Terms of Service

    1. General
‍
By using Sulitest tools, you explicitly agree to the recording of your webcam, microphone and screen activity during the test. The data captured is used to maintain the integrity of the assessment process by detecting any possible cheating.
Sharing Information for Cheating Investigations: In the event of a suspected cheating incident, Sulitest may share a limited set of data points with the organization administering the test session. This data may include, but is not limited to, timestamps of suspicious activity, screenshots captured during the assessment, and excerpts from the video or audio recording that demonstrate the suspected behavior.

1.1 Definition of terms
By using the Sulitest Impact services and making use of a Sulitest Account (the "Account") and all its related features, (the "Services"), the User agrees to be bound by the following terms of service (the "Terms"). These Terms cover all present and future features provided by the Account. The Services are operated by Sulitest Impact ("Service Provider").

1.2 Agreeing to the terms
If the User agrees to these Terms on behalf of a company or another legal entity, the User represents that they have the authority to bind such entity, its affiliates, and all Users who access the Services through the Account to these Terms. In the absence of such an authority, the User is not authorized to use the Services.

1.3 Purpose of Data Collection
‍Personal Data: Date of birth, country, gender
This data is collected exclusively for research purposes. It will be processed entirely anonymously, meaning no individual identifier will be associated with this information. The goal of this collection is to analyze the demographic data of users and identify potential correlations with the results obtained during tests.
‍Email Address: Your email address is primarily used to authenticate you and allow you to access your account. It can also be used to send you important notifications about the service, such as updates or information related to your account.
‍Interactions with the device used during the test: The data collected during your interactions with the device (see section 6.3) is essential to ensure fairness for all candidates by monitoring the proper functioning of the service and identifying any potential technical issues.
‍Legitimate Interest: The retention of your data allows us to offer you a better user experience, provide you with a quality service, and meet your needs effectively.

1.4 Definition of cheating:
Cheating is defined by the use of the following methods when taking TASK:
1.4.1 Completion of the assessment with collaboration or with the use of external materials or resources.
1.4.2 Allowing someone to impersonate you while participating in a session or in the completion of an assessment, or impersonating someone else
1.4.3 Collaboration, discussion, or publishing of assessment questions or answers at any time
1.4.4 Trying to find vulnerabilities in the system
1.4.5 The use of resources such as textbooks, other people, electronic devices, AI, third party websites or any other resources during the assessment or break(s)
1.4.6   Any Account found to be committing the above-mentioned activities will be immediately suspended or deleted.

1.5 How consent is collected:
Prior to the start of proctored test, users will be prompted to activate their webcam and microphone and must agree to these terms in order to proceed with the test. Without consent, users will not be able to participate in the proctored assessment.
Uers who do not have a webcam or microphone are able to participate in the proctored assessment.
Sulitest Impact provides access to this website and its services . Access to and use of those services is governed by these terms and conditions (“Terms and Conditions”). By accessing these service, you consent to be bound by the terms and conditions, and your acknowledgment of, and agreement to its terms. By using these services you also represent that you are legally able to enter into a contract.

    2. User

2.1 User registration
As far as the Services provided are concerned, there are two User categories:
2.1.1. Organization User – A person with the status of:    
- A teacher, i.e., a person who, depending on the User's legal system, is engaged in activity which is defined as a teacher, an educator, or any other pedagogical employee hired at schools.    
- An employee of a public or a non-public university within the provisions of the User's legal system
- A representative of a company or another legal entity.
2.1.2. Individual User
– Any non-representative of organizations
By completing Registration on the Services, the User declares that they are prepared to conclude an Agreement, and the personal data which they have provided is accurate and complete and does not infringe on any rights of any third parties. In case of any changes within this scope, the User should immediately notify the Service Provider of the above.
The Services are provided exclusively to individuals who are at least 13 years of age, or to minors who have obtained parental or legal guardian consent to open and maintain an Account.
The Services are provided exclusively to persons. Accounts registered by "bots" or automated methods are not authorized and will be terminated. Each user is solely responsible for all actions performed through the Services.

