Privacy Policy

3.1 Data You Provide.

Representatives and Authorised Users supply names, work email addresses, telephone numbers, job titles, location details, a profile image, the name and address of the Organisation, tax registration details where invoices require them, and the credentials that protect their Accounts. Organisations upload Customer Content, which can include rosters with Candidate names, email addresses, enrolment or roll numbers, and class or department. Persons who contact the Company provide the content of their messages, and persons who subscribe to the newsletter provide an email address.

3.2 Assessment Data.

When a Candidate sits an assessment, the Platform records the answers given, the scores awarded, the time spent on each question, comparative rankings, topic-level performance, certificate details where a certificate is issued, and the markings and comments entered by an evaluator.

3.3 Proctoring Data.

If the Organisation has enabled a proctoring feature, the Platform processes the activity captured by the webcam, including the output of face detection that indicates how many faces are visible and signals that describe the direction of eye movement, together with device activity such as browser and tab events, the events that Browser Lockdown blocks, and the alerts raised by chit detection. The webcam activity and the device activity are analysed in real time as the session proceeds, and the Company does not record or store them as video or audio files. The signals and alerts that the analysis produces are kept with the Assessment Data of the attempt concerned and are retained as stated in section 10. The Platform does not verify the identity of a Candidate by face matching, and it does not compare a facial image with a stored image or template.

3.4 Payment Data.

Payments are made through CCAvenue, PayPal, or Stripe. Card, bank, and wallet details are entered on the payment gateway’s own pages and are handled by the gateway. A user who chooses to save a debit or credit card for later payments, including renewals, does so with the gateway, which holds the instrument in tokenised form in line with the requirements of the Reserve Bank of India on the storage of card data; the Company does not store the full card number. The Company receives the transaction status, a reference number, the amount, the date, the plan purchased, and the billing name and address that it needs to issue invoices and keep accounts.

3.5 Sign-In Data.

Where a user signs in with Google or LinkedIn, the Company receives the information that the provider releases once the user approves the request. That ordinarily consists of the user’s name, email address, and profile picture, together with an identifier assigned by the provider. The Company does not receive the user’s password for those services.

3.6 Technical and Usage Data.

The Platform collects the internet protocol address, device type, operating system, browser type and version, language, time zone, the pages or screens viewed, the dates and times of access, error logs, and identifiers stored in cookies and similar technologies. Further detail appears in the Cookie Policy.

3.7 Document and Text Analysis.

The Platform sends text, images, and documents, such as written answers and uploaded files, to the Copyleaks application programming interface for analysis. Copyleaks returns results that assist the Organisation’s evaluators, including indications of textual similarity.

6.1 Optional and Controlled by the Organisation.

AI-based proctoring is optional. An Organisation enables it assessment by assessment, and a Candidate should receive from the Organisation, before the session starts, notice of what is monitored and why. The Platform requests the browser permissions that the monitoring requires, and a Candidate who declines them can discuss alternatives with the Organisation.

6.2 Human Involvement.

The Platform raises alerts and the Company does not itself take any decision about a Candidate. Article 22 of the GDPR gives an individual the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. The Terms and Conditions require the Organisation to have a competent person review any flagged event before an adverse step is taken, so that no sanction follows from an automated alert on its own. A Candidate who is the subject of an adverse decision should ask the Organisation for human review, an explanation, and the opportunity to contest it.

7.1 Account Holders.

The Platform is not offered to individuals under the age of eighteen (18) as account holders, and the Company does not knowingly open an Account for such a person. Where the Company learns that it has done so, it will close the Account and delete the associated data.

