AI-assisted review features are intended to help authorised people prioritise and conduct their review. They are not designed to infer your emotions, intentions or state of mind. Your Exam Provider decides whether to enable these features, how outputs are reviewed and what action, if any, is taken. Final determinations about misconduct, assessment validity or other significant outcomes should be made under the Exam Provider's own procedures, with appropriate human review. Information shown before the assessment should identify any materially different use. ## Who may see or receive my information? Depending on the assessment, candidate information may be available to: * authorised staff, markers, proctors, invigilators or reviewers acting for your Exam Provider; * authorised Synap personnel where access is necessary to operate, secure or support the service; * Synap's Subprocessors for the relevant platform or optional feature; * another provider selected or connected directly by your Exam Provider; and * regulators, courts, law-enforcement bodies or other recipients where disclosure is required by law. Access is limited according to role and purpose. Synap does not sell candidate information or use candidate assessment, proctoring or identity data for targeted advertising. ## Where is my information processed? Exam Providers can use a Synap stack whose primary AWS and MongoDB workloads are hosted in either: * the **European Union**, in Ireland; or * the **United States**, in Virginia Backups may use another availability zone or region for resilience and disaster recovery, but remain within the selected EU or US data-residency boundary. Some supporting or optional services may process information in other locations. For example, a third-party proctoring or identity-verification feature may have its own regional configuration. Relevant locations and transfer safeguards are described in our [Subprocessors List & Management Policy](https://legal.synap.ac/subprocessors-list-and-management-policy), and assessment-specific information should be shown before a feature is used. ## How long is my information kept? Your Exam Provider normally decides the applicable retention period, taking account of its assessment, regulatory, appeals and record-keeping requirements. Synap keeps candidate information in accordance with the Exam Provider's configuration and instructions, our agreement with it, and any applicable legal requirements. Different categories may have different retention periods. For example, an Exam Provider may retain a result or certificate for longer than a proctoring recording or identity image. Optional providers may also apply documented retention and deletion arrangements for the feature they supply. Contact your Exam Provider if you need the retention period that applies to your assessment. ## How is my information protected? Synap uses technical and organisational measures designed to protect candidate information. These include encryption in transit and at rest, access controls, monitoring, staff confidentiality and security procedures. Synap maintains ISO 27001 certification, an independently audited information-security standard. No online service can promise absolute security. If you believe information connected with your assessment may be at risk, contact your Exam Provider promptly. ## Cookies and similar technologies Candidate portals use cookies and similar local-storage technologies where needed to keep you signed in, secure your session, remember settings and operate the assessment. Synap does not use advertising cookies on candidate exam portals. The separate Synap marketing website may use analytics or advertising technologies subject to the choices and information provided there. ## What choices and rights do I have? Your rights depend on the law that applies and the purpose for which your Exam Provider uses the information. They may include rights to ask for access, correction, deletion or restriction, to object to certain uses, or to ask for human review of certain automated decisions. Your Exam Provider is normally the best first contact because it controls the assessment, holds the context needed to identify your records and decides how to respond. Its privacy notice should provide contact details, applicable legal bases, your rights and how to complain to the relevant regulator. If an assessment requires proctoring, an identity check or another feature that causes concern, contact your Exam Provider before the assessment. It can explain whether an alternative or reasonable adjustment is available. Synap cannot change an Exam Provider's assessment requirements on its own, but we will assist them if asked to do so. ## How do I contact Synap? For questions or requests about your assessment data, first contact your Exam Provider. They will contact us if needed. You can contact Synap at . If your request concerns Customer Data controlled by an Exam Provider, we will direct or forward it to that organisation where appropriate. # Website Terms of Use Synap Learning Limited ("Synap", "Us", "We") welcome you to our Site! The **"Site"** means [synap.ac](https://www.intercom.com/), and any successor URLs, mobile or localized versions and related sub-domains, in whatever format they may be offered now or in the future. Through the Site, we may provide you with general information regarding our company, products and services. By using or accessing any part of the Site, you are agreeing to these Website Terms of Use (**"Terms"**), our [Privacy Policy](https://www.intercom.com/privacy) and all other policies or notices posted by us on our Site. We may change these Terms and Conditions at any time, and your continued use of the Websie following any changes shall be deemed to be your