2.2 User account
2.2.1. The Service Provider distinguishes two categories of Accounts that can be created:      
a. An Organization account;    
b) An Individual account.
2.2.2. An Organization Account having individual features as per the User's preferences is available only after an agreement with the Service Provider. This will require the User to complete a separate agreement with the Service Provider.
2.2.3. The Service Provider reserves the right to refuse to create an Account, block an Account, or delete an Account if:
a) The Account Name is already being used on the Services;
b) The Service Provider discovers or learns from a reasonable and credible source that an Organization User does not comply with the requirements stated in the Terms and Conditions, or that their Account is being used for commercial purposes;
c) The Service Provider receives reasonable and credible information that the User is using the Account in a way that is against the law, shows disregard for common decency, or violates any personal rights or legitimate interests of any third parties.
In this case, the Service Provider will immediately inform the User, via the e-mail address that was provided during Registration, that their account will be deleted.
2.2.4. The User is not allowed to share an Account with any third parties.

2.3 Type and Score of the Services
2.3.1. The Service Provider provides two types of Services to the Users:
  a) Free of charge services.
  b) Paid services.
2.3.2. The Services are provided to the User upon:
  a) The correct registration and activation of an Account — in the case of the Services which are free of charge;
  b) The User making a payment — in the case of the Services which must be paid for.
2.3.3. The Services provided electronically via the sulitest.org website includes:
  a) The possibility of maintaining an Account on the Services;
  b) The option to create new Tests or manage already existing online Tests;
  c) The ability to make the online Tests available to selected Individual Users;
  d) The ability to have Individual Users complete the Online Tests.
2.3.4. Using the Services referred to in par. 3 a), b), c), d) is possible only after a User completes their Registration and activates their Account.
2.3.5. The Services referred to in par. 3 a), b), c), d) are available to the Users as free services or as part of the paid services.

2.4 Authorized use of the Services
2.4.1. The User agrees not to use the Services for any illegal or prohibited activities. The User also agrees not to disrupt the Service Provider's networks and servers in the User's use of the Services.
2.4.2. Moreover, The User agrees not to use the Services to send junk mail, bulk emails, or mailing list emails that contain persons that have not specifically agreed to be included on that list. The User agrees not to use the Services to store or share content that violates the law or the rights of a third party.
2.4.3. Having multiple free accounts is not considered acceptable use of the Services (e.g. bulk signups, a large number of free accounts created by a single organization or individual). Abusive registrations of aliases for third-party services are also not acceptable. Free accounts must also only be created and maintained by their effective users (e.g. it is not acceptable to create accounts in anyone else's name and later transfer credentials to that third party).
2.4.4. Any Account found to be committing the above-mentioned activities will be immediately suspended or deleted.
2.4.5. Trading or selling a Sulitest account to a third party is prohibited and the Service Provider reserves the right to suspend infringing accounts. This rule does not apply to Sulitest Impact Organization Accounts, which can be sold or traded exclusively through the Service Provider. The Service Provider has no obligation to store or forward the contents of terminated accounts. The Service Provider also has no obligation to store messages or contents for accounts.
2.4.6. The Service Provider may also terminate Accounts that are being used for illegal activities that are not listed in the present section, particularly in response to orders from the competent authorities informing of such illegal activity.
2.4.7. Although it is not current practice, the Service Provider reserves the right to suspend or delete free Accounts that have been inactive for a consecutive period of three months or more.

