Privacy Notice & Terms of Use

Version 2024-07-01 · Effective date: 1 July 2024

Exceed-Exam ("we", "us", "our") operates this online examination and certification platform. This notice explains what personal data we collect, why we collect it, the legal bases we rely on, and the rights you have. It is written to comply with the EU General Data Protection Regulation (GDPR), Indonesia's Law on Personal Data Protection (Undang-Undang Pelindungan Data Pribadi / "UU PDP", 2022), and the Brunei Darussalam Personal Data Protection Order (PDPA, 2021).

1. Who is the controller

The data controller is Exceed-Exam. You can contact us through the platform's administrator for any privacy request, including access, correction, deletion, or withdrawal of consent.

2. What data we collect

• Account data: username, email address, and a hashed password.
• Activity & technical data: exam attempts, scores, certificates issued, login records, IP address, browser/device type, and user-agent string.
• Consent records: your acceptance of this notice, the version accepted, timestamp, and the IP address used at the time of consent.
• Marketing preference: only if you optionally opt in to product updates.

3. Why we process your data (purposes & legal bases)

• Providing the service (creating accounts, delivering exams, issuing certificates): performance of a contract — GDPR Art. 6(1)(b); UU PDP and Brunei PDPA equivalent "necessary to perform a contract".
• Security, authentication & preventing fraud: legitimate interests — GDPR Art. 6(1)(f); recognised under UU PDP and Brunei PDPA.
• Account & marketing communications: your consent — GDPR Art. 6(1)(a); UU PDP and Brunei PDPA both require consent for the collection and use of personal data (and for electronic marketing).
• Complying with legal obligations (e.g. retaining audit records): legal obligation — GDPR Art. 6(1)(c).

4. Your consent

When you create an account you must actively accept this Privacy Notice & Terms. Consent is recorded with a timestamp and IP address so we can demonstrate it was given (GDPR Art. 7(1)). You may withdraw consent at any time, without affecting the lawfulness of processing before withdrawal (GDPR Art. 7(3); UU PDP; Brunei PDPA). Withdrawal is available from your Privacy & Consent page.

5. Your rights

• Access to the personal data we hold about you.
• Correction of inaccurate or incomplete data.
• Erasure / deletion ("right to be forgotten"), subject to legal retention obligations.
• Withdraw consent at any time.
• Object to or restrict certain processing.
• Data portability, where applicable.

To exercise any right, contact the administrator via the platform. We respond within the timeframes required by law (generally one month under the GDPR).

6. Data retention

We keep your account and exam records for as long as your account is active and as needed to provide the service and meet legal/audit obligations. Consent and audit records are retained to demonstrate compliance. You may request deletion at any time.

7. International transfers

If data is processed or stored outside your country of residence, we apply appropriate safeguards consistent with GDPR Chapter V, UU PDP, and the Brunei PDPA.

8. Cookies & local storage

We use a session cookie strictly necessary to keep you logged in. We do not use advertising or cross-site tracking cookies.

9. Contact & complaints

For privacy questions or to exercise your rights, contact the platform administrator. Under applicable law you also have the right to lodge a complaint with your local supervisory authority (e.g. an EU Data Protection Authority, Indonesia's Kementerian Komunikasi dan Informatika, or Brunei's Authority for Info-communications Technology Industry).

By clicking "Register" and accepting this notice, you acknowledge that you have read and understood it and give your consent as described above.