Privacy, terms of use and refunds.

DPCert Global Institute ('DPCert', 'we') is the controller of the personal data described in this policy and operates the platform at dpcert.org. This policy meets the transparency duties of the EU General Data Protection Regulation (Regulation (EU) 2016/679, 'GDPR', Articles 13 and 14) and of the General Personal Data Protection Law (Law No. 13,709/2018, 'LGPD', Article 9). The full identification of the supplier is on the legal information page.

• Data protection officer (DPO, and 'encarregado' under Article 41 of the LGPD): [email protected]. This is the channel for every privacy matter, including communications from data protection authorities.
• Who this policy covers: candidates, credential holders, people who verify a credential, organisation buyers, partners, ambassadors, newsletter subscribers, users of the free tools and visitors to the site.

Before the detail, the commitments that the rest of this policy demonstrates:

• We do not sell personal data, and we do not share it for advertising.
• There are no advertising, analytics or third-party tracking cookies. The cookies we use are strictly necessary or remember a choice you made, which is why there is no cookie banner to click.
• There is no camera, microphone or screen recording during the exam. Integrity relies on objective signals, described below.
• Artificial intelligence never scores an exam, never decides on a credential and never decides on a revocation.
• Site measurement uses no cookies and does not store your IP address, with an identifier that changes every day.
• Your public profile and directory listing stay off until you turn them on.
• Every right in the GDPR and the LGPD can be exercised by email, free of charge, by anyone, wherever they live.

To create and protect your account, let you sign in, and keep your exams, vouchers and credentials in one place.

• Data: name, email, the password hash (never the readable password), the date your email was confirmed, the second-factor secret if you enable it, sessions (expiry, browser and source IP; the session code itself is never stored, only a hash of it), the computers you mark as trusted, and counters of sign-in attempts by email or IP.
• Legal basis: performance of a contract (GDPR Art. 6(1)(b); LGPD Art. 7, V) for the account; legitimate interests (GDPR Art. 6(1)(f); LGPD Art. 7, IX) for sessions, attempt limits and the administrative log, the interest being to keep accounts secure.
• Retention: account data for as long as the account exists. Sessions expire after 14 days (30 for administrator accounts) and the expired record is deleted; a trusted computer lasts 60 days; the second-factor step lasts 5 minutes; sign-in attempt counters (email and IP) are deleted after 30 days.
• Recipients and transfers: our hosting and network providers (see 'Who receives data'). When you ask for help, a DPCert administrator may view your account as you see it, without being able to act in it; every access of this kind is recorded in the administrative log.

Only if you choose 'Continue with Google'. It saves you a password; you can always use email and password instead.

• Data: the identifier Google returns for your account, your email and your name. We do not receive your Google password, your contacts or any other Google data.
• Legal basis: performance of a contract (GDPR Art. 6(1)(b); LGPD Art. 7, V), at your request.
• Retention: for as long as the account exists. A ten-minute cookie protects this flow against forgery.
• Recipients and transfers: Google acts as an independent controller for the sign-in itself, under its own privacy policy.

To deliver the certification exam you enrolled in, score it and show you the result. This includes the free exam path (such as the RAIF Black Friday flash promotion) and extended time.

• Data: the questions drawn for you, your answers and the time spent on each, the name you chose for the certificate, the overall and per-domain score, and the voucher used.
• Legal basis: performance of a contract (GDPR Art. 6(1)(b); LGPD Art. 7, V), including for the free exam.
• Retention: for as long as the account exists. Your per-domain result belongs to you: it appears only in your account and is never published.
• Recipients and transfers: the hosting provider only. An organisation that gave you a voucher sees only aggregate numbers (see 'Organisations, partners and ambassadors').
• Extended time: if you request it, we record only that you asked for 25% more time and the date of your declaration, never the condition behind it, and we do not ask for a medical report. Because the request may reveal a health condition, we treat this record as special-category data, process it with your explicit consent given when you tick the declaration (GDPR Art. 9(2)(a); LGPD Art. 11, I), and use it only to apply the extra time.

To protect the value of every credential, including yours, the platform records objective signals during the certification exam (not during free practice or the open assessment). There is no camera, microphone or screen recording.