2.5 Concluding and Terminating an Agreement.
2.5.1. When filling in the Registration Form and creating an Account, the User is asked to get familiar with the content of the Terms and Conditions and to approve its provisions.
2.5.2. Once the Registration Form is filled in, the Service Provider sends a message to the e-mail address specified by the User, and the message contains an Account activation link. The activation of an Account takes place when the User clicks the activation link, which confirms the creation of an Account.
2.5.3. The above is equivalent to a User giving their consent for starting the provision of the Services before the deadline for withdrawing from the Agreement for the provision of Services by electronic means.
2.5.4. The User receives, in the form of an e-mail message sent to the address specified by the User, a confirmation of:
  a) The creation of the Account;
  b) The submission and acceptance of an order for completion (applicable only to the services available as part of the paid services);
  c) Starting the provision of the Services.
2.5.5. An Agreement for the provision of Services by electronic means is considered as concluded once the User receives an e-mail message as described in par. 4 herein.
2.5.6. The User gets access to their Account via an e-mail address (login/username) and a password.
2.5.7. An Agreement for the maintenance of the Account on the Services is concluded for an indefinite period and does not include any financial liability for the User.

2.6 Entrustment of Personal Data
2.6.1. The Organization User can be a controller of the personal data of the Individual User should the Organization facilitate the use of Services for Individual Users, or they process the entrusted data on the behalf of another controller, or controllers, which means that the Organization User controls the manner of the collection and using of the personal data of the Individual user, and they are responsible for this.
2.6.2. The Organization User declares that they have determined the legal basis for the processing of the personal data of the Individual User, collected via the Online test forms.
2.6.3. As the controller of the personal data of the Individual Users, or as a processor, the Organization User entrusts the Service Provider with the processing of the personal data of the Individual User.
2.6.4. Sulitest Impact hereby declares that it obliges to use the personal data only to the extent which is necessary to provide the services specified in the Terms and Conditions, as well as for the purposes specified herein.
2.6.5. In accordance with the regulations relating to personal data, Sulitest and the Organization User conclude a contract for the implementation of organization and technical measures to protect the personal data which are processed by the Services.

    3. Data Retention and Deletion

3.1 Data storage
All personal data collected during the assessment process, including video, audio, and screen recordings, is securely stored in an object storage located in Europe. The following security measures are in place to ensure the protection of your data:
- Private Access: The storage is configured with strict access controls. Only authorized personnel are granted access to the stored data. This access is granted on a need-to-know basis and is closely monitored.
- Encryption: All data is encrypted both at rest and during transmission. Data is encrypted using industry-standard 256-bit Advanced Encryption Standard Galois/Counter Mode (AES-GCM) while stored. Additionally, any data transferred to and from our systems is encrypted using TLS (Transport Layer Security) to prevent unauthorized interception.
- Access Logging and Auditing: We maintain detailed logs of all access to the stored data, ensuring that any access to your personal information is tracked and can be audited for security and compliance purposes.
- Data Minimization: We store only the data necessary to ensure the security and integrity of the assessment, in line with the principles of GDPR. Personal data that is no longer required is securely deleted.
By implementing these security measures, we ensure that your data is protected from unauthorized access and handled in compliance with relevant data protection regulations.

3.2 Data deletion
3.2.1 Application Data
We retain your personal data for a limited period, strictly necessary to fulfill the purposes for which it was collected.
In the context of TASK, we retain your data for a period of 4 years. This period corresponds to the validity period of your TASK certificate plus one additional year, in order to respond to any requests for access to the certificate or to retake the certificate.
Candidate data is retained even if the organization that invited the candidate stops using the service. Candidate data will only be deleted upon explicit request from the candidate. The retention of your data allows us to offer you a better user experience, provide you with a quality service, and meet your needs effectively.
3.2.2 Surveillance Data
All recorded data (video, audio, etc.) will be securely stored for a period of 90 days after the end of the assessment. After this period, the recordings will be permanently deleted, unless they are needed for an ongoing investigation or legal proceedings.
‍Extended Retention for Investigations: If an incident of cheating is suspected, the recorded data may be retained for the duration of the investigation and any legal proceedings. You can request the deletion of your data at any time by contacting our Data Protection Officer at robin@sulitest.org. The request will be processed within one week and, unless the recordings are necessary for an investigation, the data will be deleted within 30 days.
‍
3.3 Right to object
You have the right to object to the processing of your personal data based on legitimate interests, including profiling. If you object, we will stop processing your data unless we have compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or if the processing is necessary for the establishment, exercise, or defense of legal claims.
If you object to the processing of your personal data, we may not be able to continue offering the assessment service, as it is necessary for maintaining test integrity. However, we will review all objections to determine if we can accommodate your request while still fulfilling our contractual obligation.
To object, please contact our Data Protection Officer at robin@sulitest.org. We will carefully consider your objection and provide you with a response within 1 month.