acceptance of such changed Terms and Conditions. Synap also offers a suite of software-as-a-service solutions designed to enable customers to manage communications with, and data about, their end users (**"Synap Services"**). Use of the Synap Services is subject to our [Subscription Terms of Service](https://www.intercom.com/legal/website-terms-of-use#terms) , and these Terms do not apply to use of the Synap Services or receipt of related services, except where otherwise noted. ### 2. Use of the Website You must not use the Website for any purpose that is unlawful or prohibited by these Terms and Conditions. You must not use the Website to copy, adopt, reproduce or redistribute the Website or any content on the Website in any similar way. Unauthorised attempts to upload information or change information on this Website is illegal and strictly prohibited. You must not misuse the Website by knowingly introducing viruses, trojans, worms, logic bombs or other material which is malicious or technologically harmful. You must not attempt to gain unauthorised access to the Website, the server on which the website is hosted or any server, computer or database connected to the Website. If you choose, or you are provided with, a user identification code, password or any other piece of information as part of our security procedures, you must treat such information as confidential, and you must not disclose it to any third party. We have the right to disable any user identification code or password, whether chosen by you or allocated by us, at any time, if in our opinion you have failed to comply with any of the provisions of these Terms and Conditions. ### 3. Changes to Website Access to the Website is permitted on a temporary basis and we reserve the right to: (a) change or remove (temporarily or permanently) the Website or any part of it without notice and you confirm that we shall not be liable to you for any such change or removal; (b) Change these Terms and Conditions at any time, and your continued use of the Website following any changes shall be deemed to be your acceptance of such changed terms and conditions. ### 4. Links to Third Party Websites The Website may include links to third party websites that are controlled and maintained by others. Any link to other websites is not an endorsement of such websites or of the owners of such websites or of the goods and/or services offered on such third party websites and we do not accept any responsibility in respect of such. We do not give any warranty as to the accuracy, reliability or content of any information or materials on such third party websites and shall not be liable for any loss or damage arising from their use. You acknowledge and agree that we are not responsible for the content or availability of any such sites. ### 5. Copyright and Intellectual Property All copyright, database rights, trade marks and all other intellectual property rights in the Website and its content (including without limitation the Website design, text, graphics and all software and source codes connected with the Website) are owned by us or our licensors. In accessing the Website you agree that you will access the content solely for your personal, non-commercial use. None of the content may be downloaded, copied, reproduced, transmitted, stored, sold or distributed without the prior written consent of the copyright holder, however you shall be entitled to download, copy and / or print pages of the Website for personal, non-commercial home use only. No permission is given by us for use by any person of any intellectual property in the Website which may constitute an infringement of our intellectual property rights or the rights of any third party. ### 6. Disclaimers and Limitation of Liability Although we have taken reasonable care to ensure that the information and material on the Website is accurate and up to date, we do not give any warranty or guarantee as to the accuracy or completeness of such information and material contained on the Website. The content of the Website does not constitute advice and you use the Website at your own risk. We are not responsible for any loss or damage arising from the use of such material and information including, without limitation, for any inaccuracy, misleading statement or representation made by any third party information provided for publication on this Website. The Website is provided strictly on an “as is” and “as available” basis without any representation or endorsement made and without warranty of any kind whether express or implied. Except as expressly set out in these terms and conditions any warranties, term and conditions implied by statute, common law or otherwise shall be excluded to the fullest extent permitted by law. To the fullest extent permitted by law, we shall not be liable for any loss of profit; loss of business; loss of contract; loss of use; loss of or corruption to data or information; loss of anticipated savings; loss or depletion of goodwill or similar losses; or any special, indirect or consequential loss, costs or damage arising out of or in connection with these Terms and Conditions and/or the Website. We give no warranty regarding the functionality of the Website including without limitation that the Website will be available on an uninterrupted or error free basis; that defects will be corrected; or that the Website or the server that makes it available are free of viruses or anything else which may be harmful or destructive and no liability can be accepted in respect of losses or damages arising out of such. We recommend that you take all appropriate safeguards before downloading information or images from the Website. Nothing in these Terms and Conditions shall be construed so as to exclude or limit our liability for death or personal injury caused as a result of negligence or for fraud or fraudulent misrepresentation. ### 7. Indemnity You agree to indemnify and keep us indemnified from and against all liabilities, legal fees, damages, losses, costs and other expenses incurred by us in relation to any claims or actions brought against us or the Website arising out of any breach by you of these Terms and Conditions or other liabilities arising out of your use of this Website. ### 8. General Terms 8.1. **Entire Agreement.