• Data: the IP address and country the exam was opened from, the browser, a weak device signature (screen size, language, time zone and browser reduced to a short code, with no canvas, audio or WebGL fingerprinting), the time per question, leaving and returning to the exam window, attempts to copy or paste (which are blocked), and how many exams were opened from the same address or device within 24 hours.
• Legal basis: legitimate interests (GDPR Art. 6(1)(f); LGPD Art. 7, IX), the interest being the validity of credentials and fraud prevention. We have balanced this interest against your rights: the signals are minimal, you know about them before the exam, and none of them fails anyone on its own.
• Effects: exits of 3 seconds or more from the exam window are counted and shown on screen. From the 9th, if you pass, the credential is issued within 3 business days after review instead of immediately; on the 10th, the exam ends and is scored with the answers given so far. All other signals only create flags for human review.
• Retention: raw events are deleted after 180 days; the summary flags stay with the attempt for as long as the account exists. None of this appears on the certificate, the public verification page or the badge.
• Recipients and transfers: the hosting provider only.

A certification is only worth something if a third party can check it. When you pass, we issue a credential with a public verification code, a PDF certificate with a QR code and a signed Open Badges 3.0 digital badge.

• What the verification code shows to whoever has it: the holder’s name as printed on the certificate, the certification, the code, the issue date and the status (active or revoked). Scores and per-domain results are never public.
• Digital badge: issued and signed by our identifier did:web:www.dpcert.org. Instead of your email, it carries a salted hash of the address, which only confirms the email to someone who already knows it.
• Legal basis: performance of a contract (GDPR Art. 6(1)(b); LGPD Art. 7, V) for issuance; legitimate interests (GDPR Art. 6(1)(f); LGPD Art. 7, IX) for verification, the interest being that of employers and the public in checking credentials, and ours in preventing fake ones.
• Retention: the credential never expires. It remains verifiable until it is revoked or until you ask us to erase your account (see 'Erasing your account'). A revoked credential remains verifiable, marked as revoked.
• Recipients: whoever has the code. You decide whom to share it with.

Your public profile is off by default. If you turn it on in your account, a profile page with your credentials appears in the public directory, the site search and the sitemap, and can be found by search engines.

• Data shown while it is on: your name, your credentials and, if you fill them in, job title, location and LinkedIn.
• Legal basis: consent (GDPR Art. 6(1)(a); LGPD Art. 7, I), given by turning the profile on and withdrawn by turning it off, at any time.
• Retention: while it is on. Turned off, the profile leaves the directory, the search and the sitemap at once; search engines may take some time to drop old copies. Verification by code does not change.
• Social posts: only if you turn this separate option on, DPCert may celebrate a new credential on its social networks with your first name and a link to your public profile. It is off by default, and turning it off removes anything not yet published from the queue.

To sell paid certification exams and bundles, issue vouchers, process refunds and apply coupons. Payment takes place on the checkout page of Stripe, our payment processor: card details never reach DPCert.

• Data: the email given at checkout, the amount, currency and what was bought, the Stripe purchase identifier, the voucher codes issued and whether they were used, refunds, and the coupons you receive (second chance or open assessment discount) with the date of use. For an unfinished purchase, the email and the link to resume it.
• Legal basis: performance of a contract (GDPR Art. 6(1)(b); LGPD Art. 7, V); compliance with a legal obligation (GDPR Art. 6(1)(c); LGPD Art. 7, II) for tax and accounting records; legitimate interests (GDPR Art. 6(1)(f); LGPD Art. 7, IX) for the single reminder about an unfinished purchase, which is not sent to buyers in the European Economic Area, the United Kingdom or Switzerland.
• Retention: purchase and voucher records for as long as the account exists; unfinished purchase records are deleted after 90 days. Stripe keeps the transaction records the law requires it to keep, under its own policy.
• Recipients and transfers: Stripe, as processor for the checkout and as an independent controller for fraud prevention and its own legal duties. On the Stripe page, Stripe’s privacy policy and cookies apply.

When an organisation buys vouchers in bulk, when a training partner applies, or when a credential holder joins the ambassador programme.