    4. Data Security
We take the security of your data seriously. The following measures are in place to protect your recorded video and audio:
- Encryption in transport: All recorded data is transferred safely using TLS encryptions
- Encryption at rest: All recorded data is stored using encryption to prevent unauthorized access.
- Access Restrictions: Only authorized personnel, including proctors or investigators, will have access to the recorded data, and only for the purposes outlined above.

    5. Rights and Obligations
‍
5.1 User's obligations
1. The User is obliged to comply with the Terms and Conditions.
2. The User is forbidden to post using the Services any content of an erotic or pornographic nature. The User is also forbidden to post any content which violates any legal or moral norms, which depicts or propagates violence, hatred, or discrimination (racial, cultural, ethnic, religious, philosophical, etc.), or which violates the personal rights or insults the dignity of other persons.
3. The User is forbidden to post using the Services any content that is against the law. The User is also forbidden to post content that does not display good manners; in particular, content that violates the personal rights or insults the dignity of other persons, as well as any spam content (e.g., links to other websites, illegal software, or any information regarding the acquisition thereof).
4. The User using the Services is obliged to refrain from copying, modifying, distributing, transmitting, or using in any other way, any of the content and the databases which have been made available on the Services, with the exception of when the User is given express permission by the Service Provider.
5. The User cannot act to the detriment of the Services or of the other Users (e.g., by attempting to break into the Services or the Account of another User).
6. The User obliges not to proceed with any actions which unjustifiably burden the Services infrastructure.
‍
5.2. User's Rights
5.2.1. To use the full functionality of the Services, the User has the right to appropriately configure their Account and the option to use the paid services, which guarantee additional functionalities within the created Account.
5.2.2. Through the created Account, and with the forms available on the Services, a User can:
  a) Complete Tests created as part of the Services;
  b) Make online Tests available to a selected group of Users;
  c) Manage the conducted online Tests via the Services;
  d) Create and add online Tests, as long as they are compliant with the applicable law, with good customs, and with the principles of social coexistence.
  e) Request access to, correct, or delete your recorded data. Requests can be made by contacting our Data Protection Officer at robin@sulitest.org. We will process these requests in accordance with applicable laws, including the General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), Personal Information Protection and Electronic Documents Act (PIPEDA), Brazil’s General Data Protection Law (LGPD).
‍
5.3 Service Provider Obligation
5.3.1. The Service Provider obliges to exercise due diligence when providing the Services.
5.3.2. The Service Provider reserves the right to introduce limitations on the use of the Services during periods of necessary maintenance work, work to improve the functionality of the Services, and work to improve its technical service. However, the Service Provider also obliges to make every effort to ensure that the above-mentioned are as brief as possible.
5.3.3. The Service Provider reserves the right to modify the Terms and Conditions. Any changes made shall enter into force once they are published on the www.sulitest.org website or any related websites. Any activities completed by the Users prior to changing the Terms and Conditions shall be considered as per the provisions which were applicable at the given time.
5.3.4. A User who does not agree to the new Terms and Conditions may stop using the Services.
5.3.5. The Service Provider reserves the right to apply admonitions, temporarily suspend, and ultimately to delete the Accounts of Users who break the provisions of the Terms and Conditions with their actions, hinder the use of the Services by other Users, or use the Services provided within the scope of the Services contrary to their intended purpose.
5.3.6. The Service Provider reserves the right to remove any content which violates the provisions of the Terms and Conditions.
5.3.7. The Service Provider may block access to the User's online Tests if they contain content that is contrary to the law, contrary to decency, racist, pornographic, insulting to the User, phishing, collecting unreasonable personal data, or is inconsistent with the Service Provider's interests.
5.3.8. The Service Provider reserves the right to fully limit the User's access to the Services functions and online Tests, as well as to the collected results of the Tests once the Paid Services have expired.
5.3.9. Users may use the following e-mail address, support@sulitest.org to report any content which blatantly violates the provisions of the Terms and Conditions.
‍
    6. Assessment administration locations
We offer different types of environments for administering assessments, each designed to meet various testing needs while ensuring security and integrity. Below are descriptions of the three types of locations where assessments may be conducted
‍
6.1. In-Class Assessment
In-class assessments are conducted in traditional educational settings, such as classrooms within schools, universities, or training centers.
- Supervision: These assessments are overseen by a person present in the room to monitor the candidates throughout the test to ensure compliance with exam rules and prevent cheating.
- Setting: Candidates are physically present in a group, seated in a structured layout that facilitates supervision. There are no special proctoring tools such as cameras or microphones required, as the invigilator ensures that test integrity is maintained.
‍
6.2. Controlled Environment Assessment (Empty Room with Camera)
Controlled environment assessments are administered in a designated, isolated room specifically prepared for testing.
- Supervision: The room is equipped with fixed surveillance cameras to monitor the entire space.
- Setting: Candidates take the test in an empty room where no one else is present. The room is free of external distractions or resources, and its design is intended to prevent any form of cheating.
This environment is highly secure and minimizes the risk of external interference, providing a stringent level of control over the testing process.
‍
6.3. Remotely Proctored Assessment
Remotely proctored assessments allow candidates to complete their tests from any location, such as their home, office, or other personal spaces.
- Supervision: Remote proctoring tools, such as webcams, microphones, and screen monitoring software, are used to observe the candidate throughout the test in real-time. Proctors or automated systems watch for suspicious behavior to ensure the candidate follows the rules.
- Setting: Candidates take the test on their personal computers or devices. They are required to activate their webcam and microphone, and their screen is recorded to ensure they do not access unauthorized resources or receive outside assistance.
This setup provides flexibility for candidates while ensuring the test remains secure through remote surveillance technologies.