** These Terms and Conditions represent the entire understanding relating to the use of the Website and supersede all other statements, representations or warranties (whether written, made by email or oral) made by us. Nothing in these Terms and Conditions shall affect the liability of either party in respect of any misrepresentation, warranty or condition that it makes fraudulently. Any rights not expressly granted in these Terms and Conditions are reserved by us. 8.2. **Jurisdiction & Governing Law.** These Terms and Conditions shall be governed by and construed in accordance with the law of England and you and us hereby submit to the exclusive jurisdiction of the English courts. 8.3. **No Waiver.** No failure or delay by us to exercise any right or remedy provided under these Terms and Conditions or by law shall constitute a waiver of that or any other right or remedy, nor shall it preclude or restrict the further exercise of that or any other right or remedy. No single or partial exercise of such right or remedy by us shall preclude or restrict the further exercise of that or any other right or remedy. 8.4. **No Third Party.** These Terms and Conditions govern the contract between you and us in relation to your use of the website. These Terms and Conditions do not create any right for any third party who is not a party to the contract between us to enforce any term of these Terms and Conditions under the Contract (Rights of Third Parties) Act 1999. 8.5. **Severance.** If any provision contained in these Terms and Conditions should be determined to be invalid, illegal or unenforceable for any reason by any court of competent jurisdiction then such provision shall be severed and the remaining Terms and Conditions shall survive and remain in full force and effect and continue to be binding and enforceable. ### 9. Contact us 9.1 If you have any concerns about material which appears on the Website, please contact or write to us at the address given at the top of these Terms and Conditions. ‍ # Acceptable Use Policy This Acceptable Use Policy applies to Synap's (a) websites (including without limitation synap.ac, any successor URLS, mobile or localized versions and related domains and subdomains) and (b) online learning products and services ((a) and (b) collectively, “Services”). To keep the Services running safely and smoothly, we need our users to agree not to misuse them. Specifically, you agree not to: 1. probe, scan, or test the vulnerability of any system or network used with the Services. If you require a penetration test or vulnerability report this must be arranged in advance and with the express permission of a Synap Authorised Representative; 2. tamper with, reverse engineer or hack the Services, circumvent any security or authentication measures of the Services or attempt to gain unauthorized access to the Services (or any portion thereof) or related systems, networks or data; 3. modify or disable the Services or use the Services in any manner that interferes with or disrupts the integrity or performance of the Services or related systems, network or data; 4. access or search the Services by any means other than our publicly supported interfaces, or copy, distribute, or disclose any part of the Service in any medium, including without limitation by any automated or non-automated “scraping”; 5. overwhelm or attempt to overwhelm our infrastructure by imposing an unreasonably large load on the Services that consume extraordinary resources, such as by: (i) using “robots,” “spiders,” “offline readers” or other automated systems to send more request messages to our servers than a human could reasonably send in the same period of time using a normal browser; or (ii) going far beyond the use parameters for any given Service as described in its corresponding documentation; 6. solicit any users of our Services for commercial purposes; 7. use the Services to generate or send unsolicited communications, advertising or spam, or otherwise cause Synap to become impaired in its ability to send communications on its own or on its customers’ behalf (e.g., by causing Synap to become registered on any Email DNS blocked list or otherwise be denied services by any other third party communications service provider); 8. misrepresent yourself or disguise the origin of any data, content or other information you submit (including by “spoofing”, “phishing”, manipulating headers or other identifiers, impersonating anyone else, or falsely implying any sponsorship or association with Synap or any third party) or access the Services via another user’s account without their permission; 9. use the Services for any illegal purpose or in violation of any laws (including without limitation data, privacy and export control laws); 10. use the Services to violate the privacy of others, or to collect or gather other users’ personal information (including account information) from our Services; 11. use the Services to stalk, harass, bully or post threats of violence against others; 12. submit (or post, upload, share or otherwise provide) data, content or other information that (i) infringes Synap or a third party’s intellectual property, privacy or other rights or that you don’t have the right to submit (including confidential or personal information you are not authorized to disclose); (ii) that is deceptive, fraudulent, illegal, obscene, defamatory, libelous, threatening, harmful to minors, pornographic, indecent, harassing, hateful, religiously, racially or ethnically offensive, that encourages illegal or tortious conduct or that is otherwise inappropriate in Synap's discretion; (iii) contains viruses, bots, worms, scripting exploits or other similar materials; or (iv) that could otherwise cause damage to Synap or any third party; 13. promote or advertise products or services other than your own without appropriate authorization; 14. use meta tags or any other “hidden text” including Synap's or our suppliers’ product names or trademarks; or 15. permit or encourage anyone else to commit any of the actions above. Without affecting any other remedies available to us, Synap may permanently or temporarily terminate or suspend a user’s account or access to the Services without notice or liability if Synap (in its sole discretion) determines that a user has violated this Acceptable Use Policy. # Billing & Payment Terms An MAU refers to a Monthly Active User, someone who logs in and uses your Synap Services in a given calendar month. This document is intended to provide an overview of the key principles of our billing and payment terms. Specific references to Synap's prices or associated user numbers is provided as examples of how this works only. Please visit our website pricing page for the most up-to-date information ### Monthly billing cycle You are billed monthly based on: 1. the Synap plan and user quota you select (i.e., Standard 100 MAUs, Pro 250 MAUs), and 2. the number of Monthly Active Users (MAUs) in your quota (i.e. 100, 250, 500) 3. the number of additional users of your account in the preceding month ('overages') 4. any fees due for Professional Services, including any agreed 3rd Party costs (e.g. proctoring seats) at the time your bill is calculated These are the “Pricing Metrics” that are used to calculate your bill. We bill you each month in advance according to your agreed plan, with the exception of 'additional users' which are billed in arrears. ### Annual plans We offer substantial discounts (\~20%) for annual payments, paid upfront. Customers on an annual plan can request to pay by invoice with 30 day terms, as opposed to card. ### In-plan and Out-of-plan users We undersand that your usage will change over time, and for many of our clients, may vary substantially from month to month (e.g. a startup launching a new product, or a tutoring company with seasonal peaks around exams). Our plans are designed to accommodate these different scenarios. Our Standard and Pro plans come with a baseline of 25 and 100 MAUs respectively, with additional users over those amounts being charged at a flat rate of £2 per user. As you scale, or during seasonal peaks, you can upgrade your plan to include more MAUs (e.g. 250, 500 or 1,000). This upgrade could be temporary or permanent, depending on which option represents the best value for you. 'In plan' users offer a significant discount (upto 70%) over out-of-plan users, so if you are seeing or expecting to have more users, it is often advisable to move to a higher plan. Our customer success team can advise you on the right plan and associated MAU quotas as we learn about your project and expected usage. ### Estimating your upcoming invoice You can see your current plan and user quota by logging in to your Admin Account, clicking on Profile Icon and selecting 'Billing'. You can also see how many MAUs have been on your platform in the last rolling 30 days by going to your Dashboard. This information should give you an accurate estimate of your monthly bill. Please note that, at the moment, there is a slight discrepancy between how your MAUs are calculated in your bill (calendar month), and how they are calculated in your Dashboard (30 days). We are working to change this. From your Billing page, you can also access past invoices for your records. A copy of these will also be emailed to you each month. **VAT Information for B2B Transactions** Please note that Synap operates as a B2B (business-to-business) service company, catering exclusively to businesses. Consequently, all the prices listed in our pricing documentation are exclusive of VAT. VAT will be calculated and added to your total upon portal creation, plan upgrades and changes, and will be explicitly itemised for overages. This ensures full transparency and compliance with tax regulations, allowing your organisation to handle or reclaim VAT in accordance with your local jurisdiction's policies. ### Billing, subscription management, and cancellation **Automated billing**\ Unless otherwise agreed under a separate Business or Enterprise Agreement, all monthly subscription plans are billed automatically via the payment method on file. Clients are responsible for maintaining up-to-date billing details and ensuring sufficient funds are available on the billing date. **Cancellations and downgrades**\ For monthly plans, cancellations must be requested at least five (5) working days prior to the next billing date to ensure the change can be processed in time. Requests made within five working days of the billing date may not be processed before the next charge, though Synap will make reasonable efforts to apply retrospective adjustments or refunds at its discretion. **Non-payment and service suspension**\ Clients on monthly billing are subscribed on a rolling basis. Whilst we will make reasonable attempts to contact and notify clients who are in arrears to provide time to rectify, Synap reserves the right, at its discretion, to terminate, suspend or delete portals with invoices in arrears of 30 days or more.