• Organisations: the buyer’s name and email, the organisation name and the people invited to its dashboard. For each batch, the organisation sees how many codes were used and how many exams were completed and passed; the pass rate only appears with 5 or more completed exams, so that no individual result can be inferred. The organisation never sees your answers, your score or your integrity signals.
• Partners and ambassadors: the application data (name, email, organisation and website) and, for ambassadors, the referral code and the purchases attributed to it.
• Legal basis: performance of a contract (GDPR Art. 6(1)(b); LGPD Art. 7, V) with the organisation, partner or ambassador; legitimate interests (GDPR Art. 6(1)(f); LGPD Art. 7, IX) for informing the organisation about the use of what it bought.
• Retention: for as long as the relationship lasts, or until an erasure request. If the account of the person who bought a batch is erased, the batch stays with the organisation, without that person’s name and email.
• Recipients and transfers: the hosting and email providers, and Stripe for payment.

Three kinds of message, each with its own rule. We use no open-tracking pixel: links carry the campaign name, never yours, so we count visits per message without knowing who clicked.

• Transactional: voucher, receipt, result, password reset, email confirmation and security notices. They are part of the service and are always sent. Basis: performance of a contract (GDPR Art. 6(1)(b); LGPD Art. 7, V).
• Relational: the single reminder about an unfinished purchase, the reminder of an unused voucher, the second-chance coupon, the next-certification suggestion for holders, the testimonial request after an exam, the single invitation to the tools series and the monthly usage summary for batch buyers. Basis: legitimate interests (GDPR Art. 6(1)(f); LGPD Art. 7, IX), within a relationship you started, with one-click unsubscribe in every message.
• Newsletter and educational series: only with your consent (GDPR Art. 6(1)(a); LGPD Art. 7, I), confirmed through the link we send to your email (double opt-in) and withdrawable at any time through the unsubscribe link in every message. We keep proof of consent and of withdrawal.
• Suppression and records: addresses that bounce permanently or complain stop receiving anything beyond essential messages. For each message sent we keep the recipient, the subject and the date, not the content; messages waiting to be resent keep their content for up to 30 days, and sent ones leave the queue after 7 days. If you ask for erasure, we keep only a one-way fingerprint (SHA-256 hash) of your address, with no other data, so that we do not write to you again, until you create a new account or subscribe again.
• Retention and recipients: subscription and consent records until an erasure request (unsubscribing stops sending at once; 30 days later we delete the name and country of the subscription and keep only the address and the date you left, so that we never write to you again); the message log for as long as the account exists and, for people without an account, for 12 months. Messages go through our email delivery (SMTP) provider.

To answer what you write to us through the contact form or by email, route it to the right team and keep a record of the answer.

• Data: name, email, organisation and team size if you give them, the topic and the message.
• Legal basis: legitimate interests (GDPR Art. 6(1)(f); LGPD Art. 7, IX) in answering; performance of a contract (GDPR Art. 6(1)(b); LGPD Art. 7, V) when the message is about your purchase or exam; compliance with a legal obligation (GDPR Art. 6(1)(c); LGPD Art. 7, II) for requests about your rights.
• Retention: contact form messages are deleted after 24 months.
• Recipients and transfers: the hosting and email providers.

To know which pages help people decide and where a purchase is abandoned, we record events such as a visit to a certification page, the start of a checkout or the result of an open assessment. The design makes following a person impossible, not merely unlikely:

• No cookie, no browser storage, no URL parameter and no third-party analytics script.
• Your IP address is never stored. Each event carries the language, the country, the page and a visit identifier computed from the truncated IP address (with the last part removed) and the browser, using a secret key that changes every day. Visits on the same day can be counted; the same person cannot be followed from one day to the next, not even by us.
• Legal basis: legitimate interests (GDPR Art. 6(1)(f); LGPD Art. 7, IX) in improving the site. You can object by writing to [email protected].
• Retention: 24 months, then deleted. Recipient: the hosting provider only.

The free tools and the open assessments work without an account. What you type in a tool stays in the page address and in this browser’s storage, so your work is not lost on reload; it does not go to our server or to measurement. The exceptions only happen when you act:

• Create a link: we store the result (with no name or email) so that whoever has the link can open it. It is deleted 180 days after the last access and, at most, 365 days after it was created.
• Receive by email: we store your email and the result link, with two-step confirmation, and send a short series of emails on the topic, with one-click unsubscribe. Basis: consent (GDPR Art. 6(1)(a); LGPD Art. 7, I). Retention: an unconfirmed request is deleted after 30 days, and a confirmed one 24 months after the last email, or sooner on an erasure request; unsubscribing stops sending at once.
• Open assessment result: the per-domain result, linked to your account only if you are signed in, or to your email if you ask for the result by email. Basis: performance of a contract (GDPR Art. 6(1)(b); LGPD Art. 7, V), at your request. Retention: 24 months; after that the result is unlinked from your account and your email, its link stops working, and it remains only as an anonymous statistic.
• AI suggestion, when that feature is on: described in the next section.

