Effective date: 24 October 2026 · Last updated: 24 October 2026
This policy explains how the Balochistan Assessment and Examination Commission (“BAEC”, “the Commission”, “we”) handles personal information in the SSRS - BAEC mobile application (“the app”). SSRS stands for Supervisory Staff Registration System.
The app is an internal tool for examination staff appointed by the Commission — Centre Superintendents, Inspectors and District Education Officers. It is used to record candidate attendance at examination centres and to verify that a candidate presenting a roll-number slip is the person registered for that seat. It is not an app for candidates, parents or the general public.
BAEC is the data controller. The app is developed and maintained for the Commission by Cyber Edge Technologies, Quetta.
1. Two kinds of information
The app handles information about two different groups of people, and it treats them differently. This distinction runs through the whole policy.
| Group | What the app does |
|---|---|
| The officer the person holding the phone |
Signs in with an account that BAEC issues to him. His details are held so the Commission knows who recorded each attendance mark. |
| The candidates pupils sitting the examination |
Their registration details are downloaded from the Commission's own records so the officer can verify them at the hall door, including when there is no mobile signal. The app does not ask a candidate for anything and does not collect anything from a candidate's own device. |
2. Information about the officer
- Name, CNIC and mobile number — taken from the staff appointment record he applied with. The mobile number is also his username.
- Password — stored only as a one-way bcrypt hash, never in readable form. Neither BAEC staff nor the developer can read it back.
- Role and posting — Superintendent, Inspector or DEO, and the examination centre or district he is responsible for, and the shift where one applies.
- Sign-in record — the time he signed in and the app build on his phone, so a lost or misused account can be traced and suspended.
Accounts are issued, not created
There is no sign-up in the app. The Commission creates each account on the examination portal and hands over a one-time password, which the officer must change on first use. An officer cannot register himself, and cannot create an account for anyone else.
Fingerprint unlock
If the officer switches on fingerprint unlock, the check is performed by Android itself. The app receives only a yes-or-no answer. No fingerprint, face or other biometric data is read, stored or transmitted by the app, and none of it reaches BAEC's servers.
3. Information about candidates
So that the hall door keeps moving when the signal does not, the app downloads the roster for the officer's own centre and keeps it on the phone. That roster holds, for each candidate seated at that centre:
- Name, father's name, roll number and registration number;
- School, examination centre, shift and the papers he is entered for;
- The photograph already held in the Commission's registration record.
None of this is collected by the app. It comes from the candidate's own examination registration, which the Commission already holds, and it is shown only to the officer appointed to that centre. The server decides what a phone may download — the phone is never asked which centre it is allowed to see, so an account cannot reach beyond its posting.
What the app records back
- Attendance — present or absent, for one candidate, for one paper, with the time it was marked and the officer who marked it.
- Answer sheet number and the numbers of any extra sheets issued.
- Unfair means (UFM) — where the officer reports a case, his written remark and, if he takes one, a photograph of the evidence. The evidence photograph is stored under a filename that does not contain the candidate's roll number.
Candidates are children
Candidates in the Middle Standard examination are school pupils, most of them around thirteen years old. Their information is processed by the Commission under its statutory duty to conduct the examination, for no other purpose. It is never used for advertising, never profiled, and never passed to anyone outside the examination process. The app is published for an adult audience — appointed examination staff — and children do not use it.
4. What the app does not do
- It does not read your location. The app requests no location permission at all.
- It contains no advertising and no advertising identifier.
- It contains no analytics or tracking library of any kind, and no social-network SDK.
- It does not read your contacts, call log, messages, files or other apps.
- It does not sell, rent or share personal information with any other company.
- It does not run in the background or track anything when it is closed.
5. Permissions, and why each one is needed
| Permission | Why |
|---|---|
| Camera | To read the QR code on a candidate's roll-number slip, and to take an evidence photograph when a UFM case is reported. The camera is used only while the scanning screen is open. |
| Internet | To download the roster from the Commission's server and to upload completed attendance. |
| Biometric / fingerprint | Optional. Lets the officer unlock the app with the fingerprint already registered on his phone, instead of typing his password at the hall door. See section 2. |
The app asks for nothing else.
6. How the information is protected
- All communication with the server uses HTTPS. Unencrypted traffic is blocked by the app's network security configuration, so the app physically cannot send data in the clear even if it were pointed at a plain HTTP address.
- The sign-in token is held in the Android keystore, which is backed by the phone's secure hardware where the phone provides it.
- The token is a one-way hash on the server — the readable value never rests in the database.
- Every request is re-checked on the server against the account's role and posting. A phone cannot widen its own reach by asking.
- An account can be suspended from the portal immediately, which ends every session on every phone using it.
7. Working offline
Examination centres in Balochistan often have no usable mobile signal, so the app is built to work without one. The roster is held on the phone and attendance marks are queued there until a connection returns, then uploaded. This means candidate information rests on the officer's phone for the duration of the examination.
The officer can clear it at any time from Settings → Reset App Data, and should do so once his centre's examination is finished. Signing out alone does not remove the roster; resetting does.
8. How long information is kept
- Attendance, answer sheet numbers and UFM cases are an official record of the examination and are retained by the Commission under its record-keeping rules.
- Officer accounts are tied to one examination session. After the session they are suspended, and are archived with that year's records.
- Data on the phone lasts only until the officer resets the app or uninstalls it.
9. Your rights, and how to contact us
An officer may ask for a copy of the account information held about him, ask for a correction, or ask for the account and its personal details to be deleted. See Delete your account for how to make that request and what can and cannot be removed.
A candidate, or a parent on a candidate's behalf, who wishes to query the registration details shown in the app should contact the Commission through the usual examination channels; the app only displays what the registration record already contains.
Balochistan Assessment and Examination Commission
BAEC Secretariat, Quetta, Balochistan, Pakistan
Telephone: 081-2876132
Email: info@baec.com.pk
Office hours: Monday to Friday, 9:00 AM – 4:00 PM
Website: https://exam.baec.com.pk/
10. Changes to this policy
If this policy changes, the new version will be published on this page with a new “last updated” date. Where a change materially affects officers using the app, the Commission will notify them through the portal.