# Proctoring Policy Synoptic proctoring policy ### Synoptic Options Synoptic assessments are configured using both an **Install Level** and a **Monitoring Level**. Install Levels determine how candidates access the assessment and the security controls available, while Monitoring Levels determine the evidence collected during the assessment. Any Install Level can be combined with any Monitoring Level. Pricing is based on the selected Monitoring Level and is charged per started 4-hour assessment session. Where multiple monitoring methods are used, the assessment will be classified and billed according to the **highest monitoring level enabled**. For example, if webcam monitoring uses Video & Audio Recording and screen monitoring uses Recreation & Snapshots, the assessment will be charged at the Video & Audio Recording rate. | **Install Level** |

Determines how candidates access the assessment and the security controls available during the exam. Options are:
- No install
- Browser Extension
- Desktop App


| | -------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Monitoring Level** |

The Monitoring Level determines the type of evidence collected during the assessment and how the session is reviewed afterwards. Options are:
- No Recording
- Recreation & Snapshots
- Video & Audio Recording (required for Live proctoring)

| See the Pricing & Credits section below for Synoptic Proctoring costs {% content-ref url="/pages/1ZjL3rbYqHNcrDnlwtim" %} [Pricing & Credits](/pricing-and-credits) {% endcontent-ref %} ### Synoptic Data Retention Policy Unless otherwise agreed as part of an Enterprise agreement, Synoptic proctoring data is retained in accordance with the following policy. #### Video, Audio and Monitoring Data Retention periods are calculated from the time an assessment attempt is submitted. | Data State | Retention Period | | ------------------ | -------------------- | | Active Storage | First 90 days | | Cold Storage | 90 days to 12 months | | Permanent Deletion | After 12 months | #### Cold Storage After 90 days, proctoring footage and monitoring data is moved from active storage to cold storage. Data remains accessible but retrieval may take longer than data stored in active storage. #### Permanent Deletion Proctoring footage and monitoring data is permanently deleted 12 months after the assessment attempt is submitted. #### Enterprise Agreements Enterprise clients may agree alternative retention periods as part of their contract. Where an alternative retention period has been agreed, this will take precedence over the standard Synoptic retention policy. # Pricing & Credits ## Introduction Our customers use Synap in a number of different ways - we work with small and large organisations, some of whom are expecting to deliver a handful of exams at different points in the year, and others who will be running multiple exams and other kinds of assessments every day. For this reason, we have recently updated our pricing model to accomodate these different use cases. This document contains our up to date prices. ## Assessment Credits & Associated Pricing In 2023, we are introducing 'Assessment Credits' ("credits"). These can be purchased in bulk and used to pay for the different kinds of assessments available on Synap. As a general rule, higher-volume purchases are eligible for larger discounts. Once purchased a credit is valid for 12 months, and is non-refundable. The reason we have credits is to provide a flexible and transferrable system that our customers can use to pay for different types of assessment - for example, credits can be used to pay for usage of Exams, Assignments, Practice Tests, as well as the various kinds of proctoring we offer on the platform. The table below shows how many credits each type of assessment requires. As you'll notice most types of assessment use 1x credit - it is only the various kinds of proctored assessments that use more credits, this is due to the additional resources associated with running them. | Assessment Type | Cost - Credit-based plans | Cost - MAU-based plans (3) | | ---------------------------------------------------------------------------- | --------------------------- | -------------------------- | | Exam - Non proctored | 1 credit | Included | | Synoptic Exam: Any Install Level, **No recording** | 2 credits | £1.00 | | Synoptic Exam: Any Install Level, **Recreation & Snapshots** | 3 credits | £2.50 | | Synoptic Exam: Any Install Level, **Video & Audio Recording** | 5 credits | £3.50 | | Synoptic Exam: Any Install Level, **Video & Audio Recording with AI Review** | 12 | £8.50 | | Assignment | 1 credit | Included | | Low-stakes MAUs (2) | 1 credit per user per month | Included | 1. Synoptic monitoring charges are applied per started 4-hour session. Attempts exceeding 4 hours will be charged again for each additional 4-hour period started. Billing is based on the highest monitoring level enabled; for example, an assessment using webcam Video & Audio Recording and screen Recreation & Snapshots will be charged at the Video & Audio Recording rate. 2. "Low-stakes MAUs" refers to the use of Synap's various 'low-stakes' assessment tools such as Collections and Spaced Learning, to deliver tests and revision materials to users. These are essentially charged as Monthly Active Users - so, one user taking any number of practice tests on the platform in a given month, will only cost 1 credit. 