Some features use a general-purpose language model, and only when they are switched on. The provider in use, if any, is listed among the recipients below. None of these features takes part in scoring exams, deciding on credentials or revoking them; the details are in our AI use policy.

• FAQ assistant: your question, after we remove detected emails, phone numbers, web addresses and personal names, is sent together with excerpts of the public FAQ, the candidate handbook and this policy. We do not store the question, and the assistant does not read your session or your account.
• Tool suggestions: the text you wrote, cleaned of the same identifiers, is sent to generate the suggestion. We store only the generated suggestion, linked to a code computed from the input, never the input itself, and delete it 90 days after it was last used.
• Testimonial triage: the text of a testimonial, cleaned the same way, is classified. The model can only hold a testimonial for human review, never publish one.
• Legal basis: legitimate interests (GDPR Art. 6(1)(f); LGPD Art. 7, IX) in offering these features; using them is optional.
• Provider terms: we only use providers under business terms that prohibit using the content sent to train models; requests are sent with storage switched off where the provider offers that option, and the provider may only keep them for a limited period to monitor abuse and security.

After an exam, we may ask how it went. Answering is optional.

• Data: the rating, the text, the job title and the name format you choose.
• Legal basis: consent (GDPR Art. 6(1)(a); LGPD Art. 7, I) for publication, given when you submit and withdrawable at any time, in which case the testimonial is taken down.
• Moderation: automatic rules decide what can be published; a testimonial rated 3 or lower is never published, and anything doubtful goes to human review.
• Retention: while it is published or until you ask for it to be taken down. The email on a testimonial request is deleted 12 months after the request.

To recover the platform after a failure and keep it running.

• Backups: encrypted copies of the database, which contain the data described in this policy. Off-site copies are kept for 30 days in storage with public access disabled; the platform’s own backup keeps the 10 most recent packages, encrypted with a key that only DPCert holds.
• Operational records: server errors (90 days) and scheduled job runs (180 days), written without personal data.
• Legal basis: legitimate interests (GDPR Art. 6(1)(f); LGPD Art. 7, IX) in the security and availability of the service, and the security duties of GDPR Article 32 and LGPD Article 46.
• Recipients and transfers: the hosting and backup storage providers.

The exam is scored automatically: each answer is compared with the answer key, with no partial credit, and the score is compared with the pass mark published for the certification. This is a decision based solely on automated processing, necessary for the contract (GDPR Art. 22(2)(a)), and you have the right to have it reviewed by a person (GDPR Art. 22(3); LGPD Art. 20).

• To request human review of a result, write to [email protected] from your account email. A person rechecks the scoring of your attempt and the integrity record, and answers in writing, with reasons.
• The automatic effects of window exits (deferral at the 9th and ending at the 10th) can also be reviewed by a person on request.
• All other integrity signals never decide anything on their own: they only flag the attempt for human review.
• We do not build profiles to target advertising or offers at you.

We do not sell personal data or share it for advertising. These are the categories of recipients, each limited to what its task needs and, when acting on our behalf, bound by a data processing agreement:

• Payments: Stripe, for cards and local payment methods such as Pix. Stripe also acts as an independent controller for fraud prevention and its own legal duties.
• Network, protection and delivery of the site: Cloudflare, through which every request passes, with the IP address and country of origin.
• Application and database hosting: a virtual server provider.
• Off-site backup storage: Cloudflare R2, with public access disabled.
• Email delivery: our email (SMTP) provider, which carries the address and content of messages.
• Sign-in with Google, only if you choose it: Google, as an independent controller.
• Professional advisers and authorities, only when the law requires it or to establish, exercise or defend legal claims in judicial, administrative or arbitral proceedings (LGPD Art. 7, VI; GDPR Art. 17(3)(e)).

