Privacy policy

ITDEVTECH Academy is operated by ITDEV (PRIVATE) LIMITED, trading as ITDEVTECH. We are the data controller for everything described here. Write to helpdesk@tikting.com about anything on this page — including the requests in clause 9, which we answer within 30 days.

Your account

Name, email address, and whether that address has been confirmed. Passwords are not stored — only an Argon2id hash, which cannot be reversed back into your password.

Your profile

Organisation, job title and country, if you enter them. Your name and organisation are printed on any certificate you earn, which is why we ask you to check them before an exam.

Your photograph, if you upload one

Optional, and yours to remove at any time from your profile. It is re-encoded on arrival, which discards the metadata a camera attaches — including, on a phone, the location the picture was taken. It is printed on any certificate you earn, and a copy is kept with that certificate for as long as the certificate itself. We do not publish it: it does not appear on the verification page, and nobody sees it unless you show them your certificate.

What you do on the course

Which lessons you open and complete, roughly how long you spend and how far you read, your quiz answers, and every readiness or certification attempt with its questions, your answers and your score.

Buying an exam seat

The invoice we raise, the billing details on it, and the payment reference once your bank transfer is confirmed. We never see or hold your card or bank credentials — you pay your bank, not us.

Technical records

The IP address and browser user-agent attached to each sign-in session, and ordinary server logs. These exist so a session can be recognised, rate-limited and revoked.

If you sign in with Google

Google tells us your name, email address and account identifier. We ask for nothing else and receive nothing else.

We do not ask for, and have no use for, special-category data — health, beliefs, and the rest. Please do not put any of it in a free-text field.

• To give you what you signed up for. An account, the course, your progress, the exam you bought and the certificate you earned. Without this data there is no product.
• Because a credential has to mean something. Attempt records, question randomisation and the technical records above are what stand behind a certificate and let us investigate a suspected fraud. Anyone relying on one of our certificates depends on this, and so does every honest learner who holds one.
• Because the law requires it. Invoices and the accounting records around them are kept for as long as tax law says, whatever else you ask us to delete.
• To nudge you back to an unfinished course. Study reminders are sent on this basis, and clause 5 explains how to stop them in one click.

The Academy sets one cookie: your sign-in session. It is httpOnly, so no script can read it; it is SameSite=Lax, so another site cannot make your browser use it; and it is served over HTTPS only in production. It lasts up to 30 days, or until you sign out.

There is no advertising cookie, no third-party tracker and no analytics product on this site. That is why you were not asked to accept anything: a strictly necessary cookie needs no consent, and we have nothing else to ask about. If we ever add analytics, this clause changes before the code does.

There are two kinds, and only one of them is optional.

• Service email — confirm your address, reset your password, your invoice, your exam seat, your certificate. These are part of the service and cannot be turned off while you have an account.
• Study reminders — an occasional nudge about a course you have started and not finished. New accounts are set to once a week; you can change or stop that at any time on your profile, or from the unsubscribe link in every one of them. We do not send them about a course you have finished, or while you are actively studying.

We do not send marketing email, and we never pass your address to anyone who does.

Certificate verification is public and deliberately so — a credential nobody can check is not a credential. Anyone holding a certificate serial can see the holder’s name, the credential, the issue and expiry dates and whether it is still valid. Nothing else about you is reachable from there, and the page cannot be searched by name.

We do not sell personal data and we do not share it for anyone else’s marketing. A small number of suppliers process it on our instructions:

• Our email provider, which delivers the messages in clause 5 and therefore sees your address and the content of those messages.
• Our hosting provider, on whose servers the application, the database and the certificate PDFs run.
• Google, but only if you choose to sign in with it.
• Our bank, which handles the transfer when you pay for an exam seat.

Some of these operate outside the country you are in. Where that involves a transfer that needs safeguards, we rely on the standard contractual terms those providers offer. We will also disclose data where a law or a court order requires it — and will tell you unless we are forbidden to.

• Account and progress — while your account is open, and for 12 months after you close it in case you come back.
• Exam attempts and certificates — for the life of the certificate plus six years. A certificate is valid for 2 years and people rely on being able to verify it; we cannot answer “is this genuine” about a record we have destroyed.
• Invoices — for the period tax law requires.
• Backups — a rolling 30 days, after which a deleted record is gone from those too.

You can ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, or object to it — and you can complain to your national data protection authority if you think we have got it wrong. Most of it you can simply do yourself:

• Correct it — your name, organisation, job title and country are yours to edit on your profile.
• Delete your photograph — one button on the same page, and the file is removed from our storage, not merely hidden. The copy printed on a certificate you have already been issued stays, for the reason in the paragraph below.
• Stop the reminders — one click, from any reminder or from your profile.
• Export or delete — email helpdesk@tikting.com and we will do it within 30 days.

One honest limit on deletion: closing your account does not destroy your exam attempts or any certificate you earned. We anonymise them instead — your name and contact details are removed and the assessment record stays, unlinked from you. A credential anyone could erase by deleting their account would be worthless to everyone who holds one, and the records that prove an exam was sat fairly have to outlive the account that sat it.

Passwords are hashed with Argon2id at OWASP-recommended parameters. Traffic is encrypted in transit. Every permission is checked on the server, never in your browser. Sign-in and exam endpoints are rate-limited, certificate PDFs are served through short-lived signed links, and the database is backed up nightly. No system is perfect; if one of ours is breached in a way that puts you at risk, we will tell you and the relevant authority within the deadlines the law sets.

The Academy is a professional certification for people who work with TIKTING. It is not intended for anyone under 16, and we do not knowingly hold data about children. If you believe we do, tell us and we will remove it.

When we change this document the date at the top changes with it. If a change materially affects what we do with data we already hold, we will email you about it rather than hoping you re-read the page.