3. "MAU-based plans" - Customers who have purchased a monthly or annual subscription to Synap, with billing based on MAUs, have all of their non-proctored use of the platform included as a part of their MAU quota. Under these plans, a given user can take as many assessments on the platform as they like, and you will only be charged once for that user. Proctored assessments on the other hand, are charged separately. The baseline cost of a Credit is £1.50 - this is the amount that you will be charged by default if you use the above assessment features. However, you can also purchase credits in bulk, in which case various levels of discount will be applied. Once purchased a credit is valid for 12 months, and is non-refundable. Our current pricing for credit bundles is: | **Number of Credits** | **Price** | **Cost per credit** | | --------------------------- | --------- | ------------------- | | 500 | £1,200 | £2.40 | | 1,000 | £1,800 | £1.80 | | 2,500 | £3,000 | £1.20 | | 5,000 | £4,500 | £0.90 | | 10,000 | £7,000 | £0.70 | | 20,000 | £10,000 | £0.50 | | 1 (Not purchased upfront)\* | £1.50 | £1.50 | ## Estimating How Many Credits You Need Our team would be more than happy to prepare a quote for you, with an estimate on the number of credits you need and the best-value package to purchase. Once you have made this initial purchase, your subsequent credits will be charged at £1.50 each, even if you do not make a larger purchase in the future. Alternatively, if you are looking to get the best value for money, our higher-volume packages do offer significant discounts and you may wish to consider purchasing one of those. ## MAU overages Synap pricing is based on **Monthly Active Users (MAU)** rather than total registered users. A **Monthly Active User** is any learner who logs in and performs a meaningful action during a billing month — for example starting an exam, completing practice questions, or accessing learning content. Plans include an agreed **MAU allowance** each month. f the number of Monthly Active Users (MAUs) in a billing month exceeds the amount included in your plan, Synap will treat the additional usage as **overage**. Key points: * **Additional active users above your plan allowance are billed as overage** at the agreed per-MAU rate. * Overage is typically **calculated at the end of the billing month** based on the total number of unique active users. * If higher usage becomes consistent, we may **recommend moving to a larger MAU plan** to provide better value and predictability. | Plan | Overage per MAU | | ------------ | --------------- | | Standard MAU | £2 | | Pro MAU | £2 | | Business MAU | £2 | # Environment & Sustainability Policy At Synap, we are committed to integrating sustainability into every aspect of our business operations. As a cloud-based SaaS provider based in Leeds, UK, we recognise the importance of environmental stewardship and are dedicated to contributing positively to the planet. Our sustainability pledge includes the following key initiatives: 1. **Energy Efficiency**: We strive to optimise energy usage in our operations, including utilising energy-efficient cloud services from AWS, known for their commitment to sustainability. All of our current hosting regions are based in regions where AWS has committed to 100% renewable power by 2030, and this will remain a key selection criteria in future deployments. 2. **Reducing Carbon Footprint**: We are working towards reducing our carbon footprint through a combination of remote working policies, digital-first strategies, and minimising non-essential travel. 3. **Sustainable Procurement**: Where physical resources are required, we prioritise purchasing from local suppliers who demonstrate a strong commitment to environmental sustainability. 4. **Waste Reduction and Recycling**: We implement waste reduction practices in our office and encourage recycling and responsible waste management among our team. 5. **Continuous Improvement**: We commit to regularly reviewing and improving our sustainability practices, setting measurable goals for reduction in resource usage and carbon emissions. As we continue to grow and evolve, Synap pledges to remain vigilant and proactive in our sustainability efforts, ensuring that our business not only thrives but also positively impacts the environment. # Vulnerability Disclosures ## Introduction This vulnerability disclosure policy applies to any vulnerabilities you are considering reporting to a Synap (the “Organisation”). We recommend reading this vulnerability disclosure policy fully before you report a vulnerability and always acting in compliance with it. We value those who take the time and effort to report security vulnerabilities according to this policy. However, we do not offer monetary rewards for vulnerability disclosures. ## Reporting If you believe you have found a security vulnerability relating to the Organisation’s system, please submit a vulnerability report to In your report please include details of: * The website, IP or page where the vulnerability can be observed. * A brief description of the type of vulnerability, for example; “XSS vulnerability”. * Steps to reproduce. These should be a benign, non-destructive, proof of concept. This helps to ensure that the report can be triaged quickly and accurately. It also reduces the likelihood of duplicate reports, or malicious exploitation of some vulnerabilities, such as sub-domain takeovers. ## What to expect After you have submitted your report, we will respond to your report within 5 working days and aim to triage your report within 10 working days. We’ll also aim to keep you informed of our progress. Priority for remediation is assessed by looking