Privacy Policy

Last revised on January 2, 2024

This Privacy Policy describes how CertComp collects and receives information about you through the Site, Services and Content and through CertComp’s businesses, including offline. The Privacy Policy together with the Terms and Conditions of use govern your use of the Site and CertComp’s collection and use of your information.

1. General

CertComp would like to start by defining two terms you'll see used throughout CertComp’s Privacy Policy: data processor and data controller.

CertComp is a data processor when CertComp proctors an exam, verifies identities, protects content, or verifies the originality of an assignment. In these instances, your Institution controls your information, not CertComp. Please see your Institution's privacy policy and contact them for inquiries regarding your Personal Information.

CertComp is a data controller when you have directly input Personal Information into a form on CertComp’s website, or directly provide Personal Information through CertComp's customer and/or product services.

Users can utilize CertComp's Sites or Services without providing Personal Information.

CertComp encrypts exam audio, video, and screen recordings and images with Zero-Knowledge Encryption. This means that once these images and recordings are encrypted, they can only be decrypted by Institution-approved representatives.

CertComp may have access to some of this data (if the Institution chooses to collect it) when providing live technical support to an exam taker during the exam.

With E-Proctoring Services, CertComp proctors are able to review exam sessions (including this data, if the Institution chooses to collect it) in real time. In such cases, the Institution gives authorized CertComp staff members temporary access to review exam sessions (including this data, if the Institution chooses to collect it), typically within 24 - 48 hours after the exam session.

2. Collecting Personal Information

• CertComp limits the Personal Information collected from end-users through their use of CertComp’s Services.
• CertComp only collects Personal Information as instructed by your Institution. This is dependent on the Services and settings selected by the relevant Institution-approved representatives.
• CertComp pseudoanonymizes specific test-taker Personal Information.
• Audio, video, and screen recordings and images collected and stored by CertComp are encrypted and can only be decrypted by Institution-approved representatives.
• If you voluntarily provide Personal Information through CertComp’s Sites or Services, CertComp may retain this Information.

CertComp’s Institution Services: When an Institution purchases CertComp’s Service(s), the type of Service and settings selected by the Institution determine what Personal Information an Institution may provide to CertComp or what CertComp can collect from the test taker. This is described in more detail below. Test-taker audio, video, and screen recordings and images received from Institutions and processed by CertComp are end-to-end encrypted and can only be decrypted by Institution-approved representatives.

3. Proctoring

Only an Institution may request CertComp to use E-Proctoring during the administration of an exam.

When using E-Proctoring, an exam administrator may instruct CertComp to monitor test takers via a webcam, microphone, browser, and/or desktop in an effort to uphold the integrity of the assessment. This may include a scan of the test taker’s surroundings, screen, and computer display. 

3.1 Video and audio recording

The Institution determines whether audio and/or video is used to monitor and/or record exam sessions and only the exam administrators have access to these audio and/or video recordings. If selected, the entire exam session is recorded.

The Institution also decides whether to record the test taker’s audio during the exam attempt. If selected, the test taker’s microphone is turned on during the session.

Audio, video, and image files are encrypted prior to being transferred to CertComp's cloud service provider in the location specified by the Institution. The Institution designates certain individuals as appropriate individuals to access this encrypted information. Depending on the Institution’s location these audio and video files are stored on CertComp's cloud service provider’s servers in the US, Europe, Canada, Japan, Australia, South Africa, Singapore, or Abu Dhabi. These files never leave the controlling location of the Institution.

Record Screen, Full Video, 360º Room Scan, and Random Room Scan are additional options that an exam administrator can select for an exam.

Verify Audio, Video, Desktop and Signature may also be selected by the exam administrator and the test taker is required to take those actions prior to the start of the exam.

As a result of these Institution-selected monitoring or verification options, CertComp may collect Personal Information such as a test taker’s image and Personal Information that may be shared through the screen, desktop, webcam, web traffic or microphone of the test taker’s device.

3.2 Facial and gaze detection

If your Institution elects to use CertComp's proctoring Services that enable video recording, CertComp uses facial detection or gaze detection to flag potentially suspicious test activity to help Institution-approved representatives maintain assessment integrity. The Institution may choose to disable facial detection and gaze detection as a secondary setting of the video recording feature if It wishes to opt out of facial detection and gaze detection, but still record the exam session.

CertComp does not use what is conventionally known as “biometrics” or “facial recognition” technology. Facial recognition uniquely identifies specific people by assessing whether the face in one image matches the face in another image. It requires a database of either images of people’s faces, or biometric representations of them, and technology that compares new images or biometric representations with entries in that database.

Instead, CertComp uses “facial detection” or “gaze detection” technology. A fundamental difference between these technologies and biometrics or facial recognition technology is that facial or gaze detection technologies do not use geometry or landmarks as identifiers. Additionally this difference, can be illustrated by the questions they answer:

Facial Recognition: “Does the face in this picture match the face in this other picture?”

Facial Detection: “Is there a face in this picture?”

Gaze Detection: “Is the person looking away from the camera or the exam screen?”

Facial detection can identify that there is a human face present in an image or video recording, but it cannot identify that person – only that there is, indeed, a person in the image or recording.

Gaze detection can determine the direction that the individual is looking, but cannot identify who they are or what they are looking at.

If the exam administrator enables the use of video recording, CertComp uses facial detection to flag video evidence that may indicate the number of individuals present within the immediate vicinity of the test taker, but CertComp does not attempt to determine who those individuals are.

