1. Who we are
AQSCERT S.R.L. (“AQSCERT”, “we”) is the controller of your personal data. Company number: To be confirmed. Registered office: Registered office address to be confirmed. Contact our data protection lead at [email protected]. Our lead supervisory authority is the competent data protection supervisory authority of the member state of our registered office (to be confirmed).
2. Data we collect
- Identity and contact: name, name for certificates, email, phone, country, date of birth.
- Account and security: hashed password, two-factor settings, session and sign-in records, pseudonymised IP addresses.
- Examination: bookings, answers, scores, score reports, incident reports and, for online exams, proctoring data.
- Identity verification: images of your photo ID and the verification outcome.
- Certification: eligibility evidence, decisions, certificates, CPD records and status history.
- Financial: invoices and payment status. Card details are handled by Stripe; we never see or store full card numbers.
- Communications: enquiries, complaints, appeals and email delivery records.
We collect most data from you directly. Employers or partners may provide your name and email when inviting you or issuing a voucher.
3. Purposes and lawful bases
| Purpose | Lawful basis |
|---|---|
| Creating and managing your account | Contract (Art. 6(1)(b)) |
| Booking, delivering and marking examinations | Contract (Art. 6(1)(b)) |
| Verifying your identity and protecting exam integrity, including proctoring | Legitimate interests (Art. 6(1)(f)) — DPIA-001 and DPIA-002 |
| Eligibility review and certification decisions | Contract; legitimate interests in a reliable certification scheme |
| Publishing certificate verification (number, name, title, dates, status) | Legitimate interests of employers and the public in verifying credentials |
| Payments, invoicing and tax records | Contract; legal obligation (Art. 6(1)(c)) |
| Service emails (bookings, results, expiry reminders) | Contract; legitimate interests |
| Marketing emails | Consent (Art. 6(1)(a)) — withdraw any time |
| Complaints, appeals and malpractice investigations | Legitimate interests; legal claims |
| Sharing outcomes with your employer (corporate accounts) | Consent — DPIA-003 |
| Security logging and fraud prevention | Legitimate interests |
We do not make decisions about you based solely on automated processing. Every certification decision and every proctoring flag is reviewed by a person.
4. Special category data
If you request reasonable adjustments, you may give us health or disability information. We process it only to arrange adjustments, on the basis of your explicit consent (Art. 9(2)(a)), restrict access to trained staff, and delete it when no longer needed. You can withdraw consent, although we may then be unable to provide the adjustment.
5. Remote proctoring
Online exams are supervised by an external proctoring provider acting as our processor. It records webcam video, audio and your screen during the exam, and images of your ID and room at check-in. We do not use biometric identification or emotion analysis by default. Recordings are normally deleted after three months. Remote proctoring is optional: you can choose a test-centre exam instead.
6. Sharing and processors
We share data with service providers who process it on our behalf under written data processing agreements, with your employer only where you have consented, with anyone using our public verification service (limited to certificate details), and with authorities where the law requires. We never sell personal data.
| Processor | Service | Location | Transfer safeguard |
|---|---|---|---|
| Stripe Payments Europe Ltd | Payment processing | Ireland / United States | EU Standard Contractual Clauses |
| Resend | Transactional email delivery | United States | EU Standard Contractual Clauses / EU–US Data Privacy Framework |
| S3-compatible storage provider | Certificates, ID documents (encrypted), documents | European Union (to be confirmed) | No transfer outside the EEA |
| Remote proctoring provider (to be appointed) | Online exam invigilation | To be confirmed | EU adequacy decision or Standard Contractual Clauses, after transfer impact assessment |
7. International transfers
Where data is transferred outside the European Economic Area, we rely on European Commission adequacy decisions or the EU Standard Contractual Clauses, supported by a transfer impact assessment. Contact us for a copy of the relevant safeguards.
8. Retention
| Data | Retention period |
|---|---|
| Certification records (certificate number, holder name, dates, status) | 10 years after expiry or withdrawal, then anonymised |
| Examination responses and results | 6 years after result confirmation |
| Identity verification documents | 6 months after the verification decision |
| Remote proctoring recordings (held by processor) | 3 months, unless under investigation or appeal |
| Payment and invoice records | 6 years after the end of the financial year |
| Complaints and appeals | 6 years after case closure |
| Audit logs | 7 years |
| Inactive candidate accounts with no certificates | 3 years after last sign-in |
| Marketing preferences | 2 years after consent withdrawal or last interaction |
9. Security
We use encryption in transit and at rest, additional field-level encryption for sensitive data, Argon2id password hashing, mandatory two-factor authentication for staff, role-based access and tamper-evident audit logs.
10. Your rights
Under the GDPR you have the right to:
- access your data and receive a copy (subject access);
- data portability — a machine-readable copy;
- rectification of inaccurate data;
- erasure, where there is no overriding reason for us to keep the data;
- restrict or object to processing, including objecting to processing based on legitimate interests;
- withdraw consent at any time, without affecting earlier processing.
Self-service: signed-in candidates can download a data export and request erasure from the Privacy section of the dashboard. You can also email [email protected]. We respond within one month, which may be extended by two further months for complex requests. We may need to verify your identity first.
11. Cookies
We use only a strictly necessary session cookie and store your colour-theme preference in your browser. See the cookie policy.
12. Complaints to a supervisory authority
Please contact us first so we can try to help. You also have the right to complain to the competent data protection supervisory authority of the member state of our registered office (to be confirmed), or of the EU member state where you live or work, or where an alleged infringement took place.
13. Changes to this notice
We will post any changes here and, for significant changes, notify account holders by email.