7.2 Candidates.

Schools and colleges may enrol Candidates who are under eighteen (18). Under section 2(f) of the Digital Personal Data Protection Act, 2023, a child is an individual who has not completed eighteen years of age, and section 9(1) requires a data fiduciary to obtain verifiable consent of a parent or lawful guardian before processing a child’s personal data. Section 9(3) prohibits tracking or behavioural monitoring of children. Rule 12 of the 2025 Rules, read with Part A of the Fourth Schedule, exempts an educational institution from those two sub-sections where the processing is restricted to tracking and behavioural monitoring for the educational activities of the institution or in the interests of the safety of its enrolled children. Whether that exemption is available is a question concerning the institution that acts as data fiduciary. The Company processes a child’s data only on that institution’s instructions, and the Terms and Conditions oblige the institution to have satisfied the applicable law, including parental consent, before it enrols the child.

8.1 No Sale of Personal Data.

The Company does not sell personal data and does not disclose it to third parties for their own marketing.

8.2 Organisations.

Assessment Data is made available to the Organisation that invited the Candidate and to the Authorised Users whom that Organisation has authorised. The Organisation decides who inside its own institution may see results and proctoring alerts.

8.3 Service Providers.

The Company shares personal data with providers that perform functions on its behalf and under contracts that restrict their use of the data. They are identified in the table below. The Company updates the table when it changes a provider, and clause 5.4 of the Terms and Conditions gives Organisations an opportunity to object.

8.4 Professional Advisers and Authorities.

The Company may disclose personal data to its legal, financial, and insurance advisers under duties of confidentiality, and to courts, regulators, and law-enforcement bodies where a lawful request or order requires it. In India such a request may be made, among other provisions, under section 69 of the Information Technology Act, 2000. The Company assesses each request and discloses no more than the law demands.

9.1 Where Data Is Held.

The Company is located in India and personal data is accessed from India. The cloud storage and the application servers of the production environment are hosted on Microsoft Azure in the United States, and the Company’s mail server is located in India. Personal data that the Company receives from the European Economic Area or the United Kingdom is therefore held in the United States as well as accessed from India, and sections 9.2, 9.3, and 9.5 describe the safeguards that apply. The Company will confirm the hosting region in an Order Form or on written request, and it will not move Assessment Data to a different region without giving the affected Organisation prior notice.

9.2 Transfers From the European Economic Area.

The transfer of personal data to a country outside the European Economic Area requires one of the mechanisms in Chapter V of the GDPR. India is not among the countries that the European Commission has recognised as ensuring an adequate level of protection, and the list is published at https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en . Transfers of personal data from the Organisation in the European Economic Area to the Company in India are therefore made under the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914, which the Company incorporates in the data processing agreement, supplemented by the technical and organisational measures described in section 12. A transfer to a United States recipient that participates in the EU-US Data Privacy Framework may also rely on Commission Implementing Decision (EU) 2023/1795 for as long as that decision remains in force. Article 46(1) of the GDPR makes these safeguards conditional on the availability of enforceable rights and effective remedies for data subjects, and the Company’s commitments are framed accordingly.

9.3 Transfers From the United Kingdom.

Personal data that originates in the United Kingdom and is transferred to the Company is covered by the International Data Transfer Agreement or by the International Data Transfer Addendum to the European Commission’s standard contractual clauses, as the parties elect.

9.4 Transfers From India.

Section 16 of the Digital Personal Data Protection Act, 2023 permits the transfer of personal data outside India except to a country or territory that the Central Government restricts by notification, and Rule 15 of the 2025 Rules makes a transfer subject to any requirement the Central Government specifies by order. Rule 7 of the SPDI Rules allows the transfer of sensitive personal data or information to a person in India or abroad that ensures the same level of data protection, where the transfer is necessary for the performance of a lawful contract or the individual has consented. The Company will follow any restriction or requirement notified under those provisions.

9.5 Sub-Processor Transfers.

Where a sub-processor is located in a different country from the Company, the Company concludes a written agreement with that sub-processor that imposes data protection obligations equivalent to those the Company owes to the Organisation.