If a test taker is not able to pass the face detection process and/or the 360º Room Scan, they can enter into direct contact with an CertComp Support Agent via a live chat to troubleshoot the issue. The Support Agent can request access to webcam images from the system, provide instructions that ensure clearly-captured images, and otherwise help the user overcome any technical issues they may be having. If the exam administrator enables the use of video recording, CertComp can use gaze detection to flag evidence in the video and/or screenshots/webcam images that the individual was looking at something other than the device they were using to take the exam. This helps Institution-approved representatives prioritize where to review exam video recordings to determine if the test taker was consulting unauthorized materials or was receiving outside assistance during the exam attempt. However, the Institution may choose to disable facial detection and gaze detection as a secondary setting of the E-Proctoring feature if It wishes to opt out of facial detection and gaze detection, but still record the exam session.

3.3 Monitoring during an exam

When exam administrators use CertComp’s E-Proctoring Services, CertComp uses technology to automatically collect certain information about a test taker’s activities during the exam session for purposes of protecting exam integrity. The flagged behaviors may include facial and gaze detection (described above) to monitor if the test taker leaves the session, tracked head movement to monitor how frequently the test taker looks away, sound detection to monitor if other voices are in the room, question response time, dropped internet connections, and other activities that may indicate irregular testing activities. When using these services, CertComp’s automated technology continually monitors the applications and processes that are running on the device during an exam session.

If an Institution has requested reporting, test-taker data may be aggregated, and then individual test-taker data may be compared to the aggregated data to look for patterns or anomalies, such as whether a test taker spent an unusually long time answering a question relative to other users.

CertComp does not and has not established “normal“ profiles or compare test takers against any preserved or aggregated normal.

At the end of an exam session, the Institution-approved representative will have access to a summary report of these flagged activities, as well as the raw data the Service collects from each test-taker’s session. The Institution-approved representative then determines if any further action is warranted. Aggregated data can also be provided to the Institution-approved representative(s) (e.g. the average length of time users spent on an exam question, the average time spent on the entire assessment and the average date/time that users started the exam session).

Only an Institution determines whether to enable settings, which settings are enabled for flagging of irregular testing behaviors, and the Incident Levels (Low, Medium, High) assigned to certain activities of the test taker during an exam. Following the Institution-approved representative’s review, only they can determine what, if any, action to take related to a test taker.

CertComp does not make any decisions related to the test taker from flagged activity.

4. ID Verification

Additionally, an Institution may select an option to verify the test taker’s identity before they start their exam. In this case, the Personal Information that is collected may include name, government ID number, and date of birth if the test taker chooses to utilize their government-issued ID or the Institution requires the test taker to use the government-issued ID to validate their identity. This ID image along with other test-taker audio, video, and screen recordings and images are stored with Zero-Knowledge Encryption by CertComp. If this option is selected by the Institution,a photo of the Institution-accepted form of ID will be collected with the webcam and encrypted on CertComp's servers. The image will only be accessible by an Institution-approved representative along with the exam results within the Institution’s assessment platform.

5. Browser Lock Setting

Depending on which features are selected by an Institution, the test taker’s browser may be locked down so that they cannot open additional tabs, pages, or device resources. This is done to help ensure test integrity.

When operating as part of the CertComp Testing Platform or as a browser extension, CertComp only has restricted access to a test taker’s computer system. This includes no access to any personal documents or files stored on the machine.

Immediately after an exam is submitted, all remote proctoring abilities are disabled automatically. 

Although it is not necessary to do so, test takers can uninstall or disable the CertComp E-Proctoring browser extension immediately after taking an exam, and re-install or enable it only when taking future CertComp-proctored exams.

When operating as a browser extension, test takers can understand when CertComp is running, through the exam entering process, when the CertComp shield icon in the upper-right-hand corner of the browser blinks red. Lock Down settings include the following, and exam administrators can choose to implement some, all, or none of these during the exam.

6. Zero-Knowledge Encryption

When processing and securing test-taker Information from an Institution, CertComp does not joke around. That’s why CertComp utilizes an end to end encryption method called “Zero-Knowledge Encryption”.

“Zero-Knowledge Encryption” means that only Institution-approved representatives at Institutions can decrypt and review the encrypted exam recordings on CertComp’s servers.

Only the Institution has the access that is needed to view Personal Information that they’ve provided to their test takers or test-taker Personal Information that has been provided to CertComp. CertComp utilizes PBKDF2-HMAC-SHA512 to generate the keys. Then AES-256 GCM encryption is used to encrypt the files and finally CertComp uses TLSv1.2 and TLSv1.3 with perfect forward secrecy to transfer any and all data. CertComp uses Zero-Knowledge Encryption for any audio, video, and screen recordings and images sent by a test taker. This means only Institution-approved representatives can decrypt, watch, and review the encrypted Information.

7. Test-taker records

All test-taker records that are “student” or “educational records” obtained by CertComp from an educational Institution are the property of the Institution and are under the control of that Institution. Institutions or the respective test taker owns the data.

CertComp will follow the instructions provided by the Institution and make every effort to comply with applicable law. In these instances, CertComp is a processor for the educational Institution and the educational Institution is the controller. Their Privacy Policy controls the use of test-taker Information. If you are looking for information regarding your test-taker records please reach out to your Institution.

8. Information collected from Institution-approved representatives

The sections below describe Personal Information that may be collected from an Institution-approved representative.