DPCert serves candidates worldwide, and some of the recipients above process data in countries other than yours, including countries without an adequacy decision. Every transfer relies on a mechanism recognised by both laws:

• GDPR: an adequacy decision of the European Commission (Art. 45), including the EU-U.S. Data Privacy Framework for certified providers, or the standard contractual clauses adopted by the Commission (Art. 46(2)(c)), with supplementary measures where needed.
• LGPD: the standard contractual clauses approved by the ANPD (Art. 33, II, b, and Resolution CD/ANPD No. 19/2024), or another mechanism of Article 33.
• Encrypted connections all the way, and encrypted backups.
• To receive a copy of the safeguards for a specific transfer, write to [email protected].

Each period below is enforced by an automatic routine or by the rule described, and the text changes whenever the code changes:

• Raw exam integrity events: 180 days.
• Sign-in sessions: expire after 14 days (30 for administrators) and the expired record is deleted. Trusted computer: 60 days.
• Site measurement events: 24 months.
• Unfinished purchases: 90 days.
• Contact form messages: 24 months.
• Email sending queue: up to 30 days for failed messages and 7 days for sent ones.
• Tool result links: 180 days after the last access, 365 days at most.
• Error and job records, without personal data: 90 and 180 days.
• Backups: 30 days in off-site storage; the 10 most recent packages in the platform’s own backup.
• Account, attempts, results, vouchers, coupons, consents and message log: for as long as the account exists, until an erasure request.
• Credentials: they never expire; they remain verifiable until revocation or erasure of the account.
• Sign-in attempt counters (email and IP): 30 days.
• Message log for people without an account: 12 months.
• Requests for a result by email: 30 days if unconfirmed; 24 months without an email once confirmed.
• Open assessment results: 24 months linked to you; after that, only an anonymous statistic.
• Stored AI suggestions in the tools: 90 days without use.
• Email on testimonial requests: 12 months.
• Newsletter subscriptions: until an erasure request; unsubscribing stops all sending at once, and the name and country are deleted 30 days later.
• Sending suppression list and erasure record (only the SHA-256 hash of the email and the date): for as long as needed to honour them.

We use seven cookies, all first-party and all either strictly necessary for a service you asked for or storing a choice you made. They are therefore exempt from consent under the ePrivacy rules (Directive 2002/58/EC, Art. 5(3)), and there is no cookie banner. There are no analytics, advertising or third-party tracking cookies:

• Session: keeps you signed in; 14 days (30 for administrators).
• Language: remembers the language you chose; one year.
• Currency: created only if you pick another currency in the price selector; one year.
• Second factor: 5 minutes, only between the password and the authenticator code.
• Trusted computer: only if you tick 'Trust this computer'; 60 days.
• Google sign-in state: ten minutes; protects that flow against forgery.
• Support return: only for a DPCert administrator who opens the view of an account to help; returns them to their own account; eight hours.
• Browser storage: the free tools keep what you type in this browser’s local storage, which does not leave your device unless you create a link or ask for the result by email. Stripe’s checkout page is on Stripe’s domain and sets its own cookies, under Stripe’s policy.

Wherever you live, we grant everyone the rights of both laws:

• Confirmation and access: to know whether we process your data and to receive a copy (GDPR Art. 15; LGPD Art. 18, I and II).
• Rectification: to correct incomplete, inaccurate or outdated data (GDPR Art. 16; LGPD Art. 18, III). The name on an issued certificate is corrected through support.
• Erasure: to delete your data (GDPR Art. 17; LGPD Art. 18, IV and VI), with the effects described in 'Erasing your account'.
• Restriction, anonymisation and blocking: to limit processing while an issue is resolved, and to have unnecessary or excessive data anonymised or blocked (GDPR Art. 18; LGPD Art. 18, IV).
• Portability: to receive the data you gave us in a structured, machine-readable format (GDPR Art. 20; LGPD Art. 18, V).
• Objection: to object to processing based on legitimate interests, including measurement (GDPR Art. 21; LGPD Art. 18, § 2).
• Information: about whom we share data with, and about the possibility of not giving consent and its consequences (LGPD Art. 18, VII and VIII).
• Withdrawal of consent at any time, without affecting earlier processing (GDPR Art. 7(3); LGPD Art. 8, § 5, and Art. 18, IX).
• Review of automated decisions (GDPR Art. 22; LGPD Art. 20).
• Complaint to a data protection authority (GDPR Art. 77; LGPD Art. 18, § 1).