at the impact, severity and exploit complexity. Vulnerability reports might take some time to triage or address. You are welcome to enquire on the status but should avoid doing so more than once every 14 days. This allows our teams to focus on the remediation. We will notify you when the reported vulnerability is remediated, and you may be invited to confirm that the solution covers the vulnerability adequately. Once your vulnerability has been resolved, we welcome requests to disclose your report. We’d like to unify our guidance, so please do continue to coordinate public release with us. ## Guidance You must NOT: * Break any applicable law or regulations. * Access unnecessary, excessive or significant amounts of data. * Modify data in the Organisation's systems or services. * Use high-intensity invasive or destructive scanning tools to find vulnerabilities. * Attempt or report any form of denial of service, e.g. overwhelming a service with a high volume of requests. * Disrupt the Organisation's services or systems. * Submit reports detailing non-exploitable vulnerabilities, or reports indicating that the services do not fully align with “best practice”, for example missing security headers. * Submit reports detailing TLS configuration weaknesses, for example “weak” cipher suite support or the presence of TLS1.0 support. * Communicate any vulnerabilities or associated details other than by means described in the published security.txt. * Social engineer, ‘phish’ or physically attack the Organisation's staff or infrastructure. * Demand financial compensation in order to disclose any vulnerabilities. You must: * Always comply with data protection rules and must not violate the privacy of any data the Organisation holds. You must not, for example, share, redistribute or fail to properly secure data retrieved from the systems or services. * Securely delete all data retrieved during your research as soon as it is no longer required or within 1 month of the vulnerability being resolved, whichever occurs first (or as otherwise required by data protection law). ## Legalities This policy is designed to be compatible with common vulnerability disclosure good practice. It does not give you permission to act in any manner that is inconsistent with the law, or which might cause the Organisation or partner organisations to be in breach of any legal obligations. # Anti-Slavery Policy Statement Modern slavery is a crime and a violation of fundamental human rights. It includes various forms such as slavery, servitude, forced and compulsory labor, and human trafficking. At Synap, we are committed to maintaining an ethical business environment and ensuring that modern slavery is not present in any part of our operations or supply chains. **Our Commitment** We voluntarily uphold a strong stance against modern slavery. We are committed to acting with integrity and transparency in all our business dealings. We expect the same high standards from all of our contractors, suppliers, and other business partners. **Policy Application** This policy applies to all individuals working for or on behalf of Synap, including employees at all levels, directors, contractors, external consultants, third-party representatives, and business partners. **Employee Training and Responsibility** Synap provides annual training to all employees on our Modern Slavery Policy to ensure they understand the importance of preventing modern slavery and human trafficking in our business and supply chains. This training reinforces our zero-tolerance approach and equips employees to recognise and report any concerns or suspicions. All employees are responsible for reading, understanding, and complying with this policy. Any employee who has concerns or suspicions about modern slavery or human trafficking within Synap or its supply chains is encouraged to report these concerns as soon as possible to their line manager or a company Director. **Raising Concerns** Synap is committed to maintaining an open and supportive environment. We encourage all employees and business partners to raise any concerns related to modern slavery. Reports will be treated with seriousness and confidentiality, and we will support anyone who raises genuine concerns. **Supplier Vetting Process** We are committed to maintaining ethical standards across our supply chains. As part of our supplier vetting process, we evaluate potential suppliers to ensure they comply with laws and regulations related to modern slavery and human trafficking. We expect our suppliers to uphold high ethical standards and demonstrate a clear commitment to preventing modern slavery within their own operations and supply chains. This vetting process is part of our broader commitment to combatting modern slavery and ensuring transparency in all aspects of our business relationships. **Continuous Improvement** We are dedicated to continually reviewing and improving our practices to ensure they remain effective in combating modern slavery. This includes providing relevant training to employees and ensuring our zero-tolerance approach to modern slavery is communicated to all suppliers, contractors, and business partners at the outset of our business relationships. **Conclusion** Synap is committed to ethical business practices and human rights. We take a proactive stance in preventing modern slavery within our business and expect our partners to share this commitment. Our dedication to combating modern slavery is integral to maintaining the integrity and ethical standards of our operations.