    7. Data privacy for education institutions
The data collected is solely collected to ensure good monitoring and prevention of fraudulent activities when using Sulitest assessment tools and ensuring test integrity is maintained.We will share any evidence of suspected cheating with the educational institution administering the test session, in accordance with our obligations and their policies.
‍
7.1 Data privacy for assessments administrated in class
In order to ensure the validity of your test results, Sulitest Impact requires your consent to collect the personal data mentioned above in order to ensure test security, integrity and validity of the test by preventing fraud or fraudulent behavior
The following additional data will be collected and processed:
- Out of focus events
7.2 Data privacy for assessments administrated in controlled environments
In order to ensure the validity of your test results, Sulitest Impact requires your consent to collect the personal data mentioned above in order to ensure test security, integrity and validity of the test by preventing fraud or fraudulent behavior
The following additional data will be collected and processed:
- Mouse activity
- Screen activity events
- Specific keystrokes events (Copy & paste, screenshots)

7.3 Data privacy for assessments administrated remotely
In order to ensure the validity of your test results, Sulitest Impact requires your consent to collect the personal data mentioned above in order to ensure test security, integrity and validity of the test by preventing fraud or fraudulent behavior
The following additional data will be collected and processed on top of the data collected in controlled environment:
- Screenshots of the TASK web application
- Video of the TASK web application - in case of suspicious activity
- Webcam and microphone recordings of your device - in case of suspicious activity
- Keystrokes events