To register an Institution to use CertComp’s suite of services an administrator account must be created. To register an account for your institution, an Institution-approved representative must provide Personal Information, such as:

• Institution-approved representative’s name
• Phone number
• Institution name
• Campus email address

8.1 Request for demo

For Institution-approved representatives to request a demonstration of the CertComp Services, you must provide Personal Information such as:

• Institution-approved representative’s name
• Phone number
• Institution name
• Campus email address

8.2 CertComp E-Proctoring Admins

An Institution-approved representative can generally utilize CertComp’s E-Proctoring Admin services to conduct exams. To do so, the Institution-approved representative does not have to provide their name or other Personal Information. Institution-approved representatives configure their exam settings to select whether to collect the following types of test-taker data:

• Audio Recordings
• Video Recordings
• Facial Detection
• Gaze Detection
• Information on test taker computer screen
• Images of test taker during exam

8.3 E-Proctoring Technical Support

To contact technical support, Personal Information such as:

• Institution-approved representative’s name
• Phone number
• Email address

may be collected from an Institution-approved representative to facilitate the troubleshooting process. Disclosure of such information by an exam administrator is voluntary and will NEVER be sold to third parties.

9. Surveys, contests, feedback

Additionally, CertComp may invite Institution-approved representatives or test takers to participate in surveys, questionnaires, contests, or to contact CertComp with questions, comments, or feedback. Participation is voluntary and only those that have opted in/ consented will be contacted.

Due to the nature of some of these activities, they may include the collection of Personal Information, such as your:

• Institution-approved representative’s name
• Email
• Institution details
• Location

10. Customer service

You may contact CertComp about CertComp's products and Services or with customer service inquiries. Depending on the method by which you contact CertComp, certain Personal Information will be visible to CertComp. This information is identified below. Other than this information that is inherently visible based on your selected communication platform and optionally if information is needed to verify your identity, CertComp never requires that you disclose Personal Information.

Customer service emails

If you contact us by email, CertComp will obtain and store your email address.

Customer service phone calls

If you contact us by phone call, CertComp will obtain and store your phone number.

Customer service Live Chat

If you contact us through chat, CertComp will obtain your IP Address and store only part of it.

11. Job applicants

• Job applicant name
• Email
• Postal address
• Government ID numbers
• Date of birth
• Employment history
• Academic history

13. Marketing

CertComp may also collect Personal Information from Institution representatives and other professionals, such as their name and email address, to send marketing communications about CertComp's products and Services. These communications will only occur if they have consented to receiving this information. CertComp does not sell, transfer or utilize your data for any purpose other than to provide CertComp's Services.

CertComp does NOT send marketing communications to test takers.

13. Automatically collected Information; log Information

When you access the Sites and Services via a browser, application, or other device, CertComp's servers automatically record certain information. These server logs will include information such as:

• Your web request
• Your interaction with a Service
• IP address (only part of the IP address is stored)
• Browser type (high level only)
• Browser language
• The date and time of your request

CertComp stores anonymized web server log files by keeping only part of the user’s IP address and generalizing the user agent.

CertComp does not utilize any device fingerprinting in logs.

Test-taker payments

Some Institutions may require the test taker to pay for the Services. In those instances, CertComp uses a third-party processor to process test-taker assessment payments. The information collected will only be used by CertComp's third-party processor for the purpose of purchasing the Service. The information collected may include:

• Credit card number
• Credit card 3-4 digit security code
• IP address
• User agent
• Email address - to receive a digital receipt

15. Customer accounts and payments

CertComp may also collect Personal Information from Institution-approved representatives using CertComp's Services to verify business information, establish customer accounts, and to process payments. CertComp may collect financial information from potential customers to process CertComp's customer payments, such as:

• Business name or Business representative
• Business email
• Business phone number
• Business address
• Bank account information
• Tax ID numbers

Sometimes Institution-approved representatives may pay for the Services with a credit card. In those instances, CertComp uses a third-party processor to process test-taker assessment payments. The information collected will only be used by CertComp's third-party processor for the purpose of purchasing the service. The information collected may include:

• Credit card number
• Credit card 3-4 digit security code
• IP address
• User agent
• Email address - to receive a digital receipt

16. Using your Information

CertComp's use of Personal Information depends on whether we are processing Information for an Institution or if an individual provides Personal Information to us directly or visits CertComp's Sites.

17. As a data processor

When CertComp is a processor for an Institution, CertComp uses Personal Information as instructed by the respective Institution for the following Institution purposes. The services listed below are described in full in the “Collecting Personal Information” section.

Please remember an Institution decides which of CertComp's products or Services to use:

• E-Proctoring
• Custom Testing (with and without proctoring)
• Registering an Institution
• Administrative account creation
• Institution assessment platform use
• Administering E-Proctoring services
• Processing client payments and/or test taker payments

Please Note: The Institution decides which of CertComp's products or Services to use and which settings and features to enable.

18. As a data controller

CertComp uses Personal Information as follows when an individual contacts us directly, agrees to participate in certain activities, or when visiting CertComp's Sites such as:

• Surveys
• Contests
• Feedback
• Customer service
• Customer accounts and test-taker payments (CertComp may collect customer Information to establish Institution accounts and process payments)
• Job applications
• Marketing
• Continuous improvement, product development, and research
• Site operations and security

19. Site operations and security

As a controller and operator of CertComp's Site, CertComp automatically collects information and log details to operate CertComp's Sites.

• CertComp tracks the total number of visitors to CertComp's Site, the number of visitors to each page of CertComp's Site, browser type, and IP addresses. However, CertComp anonymizes the IP address by removing the last octet of the address, making CertComp unable to identify you or your exact location.
• CertComp may also analyze tracked data for trends and statistics in the aggregate. Such information will be maintained, used, and disclosed in aggregate form only and will not contain Personal Information.
• CertComp also has in place website security tools and processes, including penetration testing and vulnerability scans, to better ensure Site security and protection of Information. In the event of a firewall event or other attempt that triggers a firewall rule, either active or passive, the offending IP address is recorded in its entirety and maintained in our data security tracking systems.

