Last updated: May 11, 2020
Questionmark takes the privacy of all its stakeholders seriously and understands that assessment data is private and use of it needs to follow data protection principles and applicable law.
Except where specified otherwise, this privacy policy applies to all companies in the Questionmark group, including Questionmark Computing Limited, Questionmark GmbH and Questionmark Corporation, herein ‘Questionmark’.
In this privacy policy we use the terms ‘Data Controller’ and ‘Data Processor.’ These terms have special meanings. ‘Data Controller’ means the organization or person that determines the purpose and means of the processing of personal data, for example an organization or educational institution that is a test sponsor and uses our products and services to deliver assessments to test takers. ‘Data Processor’ means the organization or person that processes personal data on behalf of the Data Controller.
Except when stated otherwise, this privacy policy addresses Questionmark’s activities as a Data Controller. When acting as a Data Processor for its customers, Questionmark is contractually bound to comply with privacy obligations in legally binding contracts that address the requirements of applicable laws.
Questionmark only processes personal data pursuant to a lawful basis in accordance with the requirements of applicable law. Lawful bases may include your consent, our legitimate interests and for the performance of a contract with you where products or services are provided. Where Questionmark is acting as a Data Processor, the Data Controller is responsible for ensuring personal data is provided to Questionmark in accordance with applicable laws and Questionmark may only process such personal data in accordance with the instructions of the Data Controller.
This website
Information collected
When you create an account on the Questionmark website, for example to view documentation or post in our forum, or register for or purchase services either on our website or via a third-party payment merchant, you enter various information including name and contact details. Questionmark also collects information at this time, including the internet protocol (IP) address used to connect your computer to the Internet; login; email address; password; computer and connection information such as browser type and version, operating system, platform, and purchase data.
Questionmark provides a chat service on our website that can provide some support and help, for example if you experience a problem with an assessment. You can use the chat service without providing personal data, but we necessarily collect all information you enter into the chat service as well as any information you share with us by email. Questionmark also records information about your interaction with Questionmark systems and personnel, such as which resources you access or download, including within our customer relationship management system.
Questionmark uses cookies to allow you to stay logged into the site, to make the website experience more useful (such as remembering preferences), to gather general statistical information about site use and for marketing purposes. More information on Questionmark’s use of cookies can be found at https://www.questionmark.com/cookies-policy/. Questionmark may ask you to provide personal information when contacting us with support or troubleshooting questions, which we will use for identification purposes and to help respond to your queries.
Children
Questionmark does not knowingly collect personal information through its website or services from any person under the age of 13. We do not market our products and services to persons under the age of 13. If you become aware that a child under the age of 13 has provided personal information to us, please contact us using the information below.
How information is used
Questionmark uses the information collected via its website for its internal business purposes (such as maintaining and improving our products and for general, reasonable administrative purposes), to correspond with you (including to provide information on our products and services and for sales and marketing purposes – unless you have opted out of receiving such correspondence in accordance with applicable laws), to gather and analyze information and monitor activity on the website and to provide you with the best product experience. For example, we may use information provided in interactions with our support personnel or using our website to improve our documentation.
Visibility of information
The personal information you provide in your Questionmark website account profile will only be visible to you, Questionmark and its authorized contractors.
When you contribute to a discussion thread or comment on a blog article, your name (but no other personal information) will be visible to other individuals with Questionmark website accounts. You are responsible for maintaining your profile information to ensure that your email address isn’t disclosed when you use the message forums.
Should you use a credit card to make a payment on this site, Questionmark does not retain a copy of the full credit card number and only retains a reference to the number which is held in full by a secure credit card handling service. Purchasing may also be made via a third-party payment merchant. In this case, Questionmark may be a joint Data Controller with that third-party payment merchant. You should review any third-party payment merchant’s privacy policy before providing them with any personal data, to ensure you are comfortable with their handling of your personal data. Questionmark will handle any personal data passed to us by a third-party payment merchant in accordance with this privacy policy.
Your choices
Questionmark will not ask you to provide personal data that is not reasonably necessary to provide a service or product you request. You can always choose not to provide information, even though it might be needed to make a purchase or to access information that requires a Questionmark website user account. If you choose not to provide essential information you might not be able to make an online purchase, register for a web seminar or other resource, or use information on the Questionmark website that requires a user account.