10.1 Approach.

The Company does not set an automatic expiry date for Account records, Customer Content, or Assessment Data. Those records are kept for as long as the Organisation’s Account exists, and afterwards until deletion is requested in writing, because institutions routinely need to verify historical results, transcripts, and certificates long after an examination has been held. The Organisation, as controller, remains responsible for deciding how long it needs each record and for instructing the Company to delete data that is no longer required, and Article 5(1)(e) of the GDPR, which limits storage to the period necessary for the purpose, applies to the Organisation in respect of Candidates in the European Economic Area.

10.2 Proctoring Data.

The webcam feed and the device activity monitored by Browser Lockdown are analysed in real time, and the Company does not retain them as video or audio recordings. The alerts and event records that the analysis produces are retained with the Assessment Data of the attempt concerned until the Organisation or the individual asks for their deletion under section 10.3.

10.3 Deletion on Written Request.

An Organisation or an individual may request deletion by writing to dsar@ethition.com. The Company verifies the identity and authority of the requester, and, where the data is Assessment Data, it consults the Organisation that controls it. An approved deletion is completed within thirty (30) days, after which the data is removed from live systems and from backups when those are overwritten in the ordinary course.

10.4 Records Kept for Longer.

Deletion is subject to retention that the law requires or permits. Invoices and transaction records are kept for the period that tax and company law prescribe. Rule 6(1)(e) and Rule 8(3) of the 2025 Rules, once in force, require a data fiduciary to retain specified logs and the associated personal data for a minimum of one year. The Directions issued by the Indian Computer Emergency Response Team on 28 April 2022 under section 70B(6) of the Information Technology Act, 2000 require service providers and bodies corporate to maintain logs of their information and communication technology systems securely within the Indian jurisdiction for a rolling period of 180 days. The Company retains data that is subject to a legal hold, a pending claim, or a regulatory inquiry until the matter ends.

10.5 Withdrawal of Consent and Erasure.

Section 8(7) of the Digital Personal Data Protection Act, 2023 requires a data fiduciary to erase personal data when consent is withdrawn or when the purpose is no longer served, unless retention is necessary for compliance with law. The Company applies that standard to the data for which it is the data fiduciary, and applies the Organisation’s instructions to the data it processes on the Organisation’s behalf.

11.1 Rights Under the GDPR and the UK GDPR.

An individual in the European Economic Area or the United Kingdom has the following rights, each subject to the conditions and exceptions that the law provides.

1. Access: The right to obtain confirmation that personal data is processed and a copy of it, with the information listed in Article 15.
2. Rectification: The right to have inaccurate data corrected and incomplete data completed (Article 16).
3. Erasure: The right to have personal data erased where one of the grounds in Article 17 applies.
4. Restriction: The right to restrict processing in the circumstances stated in Article 18.
5. Portability: The right to receive data that the individual has provided in a structured, commonly used, and machine-readable format and to transmit it to another controller (Article 20).
6. Objection: The right to object to processing based on legitimate interests, and at any time to processing for direct marketing (Article 21).
7. Withdrawal of consent: The right to withdraw consent at any time, without affecting the lawfulness of earlier processing (Article 7(3)).
8. Automated decisions: The right described in section 6.2 and in Article 22.

11.2 Rights Under the Indian Act.

A data principal has the right to obtain a summary of the personal data processed and the identities of the fiduciaries and processors with which it has been shared (section 11), to have personal data corrected, completed, updated, or erased (section 12), to have readily available means of grievance redressal (section 13), and to nominate another individual to exercise those rights in the event of death or incapacity (section 14). Rule 14(3) of the 2025 Rules requires a grievance to be answered within a reasonable period not exceeding ninety (90) days. Section 13(3) requires a data principal to use the grievance mechanism of the fiduciary before approaching the Data Protection Board of India.

11.3 How to Make a Request.

Requests concerning data for which the Company is the controller should be sent to dsar@ethition.com. The Company may ask for information needed to confirm identity and, for a request made through an agent, for evidence of the agent’s authority. Candidates who wish to exercise rights over Assessment Data should address the Organisation that invited them; where a Candidate writes to the Company instead, the Company will pass the request to the Organisation and inform the Candidate.