20. De-identified data/aggregate information

20.1 For Customer Billing and Usage

CertComp uses de-identified information for billing and utilization analysis of CertComp's Services.

21. Sharing your Information

• CertComp doesn’t sell test-taker data to third parties.
• CertComp doesn’t share test-taker data with third parties for any marketing purposes.

22. As a data processor

Data that enters CertComp's system has been encrypted using an unshared key stored in an Institution’s assessment platform and can only be unlocked by the Institution-approved representative within the assessment platform. CertComp utilizes the assessment platform to gain information about the user's role. This restricts information from being shared with users who are not labeled as an Institution-approved representative. The entire process is transparent to the end user.

23. As a data controller

In instances where CertComp is the controller and CertComp collects test-taker Personal Information, such as when a test taker contacts CertComp's Customer Service or requests Service information, information about CertComp's company, or other inquiries, CertComp may disclose your Personal Information in the following limited circumstances:

23. 1 Law and harm

CertComp may disclose test-taker Information if CertComp believes that it is reasonably necessary to comply with a law, regulation, or legal request; to protect the safety of any person; to address fraud, security, or technical issues; or to protect CertComp's rights or property.

23.2 Business transfers

Test-taker Personal Information maintained in the Institution’s exam platform is the property of the Institution. Test-taker audio, video, and screen recordings and images stored within the CertComp servers are pseudoanonymized and encrypted and will not be sold or transferred to a third party if CertComp is involved in an acquisition, merger or other corporate reorganization transaction. In such instances, and consistent with and limited to data protection laws and privacy commitments, marketing analytics data, CRM data, customer lists, and other pseudoanonymized data may be disclosed or transferred as part of a corporate reorganization transaction; provided that the acquirer commits to using the information in a manner consistent with applicable law and this Privacy Policy.

CertComp will never sell your data to a third party. Any transfer of your data to any third party will be as specifically stated in CertComp’s Terms.

23.3 Identify verification

CertComp may use third parties for identity verification with individual consent to successfully enter or submit a proctored exam using CertComp's Services.

23.4 Payment processing

CertComp uses a third-party payment processor to process payments. CertComp does not directly collect payment information and is not a money-services business. To the extent such functionality is made available in the Services, it is provided by an unaffiliated third party, and like any other third-party service, is subject to their terms of use.

23.5 Third-party service providers

CertComp uses third-party service providers to help provide CertComp's Services, such as hosting CertComp's blogs, Help Center, and knowledge bases, and to help CertComp understand the use of CertComp's Services. As CertComp uses Zero-Knowledge Encryption for audio, video, and screen recordings and images, it is encrypted and not accessible by the third-party service provider. In all instances, third-party services providers can only use any data for CertComp's business purposes as specified in CertComp's written agreement with them and not their own purposes. These Services may collect information sent by your browser as part of a web page request, such as cookies or your IP request. The sub-processors that CertComp uses are listed below but CertComp may update this list periodically:

23.5.1 AWS

Purpose: Cloud service providerLocation: InternationalWebsite: https://aws.amazon.com/

23.5.2 Azure

Purpose: Cloud service providerLocation: InternationalWebsite: https://azure.microsoft.com/

23.5.3 Cloudflare

Purpose: Cloud service providerLocation: InternationalWebsite: https://cloudflare.com/

23.5.4 Braintree

Purpose: Payment processing providerLocation: USAWebsite: https://braintreegateway.com/

23.5.5 Twilio

Purpose: Internal and external call routing providerLocation: USAWebsite: https://twilio.com/

23.5.6 Zendesk

Purpose: Helpdesk and supportLocation: USAWebsite: https://zendesk.com/

23.5.7 Crispk

Purpose: Live chat and supportLocation: FranceWebsite: https://crisp.chat/en/

CertComp will update this list as CertComp may make changes to it.

To ensure you are aware of all updates, please periodically check for updates here.

23.6 Marketing

CertComp uses search engines (Bing and Google), paid social media (LinkedIn, Twitter, and Facebook), email marketing (current and future CertComp blog), contests (CRM info), surveys, (anonymous and/or CRM), lead generation forms (Facebook and LinkedIn) to provide marketing to Institution representatives, who have opted in to receive marketing materials. CertComp does not market to test takers.

23.7 Data transfers from CertComp branches

Support tickets do not contain embedded Personal Information/ Personal Data unless specifically provided by the user in the text of the support request. CertComp Support Representatives are located in the US, Brazil and India.

Support Representatives will have read-only access to the ID assigned to the user, along with any Personal Information/ Personal Data needed to verify identity or that is voluntarily given by the user. The Support Representatives are required to delete all Personal Information/Personal Data, required or voluntarily given, immediately after responding to and resolving the support request.

In addition, CertComp may collect and transfer the following information when deemed necessary for operating of business or hired service(s):

• IP addresses
• User agent details
• Administrator account information
• Assessment platform functionality information
• Client billing information

This data is transferred depending on what is required by the Institution, its users, and what is deemed necessary for the operation of CertComp's website(s), application(s), and/or Services.

23.8 Other disclosures

CertComp may disclose test-taker Information to fulfill the purpose for which you provide it and to enforce or apply agreements with CertComp.

24. What about student education records and FERPA?

CertComp adheres to the  Family Educational Rights and Privacy Act (FERPA)  as applicable when it is providing Services to educational Institutions in the United States that are subject to FERPA.