Opt-out
Questionmark complies with all applicable laws that require opt-in consent prior to sending targeted communication. In compliance with the U.S. CAN-SPAM Act of 2003 and other applicable legislation, Questionmark maintains an opt-out list of email addresses (also known as a ‘suppression list’). This list of addresses may be provided to contractors conducting email broadcasts on Questionmark’s behalf, but only for the express purpose of suppressing these addresses from promotional email broadcasts conducted on Questionmark’s behalf. If you have registered for an account on the Questionmark website or make a purchase or register for services on our website, you will receive periodic email newsletters and communications from Questionmark to assist you in learning about assessment technologies. In registering for a user account on the Questionmark website or otherwise providing us with your personal details where Questionmark is the Data Controller, you consent to receipt of such correspondence.
If you do not want to receive communications from us, please follow the unsubscribe instructions at the bottom of the email or newsletter you received (this method is the quickest way to expedite your unsubscribe request). Alternatively, you may submit a request via www.questionmark.com/unsubscribe, by sending an email to unsubscribe@questionmark.com or by contacting your account manager.
In registering for a user account on the Questionmark website or registering or purchasing services on our website, you will be asked to consent to our processing of your personal information as described above. You may withdraw consent at any time by contacting us as described in this privacy notice.
Recruitment privacy policy
Questionmark is committed to protecting the privacy of personal data provided to us in recruitment processes. We believe it’s important that you understand how your personal data will be used, and your rights. For more information about our recruitment privacy policy, refer to Questionmark recruitment privacy policy at questionmark.com/about/careers/recruitment-privacy-notice.
Information collected when you take an assessment on our servers
An assessment may consist of a test, exam, quiz, survey, or other kind of assessment. Questionmark provides assessment services as a service provider to assessment sponsors. The assessment sponsor is the company or organization that offers the assessment for delivery from Questionmark’s servers. The assessment sponsor is the Data Controller and Questionmark is the Data Processor in respect of the processing of personal information described in this section.
When you take an assessment on Questionmark’s servers, assessment sponsors may collect or receive personal information through our service on candidates including names and demographic and other information. The assessment sponsor decides what information they ask for and collect and Questionmark processes this information only to provide the services requested by the assessment sponsor in accordance with the agreement with the assessment sponsor.
We also automatically record the IP address, browser header data and other similar information about the computer used to take the assessment. If you use our secure browser, Questionmark Secure, to take assessments, we may record further information including details of other processes running and peripherals on your computer and actions taken during the assessment including URLs of other websites you navigate to during the assessment. If the assessment sponsor asks us to provide additional services, like online proctoring or record and review proctoring, then at the choice of and as instructed by the assessment sponsor, further information will be recorded, including proof of identification, video and/or audio, full desktop screen recording and recording of web traffic/screenshots of the assessment session. The assessment sponsor decides what personal information is processed. We do this on behalf of the assessment sponsor for purposes of ensuring the integrity of the assessment process, for example so that the assessment sponsor can detect possible incidents of cheating and to ensure proper candidate authentication.
When an assessment is administered to you by or on behalf of the assessment sponsor, we collect and may score your responses and derive an assessment score, and the assessment sponsor may use this data collected to generate reports about your results.
Any personal data processed by Questionmark will be visible to and shared with the assessment sponsor, as the Data Controller. Providing personal data is voluntary, but usually necessary if you wish to take the assessment. You should raise with the assessment sponsor any concerns you have regarding personal data that you are asked to provide as part of the assessment process.
Questionmark software also uses cookies to make your experience with the software useful, for example to remember preferences, provide you with a better user experience and to help make the assessment experience more effective.
When you use Questionmark software to author or administer assessments on behalf of an assessment sponsor, personal information described above can also be recorded and is treated in the same way as information for people taking assessments.
Certain assessments may be administered through independent testing centers. These centers may have their own privacy policies that may be different from this policy. Questionmark is not responsible for these privacy policies or the conduct of independent testing centers. If you have any questions or concerns about an independent testing center’s collection or use of any of your personal information, please talk to the assessment sponsor or independent testing center directly. By taking or authoring an assessment on our servers, your personal information will be transmitted by Questionmark to the assessment sponsor.