11.4 Timing and Cost.

The Company responds to a request without undue delay and in any case within one month of receipt, as Article 12(3) of the GDPR requires. That period may be extended by up to two further months where the request is complex or numerous, and the Company will explain the reasons for any extension. No fee is charged unless a request is manifestly unfounded or excessive.

11.5 Right to Complain.

An individual in the European Economic Area may lodge a complaint with the supervisory authority of the Member State of habitual residence, place of work, or the place of the alleged infringement; contact details of those authorities are published by the European Data Protection Board at https://www.edpb.europa.eu/about-edpb/about-edpb/members_en . An individual in the United Kingdom may complain to the Information Commission, which assumed the functions of the Information Commissioner on 30 September 2026. In India, a complaint may be made to the Data Protection Board of India once the Company’s grievance mechanism has been exhausted. The Company would appreciate the opportunity to address a concern before a complaint is lodged, but this does not limit any right.

12.1 Safeguards.

The Company applies technical and organisational measures that are designed to protect personal data against unauthorised access, alteration, disclosure, and loss. They include role-based access control that limits personnel and Authorised Users to the functions their role requires, logging and monitoring of access to personal data so that unauthorised access can be detected and investigated, data backups to support continued processing after a loss of access, and contractual security obligations imposed on service providers. The programme is designed to meet the standard of reasonable security practices in Rule 8 of the SPDI Rules and the safeguards listed in Rule 6 of the 2025 Rules, and to satisfy Article 32 of the GDPR.

12.2 Breach Handling.

The Company notifies the Organisation without undue delay after becoming aware of a breach that affects Assessment Data, as Article 33(2) of the GDPR requires of a processor. For breaches affecting data for which it is the controller, the Company notifies the competent supervisory authority within seventy-two (72) hours where Article 33(1) so requires, informs affected individuals where the risk is high, and will give the intimation to the Data Protection Board of India and to affected data principals that Rule 7 of the 2025 Rules prescribes once that Rule is in force. Cyber incidents of the kinds listed in the CERT-In Directions of 28 April 2022 are reported to the Indian Computer Emergency Response Team within six (6) hours of being noticed.

12.3 Limits.

No system is entirely free of risk, and transmission over the internet cannot be guaranteed secure. Users should choose strong passwords, keep them confidential, and notify the Company at once, at security@ethition.com, of any suspected compromise.

13.1 Grievance Officer.

In compliance with Rule 5(9) of the SPDI Rules, section 8(10) of the Digital Personal Data Protection Act, 2023, and Rule 9 of the 2025 Rules, the Company has appointed the following person to answer questions about processing and to receive grievances: Debipada Rath, Director, email debipada.rath@cordiia.in, telephone +91 97326 18930. The Grievance Officer acknowledges grievances promptly and redresses them within one month of receipt.

13.2 Data Protection Officer.

Article 37(1)(b) of the GDPR requires the designation of a data protection officer where the core activities of a controller or processor consist of processing operations that require regular and systematic monitoring of data subjects on a large scale. The Company has designated a Data Protection Officer, who may be contacted at dpo@ethition.com.

13.3 Representative in the European Union.

Article 27 of the GDPR requires a controller or processor that is not established in the Union, and to which Article 3(2) applies, to designate a representative in the Union unless the processing is occasional and unlikely to result in a risk to individuals. The Company’s representative is , who may be addressed in addition to or instead of the Company by supervisory authorities and data subjects.

13.4 Representative in the United Kingdom.

The Company’s representative in the United Kingdom for the purposes of Article 27 of the UK GDPR is

13.5 General Contact.

The Company can be contacted at privacy@ethition.com or by post at Cordiia Software Technologies Private Limited, No-850, Kamalpur, Balighai, Egra, Purba Medinipur, West Bengal, India 721422.