CertComp works with Institution(s) to ensure compliance with FERPA and applicable privacy laws. One of the most important ways in which we strive to adhere to FERPA and restrict disclosure is to encrypt test-taker audio, video, and screen recordings and images. As described in this Privacy Policy, CertComp uses Zero-Knowledge Encryption to do this when an Institution has an agreement to utilize CertComp's Services.

24.1 What is FERPA?

FERPA is a federal law that affords students (or parents/guardians for students under 18 or not enrolled in a post-secondary Institution) certain rights with respect to their education records. In the United States, CertComp has agreements with educational Institutions that are subject to FERPA and CertComp acts as a third-party service provider of such educational Institutions and must make every effort to comply with FERPA generally as a “School Official.” This means CertComp is providing CertComp's Services on behalf of the educational Institution and only as authorized by them for legitimate educational purposes.

24.1.1 Why is FERPA important?

FERPA protects students from having their information disclosed to third parties without the eligible student (18+) or parent’s/guardian’s consent unless there is an applicable exception under FERPA, such as when a third-party service provider is authorized by an educational Institution by a written agreement to provide services as a “School Official.”

CertComp complies with FERPA by only using student Personal Information as a School Official as authorized by an educational Institution in CertComp's written agreements.

Remember audio, video, and screen recordings and images collected during the exam attempt, stored by CertComp, and received from an Institution are encrypted using Zero-Knowledge Encryption. These recordings and images can only be decrypted and reviewed by Institution-approved representatives within the Institution’s assessment platform. CertComp dictates who these authorized users are by utilizing the educational Institution’s assessment platform to gain information about the user's role. This restricts information from being shared with users who do not fall under the "School Official" role. The entire process is transparent to the end user. CertComp securely delivers all content for the Services encrypted and CertComp's servers make every effort to comply with industry security standards, including ISO 27001 and PCI-DSS.

For CertComp's technical support channels, CertComp's Support Representatives are trained on privacy and security and are instructed not to ask for information beyond what FERPA defines as "Directory Information". This information may include:

• Student full name
• Campus email address
• Institution name

To better ensure FERPA and privacy and security compliance, CertComp's employees receive periodic privacy and security training. CertComp has been ISO 27001 certified.

Cookies

We only utilize Single Sign-On technology to authenticate end users. CertComp does not use registration or a log-in system on any of CertComp's Sites or Services. CertComp manages sessions without using cookies (or HTML Web Storage) and runs cookie-free domains.

Third-party platforms or payment processors may utilize cookies on their own domains.

26. Do not track settings

CertComp does not use any client-side tracking pixels such as those used for advertising, marketing, and targeting.

When a client uses the “Do Not Track” client setting, CertComp will only log the action, but will not store the user agent or IP address.

27. Your Rights

Some countries and/or states have their own privacy and data security laws, CertComp makes every effort to comply with each and every one of them via a customizable DPA (Data Processing Agreement) that can be tailored to the needs of any potential partner. 

28. As a data processor

Parents, legal guardians, or eligible students should contact their Institution directly if they want to access, correct, delete, export, import, request a copy, exercise other rights they may have, or if they have questions about their Personal Information. CertComp does not have the ability to edit, revise or delete any test-taker Personal Information contained in test-taker records. We will send all requests regarding test-taker Personal Information to the respective Institution.

When CertComp is the controller, CertComp will respond to your request regarding your Personal Information held by CertComp as required by applicable laws and CertComp's legitimate business purposes.

28. US K-12 Institutions and children's privacy rights

When CertComp’s Services are used by an educational Institution in the classroom for an educational purpose, CertComp is permitted by the Institution to process that student Information as a School Official and only for legitimate educational purposes authorized by the Institution. In these instances, the Institution (on behalf of the parent) provides the required consent for CertComp to collect Personal Information of a child under 18 for this purpose as a “School Official.” Under FERPA, Institutions in the United States subject to this law must provide an annual notice to parents of third parties that are providing services under the FERPA “School Official” exception.

Other than as described above, CertComp's Site and Services are not directed to children.

30. COPPA

Except for CertComp's specific services offered to K-12 Institutions, CertComp's Services are directed towards adults who are of the legal age to access them in their respective jurisdictions.

If you are under the age of 13, please do not use CertComp's Sites without explicit permission from your School Official, parent, and/or guardian.

By accessing and using CertComp's Sites and Services, you represent and warrant that you are of the legal age to form a binding contract with CertComp in your respective jurisdiction and that you meet the foregoing eligibility requirements. If you do not meet these requirements, you must not access or use CertComp's Sites or Services. If CertComp learns CertComp has collected or received Personal Information from an individual who was ineligible to access or use the Sites or Services, CertComp will take steps to remove such Information. If you believe CertComp might have any Information from or about a user who is ineligible to use the Sites or Services, please contact  privacy@CertComp.com.

31. California privacy rights

CertComp does not sell your Personal Information to any third parties for direct marketing purposes as defined in California Civil Code Section § 1798.83.

Please contact privacy@CertComp.com for any questions regarding your Personal Information.

CertComp does not sell Personal Information to third parties.

CertComp does not market to test takers and does not permit any third-party marketing to them.

CertComp uses Zero-Knowledge Encryption, so only Institution-approved representatives can decrypt and review encrypted exam recordings.

31.1. CCPA notice

The following disclosures are made pursuant to the   California Consumer Privacy Act of 2018 (“CCPA”).  These disclosures supplement any privacy notices CertComp has provided to you. In CertComp's Privacy Policy, CertComp describes the categories of Personal Information CertComp has collected from California consumers over the past twelve (12) months, the categories of sources from which the Information was collected, the business or commercial purpose for which the Information was collected, and the categories of third parties with whom it has been shared. CertComp will not collect additional categories of Personal Information or use the Personal Information CertComp collected for materially different, unrelated, or incompatible purposes without providing you notice. For purposes of this CCPA Notice, “Personal Information” means information that identifies, relates to, describes, is capable of being associated with or could reasonably be linked, directly or indirectly, with a particular consumer or household.