We require all assessment sponsors to comply with all privacy and data protection laws applicable to the personal information being processed, including where applicable the General Data Protection Regulation (Regulation (EU 2016/679)(“GDPR”) and California Consumer Privacy Act 2018, when using Questionmark’s services. The collection, use and further disclosure of your personal information by the assessment sponsor is subject to the assessment sponsor’s own privacy policies, for which Questionmark is not responsible and which may be different from this privacy policy. You should raise any questions about this with the assessment sponsor.
The assessment sponsor is responsible for ensuring that the personal information collected from you and processed as part of the assessment process is collected and processed in accordance with applicable data protection laws. Questionmark acts in accordance with the assessment sponsor’s instructions, including as recorded in written agreements that only permit Questionmark to use personal information for purposes of providing the services to the assessment sponsor.
California Consumer Privacy Act 2018 (“CCPA”)
When providing products and services to assessment sponsors that are covered businesses under the CCPA or otherwise when implied by that law, Questionmark will be acting as a “service provider.” In this case, Questionmark will use personal information of California consumers in accordance with the assessment sponsor’s written contractual instructions and purposes, and shall not retain, use or disclose personal information otherwise than as permitted for service providers under the CCPA and its regulations. Questionmark does not sell personal information.
Disclosing information to others
Questionmark does not sell or rent personal information (including your email address) it collects to others; however, it may disclose personally identifiable information in the following situations and where applicable in compliance with and limited by the requirements of the Privacy Shield principles, EU and Swiss data protection laws and other commitments made by Questionmark to good privacy practice:
(a) in response to a subpoena, court order or legal process, to the extent permitted and required by law;
(b) to protect your security or the security of other persons including for national security or law enforcement purposes, consistent with applicable law;
(c) in connection with a sale, joint venture or other transfer of some or all of the assets of Questionmark companies, provided that the acquirer commits to using personal information in a manner consistent with applicable law and this privacy policy;
(d) to companies in the Questionmark group and a limited number of organizations or individuals who are working as our contractors, resellers or agents and who are committed and obliged to protect your privacy in a manner consistent with this privacy policy and applicable law, including where applicable the Privacy Shield principles.
These organizations and individuals assist us in providing services to customers and prospects, including the provision of data storage services, customer relationship management, technical support and consulting or other services, and may as instructed by Questionmark access, store, use or process personal information when providing services to Questionmark;
(e) when you request it, for instance if you have asked us to do this as part of an effort to connect you with experts who can help you.
By registering for a user account on the Questionmark website, making a purchase on our website or otherwise providing us with your personal information, you give your consent for your personal information to be transmitted in the situations outlined above. You may withdraw this consent at any time by contacting us as described in this privacy notice.
As Data Controller, the assessment sponsor is responsible for ensuring that transmittal of personal information collected from you as part of the assessment process is in accordance with applicable data protection laws. Questionmark acts in accordance with the assessment sponsor’s instructions.
As a Data Processor, Questionmark may only disclose personal information to others as authorized by assessment sponsors in accordance with applicable laws.
Transmission of information and cross-border transfers
Data collected and received by us may be transmitted to the United States and other countries where Questionmark or its affiliates and contractors are located. The internet is a global environment. By using this website and sending information to us electronically, you consent to international transmission of any data that you may choose to supply us. The purpose of international transmissions is to provide support in respect of our services, utilize personnel within the Questionmark group and use subcontractors that provide services to us.
Information transmissions to this site and emails sent to us may not be secure. Although Questionmark places a high priority on security and uses reasonable security measures, due to the inherent nature of the internet, all internet transmissions are done at the user’s own risk.
When Questionmark transfers personal data from the European Economic Area and Switzerland to other countries, we will only do so with arrangements in place that are designed to ensure that your personal data is protected in those other places in accordance with applicable legal requirements.
Questionmark may transfer personal data to countries considered by the European Commission to provide an adequate level of data protection as compared with EU data protection law. In respect of other countries, Questionmark has contractual agreements in place with its relevant suppliers incorporating the EU Standard Contractual Clauses.
As a Data Processor, Questionmark may only transfer personal information to other countries in accordance with the requirements and restrictions of its contracts with assessment sponsors and applicable laws.
EU-U.S. Privacy Shield
Questionmark Corporation complies with the EU-U.S. Privacy Shield Framework and the Swiss-U.S. Privacy Shield Framework as set forth by the U.S. Department of Commerce in respect of the collection, processing, use and retention of personal information transferred from the EU and Switzerland to the United States respectively, including as part of certain of our services in which we act as a data processor. To learn more about the Privacy Shield program, and to view our certification, please visit: https://www.privacyshield.gov/.
