Privacy Policy

1. Information We Collect

To provide secure, verifiable examinations and maintain official certification records, we collect the following categories of data:

• Account Identification: Legal full name, email address, certificate display name, password hash (Argon2id/Bcrypt), and OAuth profile identifiers (Google, GitHub) when social sign-in is utilized.
• Assessment & Telemetry Data: Question option selections, response timestamps, time remaining, window focus loss counts (tab switches), client IP address, and browser User-Agent strings to verify proctoring integrity.
• Certification & Registry Records: Issued certificate numbers, scorecard identifiers, exam versions, pass/fail status, topic mastery breakdowns, and cryptographic SHA-256 PDF document hashes.
• Transaction & Invoicing Data: Order reference numbers, gross transaction amounts, currency, applied coupons, billing addresses (if provided for commercial tax receipts), and gateway transaction IDs.

2. Lawful Basis for Processing (GDPR Compliance)

We process personal data under the following legal bases pursuant to Article 6 of the General Data Protection Regulation (GDPR):

• Performance of Contract: Administering examinations, calculating objective scores, issuing digital credentials, and fulfilling purchased packages;
• Legitimate Interests: Preventing examination fraud, securing platform infrastructure, verifying candidate identity against certificate duplication, and maintaining anti-cheat audit trails;
• Legal Obligation: Retaining financial transaction records for tax compliance and accounting audits;
• Consent: Sending voluntary email updates and newsletter digests (with one-click unsubscribe links).

3. Public Registry & Identity Protection (Anti-Scraping Token Gating)

A core benefit of IECC certification is independent third-party employability verification. When a candidate shares their credential URL (e.g. iecc.digital/verify/{cert_no}?token={verify_token}) or Open Badges assertion, third-party employers can confirm validity, holder name, syllabus version, and cryptographic hash.

To prevent automated scraping, mass data harvesting, and unauthorized enumeration of candidate names, lookups performed without a valid verification token or direct session authorization will automatically display masked candidate identities (e.g. J**** D****) while confirming certification status and curriculum validity.

4. Data Sharing & Trusted Subprocessors

IECC does not sell candidate data. We share necessary data strictly with trusted service providers operating under strict data processing agreements:

• Payment Gateways & MoR: Creem Payments, Wise, Mercury Bank, and Payoneer for secure financial settlement;
• Bot Protection: Cloudflare Turnstile for CAPTCHA-free bot and brute-force mitigation;
• Transactional Email: SMTP gateways for delivering scorecards, official PDF credentials, and login notices;
• Cloud Infrastructure: High-availability servers and encrypted private storage for credential persistence.

5. Data Retention & Archival Schedules

We maintain data in accordance with institutional accreditation standards:

• Active Credentials: Retained for the full 24-month validity lifespan and archived on the public registry thereafter. Long-term archival is necessary because credential verifiability is the core purpose of the service — employers must be able to confirm credentials years after issuance. If you exercise your right to erasure, your public registry entry is transitioned to a revoked/anonymized state rather than deleted outright, preserving the integrity of the verification record while removing personally identifying information;
• Exam Session Telemetry: Raw proctoring logs are retained for up to 180 days for academic integrity review, after which granular event logs are deleted or anonymized;
• Financial Records: Tax invoices and transaction metadata are retained for seven (7) years to satisfy statutory tax obligations.

6. Candidate Data Rights

Under international privacy regulations (including GDPR and CCPA), you have the right to:

• Access & Portability: Request a complete copy of your personal data and examination history;
• Rectification: Correct inaccurate legal names or account details in your candidate settings;
• Erasure ("Right to be Forgotten"): Request deletion of your candidate account and historical examination attempts, subject to statutory retention requirements for financial records;
• Opt-Out: Unsubscribe from marketing communications at any time via the one-click unsubscribe link in any broadcast email.

7. Data Security Safeguards

We implement defense-in-depth technical and organizational measures, including TLS 1.3 encryption in transit, AES-256 encrypted storage for private certificates, Argon2id password hashing, strict role-based access control (RBAC), and automated rate limiting.

Data breach notification: In the event of a personal data breach likely to result in risk to your rights, we will notify the competent supervisory authority within 72 hours of becoming aware of the breach (GDPR Art. 33) and will inform affected individuals without undue delay where the breach is likely to result in high risk (GDPR Art. 34).

8. Privacy Inquiries & Data Protection Office

To exercise your privacy rights or submit questions regarding our data practices, please email our Data Protection Office at privacy@iecc.digital or contact@iecc.digital.

EU/UK residents: You may also lodge a complaint with your local data protection supervisory authority. Where we transfer your personal data outside the European Economic Area or the United Kingdom, we rely on appropriate safeguards including the EU Standard Contractual Clauses (SCCs) and the UK International Data Transfer Agreement (IDTA) as applicable. We are in the process of designating an EU representative pursuant to GDPR Article 27; until such designation is complete, please direct EU data-protection inquiries to privacy@iecc.digital.