31.2 Institution test takers

CertComp provides Services to Institutions as a “School Official” under FERPA as described above. Under the CCPA, CertComp collects, retains, uses, and discloses Personal Information, which may include student data under these Institution agreements only as a “service provider” to CertComp's Institution customers. The respective Institution’s privacy policies apply to their test takers.

Please note that government agencies, including public Institutions, are not subject to CCPA.

If you have a question or would like to exercise your California consumer rights to knowledge, access, or deletion, please contact your Institution directly.

CertComp does not sell Personal Information. CertComp uses Personal Information to administer assessments, provide CertComp's Services, and respond to individual inquiries.

Third parties receiving Personal Information are only permitted to process that Personal Information as described in CertComp's Privacy Policy and CertComp's written agreements and are not permitted to sell Personal Information or market to any test taker.

If you are a resident of California, you have other rights under the CCPA as follows:

• Right of Access: you can access your collected Personal Information by contacting CertComp. CertComp describes in CertComp's Privacy Policy about Personal Information CertComp collects, how CertComp uses it, and to whom CertComp discloses it.
• Right to Correct, Update, or Delete: you can correct, update, or request deletion of your Personal Information by contacting CertComp through one of the channels listed below. CertComp can’t make changes to or delete your Information in some situations where it is necessary for CertComp to maintain your Information, for example if CertComp needs the Information to comply with applicable law or based on other exceptions as indicated in the CCPA.
• Right to Request Disclosure of Information Collected: please contact CertComp as indicated below to request further information about the categories of Personal Information CertComp has collected about you, where CertComp collected your Personal Information, and for what purpose CertComp uses your Personal Information.
• Right to Disclosure of Information Sold and Right to Opt-Out: you have the right to know what Information of yours CertComp has sold and you have the right to opt-out of any sale of your Information. CertComp does not sell your Personal Information.
• Right to Non-Discrimination: CertComp does not and will not discriminate against you if you exercise your rights under the CCPA.

To exercise the rights described in this Privacy Policy, please submit a verifiable consumer request to us: via email: privacy@CertComp.com

Only you, or someone legally authorized to act on your behalf and registered with the California Secretary of State, may make a verifiable consumer request related to your Personal Information. You may also make a verifiable consumer request on behalf of your minor child. You may only make a verifiable consumer request for access or data portability twice within a 12-month period. The verifiable consumer request must:

• 1. Provide sufficient information that allows CertComp to reasonably verify you are the person about whom CertComp collected Personal Information or an authorized representative, which may include the user’s:
  • 1. First name
  • 2. Last name
  • 3. Email address
• 2. Describe your request with sufficient detail that allows CertComp to properly understand, evaluate, and respond to your request.

31.3. Verify requests

CertComp cannot respond to your request or provide you with Personal Information if CertComp cannot verify your identity or authority to make the request and confirm the Personal Information relates to you. If CertComp cannot verify your identity or authority, CertComp will follow procedures to verify your identity and authority. CertComp attempts to respond to a verifiable consumer request within forty-five (45) days of its receipt. If CertComp requires more time (up to 45 days), CertComp will inform you of the reason and extension period in writing.

If you have an account with CertComp, CertComp will deliver CertComp's written response to that account. If you do not have an account with CertComp, CertComp will deliver CertComp's written response by mail or electronically, at your option.

Any disclosures CertComp provides will only cover the 12-month period preceding the verifiable consumer request’s receipt. The response CertComp provides will also explain the reasons CertComp cannot comply with a request, if applicable. For data portability requests, CertComp will select a format to provide your Personal Information that is readily usable and should allow you to transmit the Information from one entity to another entity.

CertComp does not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If CertComp determines that the request warrants a fee, CertComp will tell you why CertComp made that decision and provide you with a cost estimate before completing your request.

31.3.1 Changes to CertComp's CCPA privacy notice

CertComp reserves the right to amend this CCPA privacy notice at CertComp's discretion and at any time. When CertComp makes changes to this CCPA privacy notice, CertComp will notify you by email or through a notice on CertComp's website homepage.

31.3.2 Contact CertComp

When you contact CertComp regarding any of your rights under the CCPA, CertComp will verify your identity before CertComp provides any information. You may contact CertComp via email: privacy@CertComp.com or via the live chat available at https://CertComp.com

We do not discriminate against California residents who exercise their CCPA privacy rights.

AB 1584  is a California law that defines student and educational agencies rights regarding student records. CertComp complies with AB 1584 as described in this Privacy Policy and as applicable in CertComp's agreements with California Institution(s).

32. Legal basis for processing your Information

If you are a CertComp user or are visiting CertComp's Site(s) and are located in the European Economic Area ("EEA"), CertComp's legal basis for collecting and using the Personal Information described above will depend on the Personal Data concerned and the specific context in which CertComp collects it. When CertComp is a processor for an Institution, their privacy policy controls the processing of your Personal Data. CertComp encourages you to read your Institution’s privacy policy for a legal understanding of how, when, and why your Personal Data may be collected and how it is used.

