This policy explains what personal data EqasOnline Academy collects, why, who sees it, where it is kept, how long we keep it and what rights you have.
It covers academy.eqasonline.com: the course, the exam, the credential, the verify pages and your account. Other EqasOnline websites and products have their own policies.
1. Who we are
legal entity (to be confirmed), registered address (to be confirmed) ("EqasOnline", "we", "us") decides how and why your personal data is used.
- Under the EU and UK General Data Protection Regulation (GDPR), we are the controller.
- Under India's Digital Personal Data Protection Act, 2023 (DPDP Act), we are the Data Fiduciary and you are the Data Principal.
Contact us about privacy at contact email (to be confirmed). Our grievance officer is grievance officer (to be confirmed).
[[TBC: EU representative under GDPR Article 27, and UK representative, if required. Name and contact details.]]
2. What we collect
| Category | What it includes | Where it comes from |
|---|---|---|
| Profile | Your name and email address. [[TBC: list any other profile fields]] | You |
| Consents | That you accepted the terms and confirmed you are 18 or over. Each candidate agreement you accept. Whether you opted in to marketing email. The date and time of each | You |
| Course progress | Which lessons and practice checks you have completed [[TBC: confirm whether practice-check answers are stored]] | You, as you use the course |
| Exam attempts | Start and end times, your saved answers, your score, your pass or fail result and your domain bands | You and our scoring system |
| Integrity events | Focus loss, copy and paste events (not what you copied), IP addresses and browser changes during an attempt | Your browser, during an attempt |
| Credentials | Credential ID, your name as printed, issue and expiry dates, status and your digital badge | Our system, when you pass |
| Cases | What you send us in an appeal, complaint, accommodation request, name change request or data request, and our replies | You and us |
| Sign-in | The one-time codes we email you and the session cookie that keeps you signed in | Our system |
| Performance monitoring | Anonymous data about page speed and errors, and the type of browser and device. It does not include your name, email address or account | Your browser, unless it sends a Global Privacy Control or Do Not Track signal |
We do not use your camera or microphone. We do not record your screen or your keystrokes.
Accommodation requests may include information about your health. Only send what we need to understand your request. You do not have to tell us a diagnosis.
3. Why we use it
| Purpose | Data used | GDPR legal basis |
|---|---|---|
| Create and run your account, and sign you in | Profile, sign-in, consents | Contract: we need it to provide the Academy to you |
| Provide the course and track your progress | Profile, course progress | Contract |
| Deliver and score the exam, and show your result | Exam attempts | Contract |
| Issue your credential and keep its verify page and badge working | Credentials | Contract |
| Protect the exam from cheating and review flagged attempts | Integrity events, exam attempts | Legitimate interests: keeping the credential meaningful for every holder |
| Check that questions are fair and set the pass mark | Exam attempts, without names | Legitimate interests: running a fair exam |
| Handle appeals, complaints and other requests | Cases and the records they concern | Contract, and legitimate interests |
| Consider accommodation requests that include health information | Cases | Your explicit consent |
| Keep the site fast and fix errors | Performance monitoring | Legitimate interests: running a reliable service |
| Send you marketing email | Profile | Your consent, through a separate opt-in |
| Meet legal obligations and deal with legal claims | Any data we hold, as needed | Legal obligation, and legitimate interests |
Where we rely on legitimate interests, we have weighed our interests against yours. You can object (see section 9).
Automated decisions
We score exams automatically. This decides whether you pass. If you disagree with your result, you can appeal and a person will review it.
Our integrity checks flag some attempts automatically. A flag alone never leads to a decision. A person reviews every flagged attempt before we decide anything.
4. India: consent and legitimate uses
If you are in India, we process your personal data with your consent, or for a legitimate use allowed by the DPDP Act.
You give consent when you create your account, and again each time you accept the candidate agreement. Marketing email has its own separate consent. We show you a notice of what we collect and why before we ask for consent.
You can withdraw consent at any time, as easily as you gave it. Withdrawing consent does not affect processing that took place before. If you withdraw consent that we need to run your account, we will close your account as described in section 8.
5. Who we share it with
Anyone who checks your credential. If you share your credential ID or badge, anyone can see its verify page. The verify page shows the credential ID, your name as printed, the credential name, the issue and expiry dates and the status. It does not show your email address, your score or your domain bands. We do not offer a search by name, and we ask search engines not to index verify pages.