Questionmark Corporation has certified to the Department of Commerce that it adheres to the Privacy Shield principles. The Privacy Shield principles describe and explain Questionmark Corporation’s responsibility for personal information within the scope of the EU-U.S. Privacy Shield Framework and Swiss-U.S. Privacy Shield Framework respectively, including liability for processing of such personal information by third party agents on behalf of Questionmark Corporation and unless Questionmark Corporation can prove it is not responsible for harm caused by processing that is not consistent with the Privacy Shield principles.
Any conflict between this privacy policy and the Privacy Shield principles in respect of personal information received by Questionmark Corporation from the EU and Switzerland shall be resolved in favor of the Privacy Shield principles.
Questionmark Corporation is subject to the regulatory enforcement powers of the U.S. Federal Trade Commission in respect of personal information within the scope of the EU-U.S. Privacy Shield Framework and Swiss-U.S. Privacy Shield Framework. Questionmark Corporation commits to cooperating with the EU Data Protection Authorities and Swiss Federal Data Protection and Information Commissioner in conformance with the EU-U.S. Privacy Shield Framework and Swiss-U.S. Privacy Shield Framework and will comply with any advice given by such authorities.
Access and other rights that you have
You can view, edit or delete personal information in your Questionmark website user account profile at any time by logging in at https://support.questionmark.com/user?checked=1.
You may request access to your personal information in order to review, correct or delete any personal information Questionmark retains about you by:
- sending an email request to Questionmark’s Data Protection Officer at privacy@questionmark.com.
- mailing a request, via regular mail, postage pre-paid in the US to Privacy Officer, Questionmark Corporation, 35 Nutmeg Drive, Suite 330, Trumbull, CT 06611, in Germany to Data Protection Officer, Questionmark GmbH, Hopfenstr. 8, 80335 Munich, Germany or in other countries to Data Protection Officer, Questionmark Computing Ltd, Moor Place, 1 Fore Street, London EC2Y 9DT, United Kingdom.
In your request, please clearly state what personal information you would like to have access to. Questionmark will respond to requests within 30 days.
EU residents have rights to access personal information stored about them and to limit its use and disclosure. This includes the right to request access to and rectification or erasure of personal information or restriction of or objection to processing, as well as the right to data portability and to withdraw consent to processing of personal information. Questionmark’s customers store personal information within our systems and therefore if you want to receive access to, limit the use of, or limit disclosure of, your personal information received by Questionmark as part of an assessment process administered by an assessment sponsor, you should ask for this via the assessment sponsor. Similar rights exist for California consumers under the California Consumer Privacy Act 2018, if the assessment sponsor is a business covered by that law. If you are a California consumer, you should contact the assessment sponsor directly to most quickly exercise the rights you may have.
Where you have provided personal information directly to Questionmark, such as when registering for a Questionmark website user account or purchasing services on our website, Questionmark will on request provide you with the personal information it retains about you in accordance with applicable data protection law and the Privacy Shield principles.
Retention of personal data
Questionmark retains personal information for as long as is necessary to provide its services which includes prudent, limited duration archive retention, for compliance with legal obligations, to enforce our rights under agreements and as permitted under applicable data protection law, including where relevant subject to the requirements of the Privacy Shield principles. Retention periods will therefore reasonably vary based upon the nature of the personal information involved.
Where our assessment sponsor customers store personal information within our service, the assessment sponsor is the Data Controller and determines and is responsible for the length of time during which personal information is retained. Questionmark acts in accordance with the Data Controller’s instructions and may not retain personal information contrary to these instructions.
Aggregation and quality assurance use
Questionmark may from time to time use assessment or website personal information collected for purposes of maintenance and operation of services provided to you, including for internal quality assurance purposes, for instance to ensure that new releases of software behave as expected.
Questionmark has a formal data security policy that keeps track of any such data and carries out internal exercises to ensure that it is not misused.
Questionmark may statistically aggregate data in non-person specific form, and subject to applicable law use this data for operations management, quality control, security and marketing purposes and to improve the quality of our future products and services, and subject to applicable law pass this to assessment sponsors. Such activities on any personal information provided for assessment purposes may only be carried out with the instructions of the assessment sponsor for which Questionmark acts as Data Processor.