32.1 When CertComp is a data controller

When CertComp is a controller, CertComp will normally collect Personal Information from you only where CertComp has your consent to do so for marketing purposes, to perform a contract, or where the processing is in CertComp's legitimate business interests for Site and CertComp's business operations purposes. Where legitimate interest is CertComp's lawful basis for processing, CertComp has conducted an assessment to balance the individual’s privacy rights against CertComp's legitimate need to process the Personal Information. In some cases, CertComp may also have a legal obligation to collect Personal Information from you.

Where CertComp is the controller, if you have questions about or need further information concerning the legal basis on which CertComp collects and uses your Personal Information, please contact us through one of CertComp's channels.

33. Canadian User Rights - FIPPA

CertComp makes every effort to cooperate with Institutions in the compliance with the Canadian Freedom of Information and Protection of Privacy Act ("FIPPA"), as well as all federal and provincial laws and regulations, including those related to privacy and anti-spam legislation.

FIPPA provides Canadian citizens with the right to access information under the control of institutions. The SaaS Agreement and the Terms of Service fully detail both CertComp’s and the Institution’s obligations in relation to the confidentiality of data. FIPPA compliance is predicated on the Parties’ compliance to these provisions. These Confidentiality Obligations can be found in the  Terms of Service.

34. EU-US and Swiss-US Privacy Shield frameworks

CertComp fully complies with the EU General Data Protection Regulation ("GDPR").

Our EU Representative:Under Article 27 of the GDPR, we have appointed an EU Representative to act as our data protection agent. Our nominated EU Representative is: Instant EU GDPR Representative Ltd. Adam Brogden contact@gdprlocal.com Tel +35315549700 INSTANT EU GDPR REPRESENTATIVE LTD Office 2, 12A Lower Main Street, Lucan Co. Dublin K78 X5P8 Ireland

Our UK Representative:Under Article 27 of the UK Data Privacy Act, we have appointed a UK Representative to act as our data protection agent. Our nominated UK Representative is: GDPR Local Ltd. Adam Brogden contact@gdprlocal.com Tel +44 1772 217800 1st Floor Front Suite 27-29 North Street, Brighton England BN1 1EB

Please Note: Privacy Shield has been invalidated by the Court of Justice of the European Union. CertComp is using Standard Contractual Clauses (“SCCs”) in addition to other mechanisms and implementing supplemental measures as applicable to better ensure that EU individuals’ Personal Data is subject to adequate protections.

CertComp participates in and has certified its compliance with the EU-US Privacy Shield Framework and the Swiss-US Privacy Shield Framework. Although this is no longer a valid data transfer mechanism in the EU, CertComp will continue to self-certify under Privacy Shield as it provides additional protections. CertComp is committed to subjecting all Personal Data received from European Union (EU) member countries and Switzerland, respectively, in reliance on each Privacy Shield Framework, to the Framework's applicable principles. To learn more about the Privacy Shield Frameworks, and to view CertComp's certification, visit  the US Department of Commerce's Privacy Shield website.

With respect to Personal Data received or transferred pursuant to the Privacy Shield frameworks, CertComp remains subject to the regulatory enforcement powers of the US Federal Trade Commission (for issues pertaining to Privacy Shield). In situations where public authorities make lawful requests for information, such as to meet national security or law enforcement requirements, CertComp may be required to disclose Personal Data.

If you have an unresolved privacy or data use concern that CertComp has not addressed satisfactorily, please contact CertComp's US-based, third-party dispute resolution provider:  Jams. This service is free of charge.

As more fully described on the Privacy Shield website, you may be entitled to invoke binding arbitration when other dispute resolution procedures have been exhausted.

If you remain dissatisfied, then you have the right to apply directly to your local data protection authority. You can find the list at: https://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm

35. European Economic Area (EEA) or Switzerland User Rights

When CertComp is a processor, you must contact your Institution regarding your Information and exercising any of your rights.

35.1 When CertComp is a data controller

If you are based in the EEA or Switzerland, you acknowledge that CertComp may transfer your Information (including Personal Data) to CertComp and CertComp’s facilities in the United States or elsewhere, including those of third parties as described in the “Business transfers” and “Third-party service providers” sections of this Privacy Policy. Please review CertComp's Site   Terms of Service  for more information regarding any other applicable data protections. When CertComp is a controller with respect to your Personal Data, such as for customer support, service, and other inquiries, and you are based in the EEA or Switzerland, you may have other rights as provided below:

35.1.1 Access

If you wish to access your Personal Data that CertComp collects, you can do so at any time through the Service or by contacting CertComp using the contact details provided at the bottom of this page.

35.1.2 Correction, update, or deletion

You can correct, update, or request deletion of your Personal Data through the Service-interface, or by contacting CertComp using the contact details provided at the bottom of this page.

35.1.3 Data protection authority

You have a right to raise questions or complaints with your local data protection authority at any time.

35.1.4 Right to object

You have the right to object, on grounds relating to your particular situation, at any time to the processing of your Personal Data by CertComp. If you have a right to object and you exercise this right, your Personal Data will no longer be processed for such purposes by CertComp. You may exercise this right without incurring any costs. 

35.1.5 Right to withdraw consent

You have the right to withdraw your consent for CertComp to process your Personal Data when your consent is the lawful basis for processing.

31.1.6 Right to restriction

You may have the right to restrict CertComp's processing of your Personal Data unless CertComp's processing is otherwise authorized by applicable law.

31.1.7 Right to data portability

You may have the right to receive the Personal Data that you have given CertComp, in a structured, commonly-used, and machine-readable format. You have the right to send that Personal Data to another controller if the processing is based on consent or on a contract and is carried out by automated means.

