Privacy Policy

The short version

We keep tracking on this website to a minimum. We use Google Analytics to understand how the site is used. It runs by default when you open the site, but you can opt out at any time on our cookie banner or with the Cookie settings link in the footer, and we will stop collecting your usage data. We run no advertising pixels, and our fonts are served from our own domain.

The "Request a demo" page also runs Cloudflare Turnstile, a privacy-preserving bot check, so the form is not flooded with spam. The only personal information we actively collect is what you deliberately type into that form. You can change your analytics choice at any time using the Cookie settings link in the footer.

Who is responsible for your data

CandidatesPrep is the data controller for personal data collected through this website. We are based at 2nd Floor, 1/1 3P PECHS Block 6, Nursery, Karachi 75400, Pakistan.

If you have any question about this policy, or want to exercise any of the rights below, email privacy@candidatesprep.com.

What we collect

When you submit the demo form, we receive exactly the fields you fill in: your name, your email address, and optionally the number of candidates or users you test, how many exams you run per month, your exam environment (proctored, unproctored, both, or undecided), and your preferred call slot.

We do not ask for, and the form cannot send, payment details, government identifiers, or candidate data.

Why we collect it

Solely to respond to your demo request: to contact you, arrange the call, and prepare a plan sized to the numbers you gave us. We do not sell it, rent it, or share it for marketing.

Our legal basis for using it (UK/EU GDPR)

Where GDPR applies, we rely on two bases. When you submit the demo form, we process your details to take steps at your request prior to entering into a contract (Article 6(1)(b)): you asked us for a demo, and we need your details to give you one.

For keeping this site secure and available, and for measuring how it is used with Google Analytics, we rely on legitimate interests (Article 6(1)(f)): our interest in protecting and improving the site, balanced against your privacy. You can opt out of the analytics at any time on the cookie banner or with the Cookie settings link in the footer, and we will stop.

We do not collect special category data through this website, and we do not use your data for automated decision-making or profiling.

Cookies

Google Analytics sets first-party cookies (such as _ga) to measure how the site is used, and these are set when you open the site. If you opt out on the cookie banner or with the Cookie settings link in the footer, we stop the analytics and no further analytics cookies are set.

Our hosting provider, Cloudflare, may set strictly necessary security cookies (for example bot-management) to protect the site from attack. Cloudflare Turnstile, on the demo page, may likewise set a strictly necessary cookie solely to run its bot check. Under the ePrivacy rules these are exempt from consent because they are essential to deliver a service you requested, and they are not used to profile you or track you across sites.

The exam simulator stores your practice progress, meaning your answers, flags, and remaining time, in your own browser's local storage under the key "cp_trainer_exam". That is not a cookie, it never leaves your device, and it is never sent to us. Clearing your browser storage deletes it.

Who else processes your data

Resend delivers the demo-request email to our sales inbox. Your form submission passes through their infrastructure.

Cloudflare hosts and serves this site. Like any web host, it processes standard request data such as IP address and user agent in its logs to deliver and secure the site.

Cloudflare Turnstile: on the "Request a demo" page only, we use Cloudflare's Turnstile bot-protection service. When that page loads, your browser fetches a small script from Cloudflare, and when you submit the form Turnstile runs a lightweight check and processes limited technical signals (such as your IP address and browser characteristics) to confirm you are a person and not a bot. Turnstile is designed to be privacy-preserving: it does not use your data for advertising and does not track you across other websites.

Google Analytics (Google LLC): it receives usage data such as the pages you view, your approximate location derived from your IP address, and your device and browser type, to give us aggregate statistics about how the site is used. This runs by default when you open the site, and stops if you opt out.

Aside from Google Analytics, and Turnstile on the demo page, no other third party is contacted just by opening a page.

International transfers

We are based in Pakistan, and our processors (Resend and Cloudflare) operate infrastructure in the United States and elsewhere. If you are in the UK or EEA, your personal data will therefore be transferred outside your home jurisdiction.

Where such a transfer happens, we rely on appropriate safeguards for that transfer, including the Standard Contractual Clauses adopted by the European Commission where they apply, and we keep the data transferred to the minimum needed to answer your enquiry.

How long we keep it

Demo-request emails live in our sales inbox. We keep them only as long as needed to respond and, if you become a customer, to service the relationship. If you ask us to delete your enquiry, we will.

The CandidatesPrep platform: whose data it is

Everything above is about this website. The CandidatesPrep platform itself, used at portal.candidatesprep.com, holds data that organizations put into it: their staff and student accounts, questions, exam results, course progress and proctoring records. For that data, the organization is the data controller and CandidatesPrep is its processor. We handle it only to provide the service, under the organization's agreement with us, and we never sell it or use it for marketing.

If you are a student or trainer and want to see, correct or delete your platform data, please ask the organization that gave you your account. We help them answer your request.

The CandidatesPrep platform: how long data is kept

Exam recordings and proctoring snapshots are kept for 5 days, or longer if the organization arranges it. They are stored in the organization's own storage account, or in ours where the organization uses our storage.