By using our site or taking assessments, you give consent for such use. Except where our use does not require consent under applicable law, you may withdraw your consent to such use at any time by contacting us as described in this privacy notice. The right to object to processing of your personal data under the GDPR applies even when we process your personal data on a basis other than your consent, such as based on our legitimate interests or to perform a contract with you.
How we protect your information
To prevent unauthorized access, maintain data accuracy, ensure the appropriate use of information and protect against the loss, misuse or alteration of information under our control, we have put in place appropriate physical, electronic and managerial procedures to protect personal information we collect through our website. Questionmark maintains a formal, internal data security policy that is regularly reviewed and audited and which all employees are trained on. More information on security measures employed by Questionmark can be found at https://www.questionmark.com/trust.
Where Questionmark acts as Data Processor, we comply with contractual obligations required by assessment sponsors, including having in place appropriate technical and organizational measures that are designed to protect personal information processed by Questionmark as Data Processor.
Links to other websites
This website and our assessments may contain links to other websites on the Internet that are not operated by Questionmark. For the avoidance of doubt, this privacy policy covers only the Questionmark site and servers and not other websites or systems, even if linked to from Questionmark’s website.
Changes to this privacy policy
From time to time, we may need to update this privacy policy. We reserve the right to do so by updating this privacy policy which will be pointed to from our website. The ‘last updated’ date at the top of this page will be modified to show that a change has been made.
When the changes are material, we will also inform you in advance of any changes taking effect in our newsletter and/or otherwise prominently positing a notice of such changes or by directly sending you a notification of changes.
We stand behind the promises we make, and unless required by law will never materially change our policies and practices to make them less protective of customer information collected in the past without the consent of affected customers. We encourage you to review this privacy policy periodically for any changes or updates.
Enforcement
Questionmark is committed to working with individuals to obtain a fair resolution to any complaints or disputes about privacy and personal information.
Questionmark carries out periodic self-assessments to verify that its privacy policy and practices are implemented as described and will take such actions as may be required to address any compliance failures, including with reference to the requirements of the Privacy Shield principles and applicable law.
Please contact us if you have any questions or concerns regarding this privacy policy or our practices.
Questionmark’s commitment to privacy is demonstrated and documented by our adherence to applicable laws, execution of the E.U. Standard Contractual Clauses with relevant third parties and voluntary adherence to the Privacy Shield principles.
Any questions, complaints or concerns about this privacy policy should be sent to Questionmark’s Data Protection Officer at privacy@questionmark.com or via regular mail, postage prepaid, addressed in the US to Privacy Officer, Questionmark Corporation, 35 Nutmeg Drive, Suite 330, Trumbull, CT 06611, in Germany to Data Protection Officer, Questionmark GmbH, Hopfenstr. 8, 80335 Munich, Germany or in other countries to Data Protection Officer, Questionmark Computing Limited, Moor Place, 1 Fore Street, London EC2Y 9DT, United Kingdom. You may also call Questionmark and raise issues at our contact telephone numbers on our website.
We will respond to your concerns within the scope of the Privacy Shield principles within 45 days or sooner if required by applicable law.
For information collected regarding residents of EU member states and Switzerland, Questionmark agrees to cooperate with the EU Data Protection Authorities and Swiss Federal Data Protection and Information Commissioner in resolving any individual complaints or disputes with regard to this privacy policy, applicable EU data protection law and Switzerland’s applicable data privacy laws. Individuals in respect of which personal information has been transferred to the United States from the EU or Switzerland may report privacy complaints to their local EU Data Protection Authority or the Swiss Federal Data Protection and Information Commissioner, including if Questionmark fails to respond within the timescales referred to in this privacy policy or if our response does not address your concerns.
In respect of personal information within the scope of the Privacy Shield principles, under certain circumstances described therein you may have the right to initiate binding arbitration relating to this privacy policy or Questionmark Corporation’s relevant practices once other dispute resolution mechanisms have been exhausted.
How to contact us
If you have any questions or concerns about this privacy policy or how we have handled your personal data, please contact Questionmark’s Data Protection Officer at privacy@questionmark.com or using the contact information provided above. If we are unable to satisfactorily deal with your concerns, you should contact the bodies referred to above. Unless stated otherwise in this privacy notice or required by law, we will respond within 30 days.