31.1.8 Marketing

For Institution-approved representatives, you have the right to opt-out of marketing communications CertComp sends you at any time. You can do this by clicking the "unsubscribe" link in the marketing email CertComp sent you or by contacting CertComp using one of the contact channels provided. If using the contact details please provide your:

• Full name
• Email address
• Any other relevant information that may be required to address your request Please note that such marketing opt-out does not impact any transaction or operation notices that CertComp may need to send you. Note that CertComp does not market to test takers. If you have any questions or comments about this Privacy Policy, please contact CertComp through one of CertComp's   contact channels.

36. Protecting your Information

For test-taker Information that CertComp processes for an Institution, CertComp implements Zero-Knowledge Encryption, which means only Institution-approved representatives can decrypt and review encrypted exam recordings.

37. Security

CertComp employs procedural and technical security measures that are reasonably designed to help protect CertComp's test takers’ Personal Information from loss, unauthorized access, disclosure, alteration, or destruction, which includes encryption and other security measures to help prevent unauthorized access to a test taker’s Personal Information. The data a test taker transmits as part of their use of the Institution Services ("Storage Data") is encrypted and CertComp does not have the decryption keys to decrypt or review test-taker Storage Data in its unencrypted form.

CertComp is committed to maintaining the security and confidentiality of test-taker Information.

Towards this end, CertComp takes the following actions: (a) CertComp limits employee access to test-taker information to only those employees and contractors who need the information to fulfill their job responsibilities; (b) CertComp conducts regular employee privacy and data security training and education; and (c) CertComp protects your Information with technical, contractual, administrative, and physical security safeguards in order to protect against unauthorized access, release, or use.

Institutions or their designated representatives may review security testing results, subject to confidentiality requirements, or conduct their own security audit of CertComp’s data security and storage practices, subject to mutual agreement. Written requests for inspection and testing can be made to security@CertComp.com.

Test-taker audio, video, and screen recordings and images are secured and processed through three layers of encryption:

• 1. The Zero-Knowledge Encryption layer is used when information is stored and is secured using AES-GCM.
• 2. Transmission into the datacenter is over TLSv1.2 / TLSv1.3 and, if the client supports it, CertComp uses Perfect Forward Secrecy (PFS).
• 3. All data centers are ISO 270001 certified, SOC 2 attested.

To learn more about CertComp’s approach to data security, please see CertComp's   Data Security page.

37.1 Security systems breach notification

37.1.1 As a data processor

CertComp will notify the Institution. The Institution is responsible for notifying its test takers.

37.1.2 As a data controller

If CertComp learns of a security systems breach, CertComp may attempt to notify you electronically. CertComp may post a notice on CertComp's Sites and/or Services if a security breach occurs. CertComp may also send an email at the email address provided. Depending on where you live, you may have a legal right to receive notice of a security breach in writing.

38. Data storage

CertComp stores test-taker Personal Information, including all audio, video, and screen recordings and images, which CertComp collects during the exam for the minimum amount of time required by the Institution or by applicable law.

The length and location of how and where data for operations is stored varies and is dependent on applicable law and the information itself.

Whether CertComp is acting as the data controller or the data processor all Personal Information is encrypted in transmission and at rest.

39. As a data processor

CertComp retains data as directed by an Institution related to the Services that CertComp provides to them.

CertComp retains test-taker De-Identified Data to track usage, allow CertComp to process billing for Institutions that are CertComp’s customers, and track global usage of CertComp’s Services. "De-Identified Data" (or pseudonymized) includes:

• A pseudonymous hash of the User ID
• A pseudonymous hash of the Exam ID
• A pseudonymous hash of the Course ID (when applicable)
• Approximate location where the exam was taken
• Exam attempt number
• Length of exam
• Date of exam
• Anonymous telemetry events

40. As a data controller

In situations when CertComp acts as a data controller, the Personal Information provided by an individual is dependent on the Services, Site(s), or third-party applications accessed by the individual.

50. Retention, location, data deletion, and destruction

When CertComp is the data processor, CertComp uses a third-party cloud provider for the storage of encrypted, collected data. Data is stored in data centers requested or chosen by the partnered Institution. Institutions can choose to store the data in a data center that is geographically relevant to their location or in another, potentially further away data center.

CertComp retains data only as directed by an Institution related to the Services that CertComp provides to them. CertComp will store and maintain Institutional data for up to 30 days after the termination of an applicable agreement, unless otherwise specified by the Institution or as required by applicable law. CertComp cannot and does not retain exam attempt recordings or chat transcripts for longer than required by the Institution or applicable law.

When CertComp is a processor for an Institution, CertComp will direct the test taker to contact their respective Institution with any requests related to their Personal Information.

When CertComp is a data controller, this data is stored in locations and for time frames dependent on the Services used or Site(s) and/or third-party application(s) accessed by the individual.

CertComp retains the previously described Information only for as long as needed for CertComp’s legitimate business purposes and as required by applicable laws, investigations, or other security matters.

US Test-Taker Payment Processing: Data is stored within the US by a third-party subprocessor headquartered in the US.

US Client Payment Processing: Data is stored within the US by a third-party subprocessor headquartered in the US.

US User and Client Support: Data is stored by a third-party subprocessor headquartered in the US and Europe.

EU Test-Taker Payment Processing: Data is stored by a third-party subprocessor headquartered in Ireland.

EU Client Payment Processing: Data is stored within Germany by a third-party subprocessor headquartered in Germany.

EU User and Client Support: Data is stored by a third-party subprocessor headquartered in the US and Europe.

Institution Assessment Platform Monitoring: Data is stored in Europe by a third-party subprocessor based in Europe.

When CertComp is the data controller, questions regarding data storage, recovery, and deletion should be directed through one of CertComp’s contact channels.