Exam results, course progress and other learning records stay in the platform while a student is active, so their history, progress and certificates stay available to them and to their organization.

Where archiving is switched on for an organization, a student who has not signed in, taken an exam or worked on a lesson for the organization's chosen period (6 months unless the organization changes it) is archived. The student and the organization's administrator are emailed 14 days beforehand, and any activity in that time cancels it.

When a student is archived, their results and learning records are removed from the live platform and packaged for the organization, which downloads them through a secure link in its portal. We keep our copy for 10 days after the organization downloads it, and for no more than 30 days if it is never downloaded; after that we delete it permanently. Identity photos and documents used for proctoring are deleted rather than included. The student's account stays on the organization's roster, marked as archived, and certificates they earned remain verifiable.

The organization can bring an archived student's history back at any time by uploading its copy in the portal. The copy is sealed, so a file that has been altered cannot be restored.

When an organization's agreement with us ends, it can ask for an export of its data within 30 days, after which the data is deleted.

The CandidatesPrep platform: the Zoom integration

Trainers and administrators can connect their own Zoom account to schedule live classes (see candidatesprep.com/zoom). When they do, we store their Zoom user ID, email address, display name and plan type, and the access and refresh tokens Zoom issues. The tokens are encrypted before they are stored, are used only to create, update, read and delete that person's own class meetings, and are never shared or shown to anyone.

For each meeting created, we keep its meeting ID, join link, passcode, title, start time and length, so the invited students can see and join it. We do not access recordings, chat, audio, video, screen shares or transcripts.

Disconnecting Zoom in CandidatesPrep, or removing CandidatesPrep from the Zoom account, deletes the stored tokens and Zoom account details immediately. Meetings already created stay in the person's Zoom account until they delete them there. Zoom's own handling of meeting data is covered by Zoom's privacy statement.

The CandidatesPrep platform: the Google Calendar and Google Meet integration

Trainers and administrators can connect their own Google account to schedule live classes as Google Meet sessions. When they do, Google asks them to allow three things: their basic Google identity, their email address, and creating, changing and deleting events on their Google Calendar. If they do not allow the calendar permission, CandidatesPrep refuses the connection and gives up the access straight away.

We store their Google account ID, email address, name and, for Google Workspace accounts, the Workspace domain, plus the access and refresh tokens Google issues. The tokens are encrypted before they are stored, are used only to create, change and delete the calendar events for that person's own live classes (each with a Google Meet link), and are never shared or shown to anyone. We never read, list or change any other event in their calendar, and we do not access recordings, chat, audio, video or transcripts.

For each session we keep the event ID, the Meet link, title, start time and length, so the invited students can see and join it from CandidatesPrep. Students are not added to the calendar event: their names and email addresses are never sent to Google, and Google sends them no invitations.

Disconnecting Google in CandidatesPrep revokes our access at Google and deletes the stored tokens and Google account details immediately. People can also remove CandidatesPrep at any time from the third-party access page of their Google Account (myaccount.google.com/permissions), which stops our access at once. Events already created stay in their Google Calendar until they delete them there. Google's own handling of meeting data is covered by Google's privacy policy.

CandidatesPrep's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We do not use Google user data to serve advertising, do not sell it, and do not use it to develop, improve or train generalized artificial intelligence or machine learning models. People at CandidatesPrep do not read it, except with the person's agreement to fix a problem they asked us to help with, where needed for security, or to comply with the law.

Your rights under GDPR

If the UK or EU GDPR applies to you, you have the right to be informed about how your data is used (this page), and the right of access, to obtain a copy of the personal data we hold about you.

You have the right to rectification if anything we hold is inaccurate, and the right to erasure, to have your enquiry deleted from our records.

You have the right to restrict processing, the right to object to processing carried out on the basis of legitimate interests, and the right to data portability, to receive the data you gave us in a structured, commonly used, machine-readable format.

Because we do not rely on consent for anything on this site, there is no consent for you to withdraw. And because we do not profile, there is no automated decision-making for you to contest.

To exercise any of these rights, email privacy@candidatesprep.com. We will respond within one month, as GDPR requires, and we will not charge you for it.

Complaints

If you think we have handled your data improperly, please tell us first, as we would rather fix it. You also have the right to complain directly to a supervisory authority: in the UK, the Information Commissioner's Office (ico.org.uk); in the EEA, the data protection authority of the country where you live or work.

Data security

This site is served only over HTTPS. The demo form is transmitted over an encrypted connection, and the credentials used to send it are held server-side and are never exposed to your browser. We keep the data we collect to the minimum needed to answer your enquiry.

Children

This website is aimed at trainers and training organizations, not children, and we do not knowingly collect personal data from children through it.

Changes to this policy

If we change how this site handles personal data, we will update this page and the effective date above.

Contact

Questions about this page? Email privacy@candidatesprep.com, message us on WhatsApp 0303-2263777, or write to us at CandidatesPrep, 2nd Floor, 1/1 3P PECHS Block 6, Nursery, Karachi 75400, Pakistan.