Our service providers. They process data for us under contract and only on our instructions:
| Provider | What they do | Where |
|---|---|---|
| Amazon Web Services | Hosts the Academy | United States (us-east-1) |
| MongoDB (Atlas) | Hosts our database | India (Mumbai) |
| Amazon Web Services (WorkMail) | Sends and receives our email | [[TBC: WorkMail region]] |
[[TBC: confirm where performance monitoring data is stored, and list any other provider.]]
Others, only when needed. We may share data with professional advisers, with authorities when the law requires it, or to establish or defend legal claims.
We do not sell your personal data. We do not use it for advertising.
6. International transfers
Our servers are in the United States. Our database is in India. This means your data may be processed outside the country where you live.
If you are in the European Economic Area or the United Kingdom, these countries are outside it. We protect these transfers with [[TBC: transfer mechanism, for example Standard Contractual Clauses]]. Contact us for a copy of the safeguards.
If you are in India, your data is stored in India and may also be processed in the United States.
7. How long we keep it
| Data | How long |
|---|---|
| Profile, consents and course progress | While your account is open |
| Accounts with no credential | Deleted after 3 years without a sign-in. We email you 30 days before |
| Exam attempts | While your account is open [[TBC: confirm]] |
| Raw integrity events | 2 years from the attempt |
| Credentials | While your account is open. After you delete your account, see section 8 |
| Cases | [[TBC: retention period]] |
| Performance monitoring data | [[TBC: retention period]] |
| Server and security logs | [[TBC: retention period]] |
| Marketing opt-out | We keep your email address on a do-not-contact list so that we respect your choice |
We may keep data longer if the law requires it or if we need it for an open appeal, complaint or legal claim.
8. Deleting your account
You can delete your account from your account settings, or ask us at contact email (to be confirmed).
If you hold a credential, you choose what happens to it:
- Keep it verifiable. We keep only the credential ID, your name as printed, the dates and the status, so that the verify page keeps working.
- Mark it withdrawn. We keep only the credential ID and the status "Withdrawn".
We delete the rest of your data, except where we must keep it:
- to finish an open appeal, complaint or misconduct review,
- to apply a 12-month bar from new attempts, until it ends, or
- to meet a legal obligation.
Badge files you have already downloaded or shared are outside our control.
9. Your rights
Everyone
You can ask us to:
- tell you what personal data we hold about you and give you a copy,
- correct or complete it,
- delete it,
- stop sending you marketing email, at any time.
Use the data request form in your account, or email contact email (to be confirmed). We may ask you to confirm your identity first. We aim to reply within 30 days. We do not charge for this.
If GDPR applies to you
You also have the right to:
- restrict how we use your data,
- object to processing based on legitimate interests,
- receive your data in a portable format,
- withdraw consent at any time,
- ask a person to review an automated decision, and
- complain to a data protection supervisory authority, for example in the country where you live or work.
If the DPDP Act applies to you
You also have the right to:
- get a summary of your personal data and how we process it, and the identities of others we have shared it with,
- have your data corrected, completed, updated or erased,
- have your grievances handled by our grievance officer, grievance officer (to be confirmed), and
- nominate another person to exercise your rights if you die or become unable to do so.
If you are not satisfied with how we handle your grievance, you can complain to the Data Protection Board of India.
The DPDP Act also asks you to give accurate information and not to impersonate anyone. Our candidate rules ask the same.
10. Marketing email
We send marketing email only if you opt in. The opt-in is separate from creating your account. Every marketing email has an unsubscribe link, and you can change your choice in your account settings.
We send service emails whether or not you opt in. These include sign-in codes, results, case updates, reminders about your credential's expiry and notices before we delete an inactive account.
11. Cookies
We use one cookie, to keep you signed in. We do not use tracking or advertising cookies. See the Cookie policy.
12. Security
[[TBC: short, accurate summary of security measures for the Academy.]]
If a personal data breach affects you, we will tell you and the relevant authorities as the law requires.
13. Age
The Academy is for people aged 18 or over. We do not knowingly collect data from anyone younger. If you think a child has created an account, email contact email (to be confirmed) and we will delete it.
14. Changes to this policy
We may update this policy. We publish each version with its date. If a change materially affects you, we email you before it takes effect.
15. Contact
legal entity (to be confirmed) registered address (to be confirmed) Privacy questions: contact email (to be confirmed) Grievance officer: grievance officer (to be confirmed)