Privacy and account

By the principle of data minimisation: we collect only what is needed to issue, protect and verify the credential. The privacy policy describes, item by item, what we keep, on which legal basis under the GDPR and the LGPD, who we share it with and for how long. In short: card details never pass through DPCert, we use no advertising cookies, we do not sell data, and each type of data has a retention period set out in the policy.

Your answers, the time spent on each question, the name you type for the certificate and technical integrity signals such as loss of focus and leaving the window, plus the country and IP address of the attempt. We collect no images, audio, identity documents or screen recordings. Raw exam session events are deleted after 180 days; the attempt summary and the credential remain, because they are the record that allows the result to be verified and challenged.

No. Scoring is automatic against the answer key, compared with the published pass mark, with no AI model involved. There is no AI proctoring either: integrity signals create flags for human review, and revoking a credential is always a decision made by a person, with a recorded reason. Where DPCert does use AI (for example, question drafts reviewed by people and the assistant on this FAQ), the AI use policy explains what is done and what happens to the data.

The data subject rights under the GDPR and the LGPD: access, rectification, erasure, portability, restriction, objection, information about sharing and withdrawal of consent where consent is the legal basis. Write to [email protected] from the address on your account. You can also complain to the data protection authority in your country. The privacy policy has the details and the response times.

Write to [email protected] from the address on the account and we delete your account, your attempts, your exam telemetry, your vouchers and your communication records. What cannot simply disappear is a credential already issued: whoever verified it must still be able to verify it, so the minimal credential record is kept. If it has to be withdrawn, that is a revocation, and it stays visible marked as revoked. Data the law requires us to keep, such as purchase tax records, follows the legal period.

To buy a paid exam, no. To sit any exam, including the RAIF, and receive the credential, yes: the credential belongs to an account, and that is where you download the certificate and follow your performance. You can create the account with email and password, or sign in with a Google account. A free exam (such as the RAIF during its Black Friday flash promotion) requires a confirmed email.

All in your account, without talking to anyone. Changing the email triggers a fresh confirmation to the new address. Changing the password ends every other open session and keeps only your current one. Remember that changing the account name does not alter a certificate already issued, because the printed name is frozen when the exam opens.

Turn on two-step verification in your account. It uses a standard authenticator app, such as the one on your phone, and starts asking for a six-digit code after your password. It is optional and starts switched off, but it is worth switching on: your account holds credentials other people rely on to trust you.

Write to [email protected] or use the form on the contact page, in English, Portuguese or Spanish. To get it resolved faster, say which certification it concerns and, if there is one, the voucher or credential code. Requests about your personal data go to [email protected].