Write to [email protected], preferably from your account email. There is no charge.

• We acknowledge within 3 business days and answer in full within 15 days, inside the deadlines of both laws (LGPD Art. 19, II; GDPR Art. 12(3)). If a request is complex, we explain why within that time; under the GDPR, any extension never exceeds two further months.
• To protect you, we confirm your identity before acting. A reply from the account email is usually enough, and we never ask for more than that requires.
• If we decline a request, we explain why and how to complain to an authority.
• Much of this you control yourself in your account: profile visibility, social posts, professional details, the second factor and, through the unsubscribe link, emails.

Ask at [email protected], from your account email. Erasure is permanent and done in a single operation:

• We delete your account, sessions, attempts with answers and integrity data, vouchers linked to you, coupons, credentials, consent and message records, newsletter and assessment subscriptions, contact messages and any other record with your email.
• Credentials are deleted too: after erasure, the verification code answers that the credential was not found. If you want an employer to keep being able to verify it, consider turning your public profile off instead of erasing the account. A digital badge you already downloaded will show as revoked: its position on the public status list stays, with none of your data, marked as withdrawn.
• What remains, without identifying you: changes you made as a staff member stay, without the author’s name, and the administrative log keeps a masked address proving that the erasure was done. Stripe keeps the payment records the law requires it to keep. Organisation batches stay with the organisation, without your name or email. We also keep a record of the erasure with only a fingerprint (SHA-256 hash) of your email and the date, to apply it again if a backup is ever restored and so that we do not write to you again.
• Backups: erased data disappears as the copies rotate (30 days in off-site storage). If a copy ever has to be restored, erasures made after it are applied again before the platform goes back online.

You can complain to a data protection authority at any time. We would appreciate the chance to resolve the issue first at [email protected].

• ANPD (Autoridade Nacional de Proteção de Dados), for matters governed by the LGPD.
• In the European Economic Area, the supervisory authority of the Member State where you live, work or where the alleged infringement took place (GDPR Art. 77).
• Elsewhere, the data protection authority of your country.

We apply security measures appropriate to the risk (GDPR Art. 32; LGPD Art. 46):

• Passwords stored only as a slow, salted hash; session codes stored only as a hash.
• Limits on sign-in attempts, and a second factor available to every account (we recommend enabling it).
• Encrypted connections (HTTPS), encrypted backups, and access to administrative areas restricted and recorded.
• Personal data incidents that may create a risk to you are notified to the competent authority and, where required, to you, within the deadlines of the GDPR (Articles 33 and 34) and the LGPD (Article 48).

DPCert is intended for professionals aged 18 or over, or the age of majority where you live if that is higher. We do not knowingly collect data from younger people; if we learn that an account belongs to one, it is erased.

When the way we process data changes, this page changes first. Each version is dated and summarised at the end of the page, and a significant change affecting data you have already given us is communicated before it applies.

DPCert Global Institute ('DPCert', 'we') assesses knowledge in data protection and responsible AI through its own certification exams, designed with reference to ISO/IEC 17024, and issues credentials to those who pass. A credential attests the result of an exam, not employment, prior experience, professional licensing, membership of any organisation or the compliance of any organisation. DPCert is not accredited by, affiliated with or endorsed by any data protection authority or standards body. No course is required to take an exam, and no course guarantees a pass.

DPCert credentials are valid until revoked. There is no renewal, no continuing education requirement and no annual fee: you pay for the exam once, and the credential is yours.

The account is personal and non-transferable, and some obligations come with it:

• Use your real name. It is the name printed on the certificate and shown in public verification, and correcting it after issuance goes through support.
• One person, one account. Multiple accounts for the same person may be removed.
• Your password is your responsibility. If you suspect unauthorised access, change the password, which ends all other sessions, and tell support.

RAIF (Responsible AI Foundation) costs USD 100. As a Black Friday flash promotion, it is free during November 2026, until 30 November 2026 at 23:59 Brasília time. While an exam is free, enrolling in the free path gives you the right to one exam, under the same rules as any certification exam:

• If you do not pass, you can retake the exam free of charge within 7 days of the result. After that the right expires, and a new enrolment in the free path becomes available 30 days later.
• Free does not mean different: the same integrity rules, the same public verification and the same permanent credential apply.
• An exam taken at no cost has no refund, because nothing was paid. A RAIF bought outside the promotion follows the rules for paid exams, including vouchers and refunds. RAIF is never part of a bundle.

