Privacy policy

This policy explains what personal data Publicert (publicert.com) collects, why, and what you can do about it. The business that runs Publicert is the controller of your data. It is named at the foot of every page, under “Operated by”, with its registered details and contact address. In this policy it is “we”.

1. What we collect

When you take a test. You do not need an account. We store your answers, your score and the language you took the test in. They are linked to a random identifier kept in a cookie (course_guest, 30 days), so that you can come back to your test and your result on the same device. A second cookie, recent_test (24 hours), contains no identifier. It only tells the site to check whether you have an unfinished test or a certificate not yet collected, so that it can remind you.

When you tell us why you are leaving. On the test and result pages we may ask how it went and why you are leaving. Every answer is optional. We store your rating, the reason you choose and any comment, with how long you spent on the page and how many questions you had answered. If you give your e-mail address, we send you one e-mail with a link back to your test or your result. If you also tick the box, we may send you reminders and offers. You can withdraw that consent at any time by writing to the contact address at the foot of every page. Even if you answer nothing, your browser tells us when you leave one of these pages, with the same page details and no contact details.

When you buy a certificate. We store the name you want printed on it, your e-mail address, the certificate number, your score and the dates of issue and refresher. Stripe processes the payment. We receive confirmation of the payment and its amount, never the card number. If you open the payment form and do not finish paying, we send you one e-mail with a link back to your result.

When a business buys certificate codes. We store the company name, the e-mail address of the buyer and, for each code used, the certificate it was used for. The buyer's page of codes shows the name on each certificate issued with one of its codes.

When you contact us. We keep your messages and our replies.

When you visit the site. Like every website, our servers receive your IP address and your browser's details. We use them to deliver the pages, to keep the site secure (for example to limit repeated attempts) and to find errors. We also remember your language and light or dark theme in cookies. These cookies, and the session and security cookies the site needs to work, are described in our cookie policy.

2. Why we use it

• To run your test and show your result, which is the service you ask for (contract).
• To issue your certificate, send it to you and list it in the public register (contract).
• To take payments and keep accounting records (contract and legal obligation).
• To keep the site secure, prevent fraud such as cheating on tests and fix errors (our legitimate interests).
• To answer your questions (contract or legitimate interests).
• To learn why visitors leave a test or a result and to improve our courses (our legitimate interests).
• To send you the link back to your test that you asked for (your request) and, only if you ticked the box, reminders and offers (consent).

We do not sell your data. We do not use it for advertising, and we do not send marketing e-mails without your consent.

3. The public register

A certificate is meant to be checked by others. Anyone who has its number can see the holder's name, the course, the test score, the dates and whether it is valid. They cannot see your e-mail address. The register is not searchable by name. A certificate can be found only by its number.

4. Who receives your data

We use service providers who process data on our behalf and only on our instructions:

• Stripe, for card payments;
• an e-mail delivery provider, to send your certificate, receipts and the links you ask for;
• our hosting and network providers (including Cloudflare), who run the servers and protect the site;
• internal notification tools that tell our staff about new orders and errors.

Some of these providers are based outside the European Economic Area or the United Kingdom. Where that is the case, the transfer is protected by an adequacy decision or by the standard contractual clauses approved for this purpose.

We may disclose data where the law requires it, for example to a tax authority or a court.

5. How long we keep it

• Test attempts that did not lead to a certificate are deleted 12 months after they were started.
• Certificates are kept as long as they can be checked in the register, and afterwards as long as the law requires us to keep the records of the sale.
• Records of payments and orders are kept as long as accounting and tax law requires.
• Your answers to the question why you are leaving are deleted together with the test attempt they belong to. An e-mail address you give there is deleted after 30 days, or after 12 months if you agreed to receive reminders and offers.
• Unfinished, failed or cancelled orders are deleted after 60 days.
• Error records are deleted after 90 days.

6. Your rights

You have the right to ask us for a copy of your data, to have it corrected or deleted, to restrict or object to its use, and to receive the data you gave us in a portable form. You can object at any time to your certificate being shown in the public register. We will then remove it from the register, and it can no longer be checked. To use any of these rights, write to the contact address at the foot of every page. We may need to confirm that the request comes from you, for example by sending a reply to the e-mail address on the certificate.

If you think we have not handled your data properly, you can complain to the data protection authority of the country where you live or work, or where we are registered.

7. Changes

We will update this policy when what we do with data changes, and the version on this page always applies.