    8. Copyrights and liability
‍
8.1. Copyright‍
8.1.1. The Sulitest platform is protected by international legislation on copyrights, trademarks and in general intellectual property rights, covering both the form (choice, structure and design of materials, means of accessing data, database or any organization of data, etc.), and each element of content (brands, text, illustrations, graphics and other visuals, video, etc.). The content of this site is the exclusive property of the Sulitest Impact and its contributors, who do not grant any license or other right than to consult these materials on the site.
8.1.2. Any reproduction, representation, modification, distribution, or redistribution, total or partial, of the content using any process (in particular caching or framing) as well as any sale, resale, loan, retransmission or supply to a third party in any manner, is strictly prohibited. Failure to comply with these restrictions constitutes counterfeiting and exposes the perpetrator to civil and criminal liability unless the User has been given written permission by the owners of that content.
8.1.3. It is also forbidden for any external entities to download any photos from the Services and use them for marketing and commercial purposes.
8.1.4. Using the above-mentioned materials without the written permission of the Service Provider, the Users, or any other parties publishing on the Services with the permission of the Service Provider, is against the law and may be the basis for initiating civil and criminal proceedings against the persons who are involved in such dealings.
‍
8.2. Liability Warranties and Liability‍
8.2.1. The Service Provider does not make any warranty about the reliability of the Services or guarantee the security of user data, despite best efforts. The Service is provided "as is" and the User agrees not to hold the Service Provider responsible nor to seek indemnification for any damages that may arise because of the loss of use, data, or profits connected to the performance of the Service or failure in such performance.
8.2.2. Furthermore, the User will not hold the Service Provider liable or seek indemnification if confidential material is unintentionally released as the result of a security failure or vulnerability in the performance of the Services.
8.2.3. The Service Provider obliges to make every effort that the content shared via the Services is compliant with the provisions of the Terms and Conditions. Nevertheless, the Service Provider does not verify the reliability and authenticity of the content published by the User.
8.2.4. Both the Service Provider and their suppliers do not guarantee that the Services will be free of errors and that the access to it will be constant and uninterrupted.
8.2.5. Due to the encrypted nature of the Services, The User acknowledges that the Service Provider has no ability or obligation to recover the User's data if the User misplaces their password.
8.2.6. In addition, the Service Provider is not liable for:    
  a. Any damage caused to third parties resulting from the Users using the Services in a manner not compliant with the Terms and Conditions or with the provisions of the law;    
  b. Any content made available by the Users, meaning content which violates the law or any legally protected third party rights;    
  c. The content of the online Tests published on the Services by the Users;    
  d. The results of the online Tests published on the Services;    
  e. The provision of false or incomplete data and information by the Users;    
  f. Non-compliance with the provisions of the Terms and Conditions on the part of the Users.
  g. The Service Provider is not liable for issues with or interruption of the operation of the Internet network which may make it impossible for the User to use the Services. In particular, the Service Provider is not liable for any losses incurred by the User as a result of losing data or not being able to transfer data, which may be caused by interruptions in the access to the Services or by interruptions in the operation of the Internet network.
8.2.8. The Service Provider is not liable for any damage caused as a result of the User incorrectly using the Services; in particular, for the disclosure of Account passwords, disclosure of personal data, and for any damage resulting from ceasing the provision of the Services and deleting the Account of a User violating the Terms and Conditions or the provisions of law, as well as any damage resulting from the modification of the online Test code, or the incompetent use thereof.
8.2.9. The User is obliged to repair the damage which the second party has suffered as a result of non-performance or incorrect performance of the duties outlined in the Terms and Conditions and the commonly applicable norms by the Users, unless their non-performance or incorrect performance was a result of circumstances for which the User is not liable.
8.2.10. The Service Provider is not liable for any damage resulting from the cessation of the provision of the Services to a User who is violating the Terms and Conditions, this includes damage resulting from the deletion of the Account of the User who is violating the Terms and Conditions.

    9. Final Provisions
‍9.1. Any disputes between the Parties will be settled amicably. However, if there is no possibility of settling a dispute amicably, the competent Court will be the local court for the seat of the Service Provider.
9.2. Sulitest Impact reserves, to the extent which is permissible in compliance with the applicable regulations, the right to make changes and modifications of the Terms and Conditions in case of the occurrence of significant reasons related to the technical or substantive aspect of the operation of the Services. The changes will be published on an ongoing basis on the Service Provider's Services.
9.3 The Terms and Conditions are valid beginning on January 1st, 2025.  