For paid exams, each purchase generates a voucher, and each voucher is worth one attempt:

• A purchased voucher has no expiry date. You take the certification exam whenever you want.
• The voucher is not tied to an account: whoever enters the code uses the attempt. Treat the code like a ticket and do not share it.
• The attempt is used when the exam is opened, not when it is submitted. Abandoning an opened exam uses the voucher.
• Without a pass, a new attempt requires a new voucher, with the second-chance coupon described in Part 3.

The certification exam is individual and closed-book. The rules below exist so that everyone’s pass keeps meaning something:

• Take your own exam. Do not get help from anyone, and do not take the exam on anyone’s behalf.
• Do not use artificial intelligence of any kind during the exam: chat assistants, browser extensions, screen capture or automatic translation tools. Do not consult materials, websites or apps either.
• Do not copy, photograph, record, transcribe or disclose questions, options or any part of the item bank, during or after the exam.
• Do not use automation, scripts or any means of circumventing the normal operation of the exam.
• Do not try to access administrative areas, other candidates’ data or parts of the system that are not yours.
• Do not claim, display or suggest a credential you have not earned, and do not alter an issued certificate.

Revocation is the most serious act on the platform, which is why the grounds are explicit. A credential may be revoked when:

• There was fraud in the exam, including help from others, an exam taken by someone else, prohibited materials, or the use of AI or automation.
• The holder disclosed exam questions, in whole or in part.
• The credential was obtained with a false identity or false information.
• The credential is being presented in a misleading way, or the certificate has been altered.
• It was issued because of an administrative or technical error by DPCert itself.

Revocation is an administrative act, decided by a person and never by an automated system or by AI, with a mandatory written reason recorded in the administrative log. A revoked credential does not disappear: the code remains searchable and shows that it is revoked, and the digital badge is listed as revoked in the public status list. Disappearing would make the code look fake to anyone who verified it in good faith in the past. Revocation for fraud does not give rise to a refund.

You can contest a result, the deferral of a credential, the ending of an exam or a revocation:

• Write to [email protected] from your account email, saying what you contest and why, preferably within 30 days of the decision.
• A person who did not take the original decision reviews the case, with the attempt record, the integrity signals and your arguments, and answers in writing, with reasons.
• If the appeal is upheld, the credential is issued or restored; a restored credential returns to its previous state in the verifier.
• Appeals cost nothing, and lodging one never puts you at a disadvantage.

The questions, options, syllabi, texts and the DPCert brand belong to DPCert Global Institute. Your certificate and your credential are yours: you may display them, share them and include them in your professional profile freely. What may not be reproduced is the content of the exams.

We work to keep the platform available, but maintenance and failures happen. If a problem on our side compromises an exam in progress, write to [email protected] and we release a new attempt at no cost. We may change prices, the catalogue, syllabi and this text; changes apply to later purchases, never retroactively to a voucher already bought.

You have 14 days from the purchase to ask for a full refund, provided the voucher has not been used. Just write to [email protected] from the email used for the purchase.

The process is simple and has one effect worth knowing in advance:

• We refund the amount through the same payment method. How long the money takes to appear depends on your bank or card issuer.
• The voucher is cancelled in the same step and the code stops working. Without this, the code would still open an exam after the money had been returned.
• A used voucher is not refundable, even within the 14 days: the attempt is used when the exam is opened, and from then on the service has been provided.
• After the 14 days, the voucher is still yours with no expiry date, but it is no longer refundable.
• A bundle of more than one certification in a single payment is refunded as a whole, and only with all its vouchers unused and within the 14 days. If one of them has been used, none is refundable.

If you do not pass a paid exam, you receive a 50% discount coupon for a new attempt at the same certification. The coupon is valid for 90 days, can be used once and appears in your result and in the result email. It cannot be combined with bundles or batch purchases.

If you score 70% or more in the open assessment of a paid certification, you receive a 10% discount coupon for its exam. The coupon is valid for 7 days, can be used once and appears in the assessment result. It cannot be combined with bundles, batch purchases, another coupon or a referral.