Privacy Policy

Respecting your rights as personal data subjects and respecting the applicable law regulations, in particular the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter referred to as GDPR, we pledge to maintain the security and confidentiality of the personal data which we have obtained from you. Please note, you are also subject to the requirements of the Data Protection Act.The Services are operated by Sulitest Impact (the “Company”, “We”), registered under the number W133022480 at Préfecture des Bouches-du-Rhône – France (French law, Association loi 1901), located at Kedge BS – Domaine de Luminy – BP 921 – 13288 Marseille – France. It is therefore governed by the laws and regulations of France.This Privacy Policy provides a description of how we take care of your personal data, as well as information about your rights to privacy. When using the Services, a User approves the privacy protection practices described in this Policy.
‍
1. We collect the following personal data on the Website:a) The data necessary for registering a User and for creating an Account: an e-mail address, password, name and surname, birth date, country of origin, time zone, and type of entity (an individual user/an organization). Such data is required for the correct configuration of an Account and for establishing contact with a User, if need be;
b) Data required for providing services to a User or to a Respondent, the contents of which may change depending on the service provided or on the nature of an online Test. This may include a residence or address, phone number, education, profession, and the data contained within the online Tests;
c) Data required to proceed with the complaint process — name and surname, as well as a User's or Respondent's e-mail address, the device's IP address, Tax Identification Number — which we require from those requesting an invoice who have a Tax Identification Number number;
d) Information resulting from the general principles of Internet connections, such as an IP address (as well as other information contained within the system logs), which is used by the Website administrator for technical purposes. IP addresses may also be used for statistical purposes, including the collection of general demographic information (e.g., determining the region in which the connection is made).

2. Providing the data mentioned above is necessary in cases specified therein, including:
a) To use the Services offered by Sulitest Impact;
b) To reply to your questions and make it possible to get in touch via e-mail;
c) To proceed with voluntary registration (setting up an Account) on the Website. In such a situation, we store the data the User has provided in order to make it easier for the User to use the services available on the Website in the future until the User deregisters (delete the Account).

3. Functional cookies are required for the sole purpose to enable or facilitate communication by electronic means and are strictly necessary for the provision of the Services at the request of the users. Optional marketing and analytical cookies are always disabled by default.

4. The personal data of the User is processed by our company as the Controller in order to proceed with the implementation of the services which we render to the User (i.e., the persons whom the data concerns), and which are offered within the scope of the Services. Pursuant to the data minimization principle, we process only those personal data categories which are necessary to achieve the goals which have been discussed in the preceding sentence.

5. In relation to the personal data of the Users, the Controller is the entity processing the personal data on the basis of an agreement concluded with the User. In such a case, the Controller of the data is a User who is collecting data via online Tests.

6. As a person using the Website, it is your responsibility to choose if, and to what extent, you would like to use the Services and share information and data about yourself within the scope set forth in this Privacy Policy.

7. We process personal data for the period necessary to achieve the objectives mentioned in par. 1 and 2 above. Personal data may be processed for a longer period of time if an obligation is imposed on us as the Controller, if required by specific legal provisions, or because of the Controller's legitimate interest specified in par. 9 let. c below (i.e., for the period of the termination of the claims, or the completion of the relevant proceedings, if these were started within the limitation period).

8. The sources of the personal data processed by the Personal Data Controller are the persons the data concerns.

9. The following article is the basis for the processing of your personal data; Art. 6 par. 1, let. a of the GDPR, i.e. the data subject has given consent to the processing of their personal data for one or more specific purposes; where the purposes are described within the Terms of Service.

10. To provide the Services, we rely on data subprocessors, which process different categories of data. Processors never store data outside of the scope of their specific purpose.
a) Data management is carried out by our IT partner, ALEAUR (209b Avenue Charles de Gaulle 92200 Neuilly-sur-Seine - SIRET 411 893 167 00014), in accordance with current legislation. The Data from the Sulitest platform is stored in two secure computer centers, located in France and certified ISO 27001, OHSAS 18001, ISO 22301, ISO 14001, SSAE16/ISAE 3401 SOCs, PCI-DSS, ISO9001, ISO 50001, HDA/HADS.
b) In a case where the personal data is transferred to a third country, or to an international organization, the company undertakes to put in place the EU standard contractual clauses for any transfer and to make these clauses available to users.

11. We do not make any personal data available to third parties without the explicit consent of the person whom the data concerns. Without the consent of the person whom the personal data concerns, this data can be made available only to the bodies which are governed by public law (i.e., tax authorities, law enforcement authorities, as well as to other entities which are authorized by the generally applicable provisions of the law).

12. The personal data may be entrusted for processing to the processors of such data on behalf of our company as the Controller. In such a situation, as the Controller, we conclude an entrustment agreement with the processor for the processing of personal data. The processor processes the entrusted personal data only for the purposes, within the scope, and as per the goals indicated in the entrustment agreement, which has been referred to in the preceding sentence. Without entrusting your personal data for processing, we would not be able to proceed with our activities through the Services. As the Controller, we entrust personal data to the following entities for processing:
a) Those providing hosting services for the Services;
b) Organization Users the Individual User has agreed to share their personal data with.13. Under the provisions of the GDPR, each person whose personal data we are processing as the Personal Data Controller has the right to:
a) Be informed about the processing of the personal data referred to in art. 12 of the GDPR;
b) Have access to their personal data referred to in art. 15 of the GDPR;
c) Correct, supplement, update, or rectify the personal data referred to in art. 16 of the GDPR;
d) Delete the data (the right to be forgotten), referred to in art. 17 of the GDPR;
e) Limit the processing referred to in art. 18 of the GDPR;
f) Transfer the data referred to in art. 20 of the GDPR;
g) Object to the processing of the personal data, which is referred to in art. 21 of the GDPR;
h) In the case of the legal basis: The right to withdraw the consent at any time without any influence on the compliance with the processing right, which has been made on the basis of the consent prior to its withdrawal;
i) Not be the subject of profiling, referred to in art. 22, in conjunction with art. 4 par. 4 of the GDPR;
j) Lodge a complaint with a supervisory body referred to in art. 77 of the GDPR. The supervisory authority of France, the company’s member state, is CNIL.
‍
Each person whose personal data we are processing must take into consideration the principles of using and implementing these authorizations that result from the provisions of the GDPR.

14. If you would like to exercise your rights as referred to in the preceding paragraph, you should use functionalities provided by the Services, which will allow you to delete your account and the data stored on the Website. You may also send an e-mail message to either of the addresses referred to in par. 17 or write to the correspondence address.

15. Any inquiries, requests, and complaints regarding the processing of the personal data by the Controller, hereinafter referred to as the Requests, should be sent to the following e-mail address: support@sulitest.org.

‍16. Each identified security breach is documented and in case any of the situations described in the provisions of the GDPR of the Act occurs, the relevant supervisory authority will be notified. Information to data subjects regarding an identified security breach is assessed based on the impact of the breach notification.

17. All words in capital letters have the meaning assigned to them by the Terms and Conditions of the Website, unless stated otherwise in this Privacy Policy.

18. The provisions of this Privacy Policy are applicable within the possible extent to all persons with whom we remain in legal relations, and to those for whom we are the Controller of their personal data (i.e., our Users).

19. In any matters not regulated by this Privacy Policy, the relevant applicable provisions of the law shall apply. In case any of the provisions of this Privacy are not compliant with the regulations of the law, the latter provisions shall be applicable.

20. We reserve the right to periodically review and change this policy from time to time and will notify users who have enabled the notification preference about changes to our privacy policy.