Privacy Policy

We use your information to:

• Provide the service: authenticate your account, deliver exam content, track progress, issue certificates.
• Process payments: complete transactions and prevent fraud.
• Communicate with you: send welcome emails, password reset links, purchase receipts, referral earnings notifications, and platform updates.
• Personalise your experience: show relevant content, adapt difficulty, and display performance insights.
• Maintain platform integrity: detect and prevent cheating, abuse, and unauthorised access.
• Legal compliance: comply with applicable Nigerian laws and regulatory requirements.
• Analytics: understand aggregate usage patterns to improve the Platform (no personally identifiable data is shared externally for this purpose).

We will not use your personal data for unsolicited marketing without your explicit consent.

We do not sell your personal data. We share it only in the following circumstances:

• Service providers: Paystack (payment processing), email delivery services — all bound by data processing agreements.
• Examiners: If you take a certification exam or live proctored exam created by an Examiner, that Examiner may see your name, score, submission, and — for proctored exams — your webcam images, screen captures, and violation log.
• Financial institutions: Your bank account details are shared with our banking partners solely to process Examiner withdrawal requests.
• Legal obligations: We may disclose your information where required by law, court order, or governmental authority in Nigeria.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity, subject to the same privacy commitments.

We implement appropriate technical and organisational measures to protect your personal data, including:

• Passwords are stored using bcrypt one-way hashing — we cannot retrieve your plaintext password.
• Payments are processed over encrypted HTTPS connections via Paystack's PCI-DSS compliant infrastructure.
• Database access is restricted to authorised personnel and server processes only.
• Password reset tokens are single-use and expire after 1 hour.
• Remember-me tokens are stored as SHA-256 hashes and expire after 30 days.

No system is 100% secure. In the unlikely event of a data breach affecting your personal information, we will notify you in accordance with applicable Nigerian law.

When you join a live proctored exam that has webcam or screen recording enabled:

• Your browser will request permission to access your camera and/or screen. Granting this permission is required to participate in the exam.
• Snapshots are captured at intervals set by the Examiner and uploaded securely to CBT Land servers over an encrypted connection.
• Capture images and violation logs are stored in a restricted directory and are accessible only to the Examiner and CBT Land administrators.
• Proctoring data is retained for 90 days after the exam ends, then permanently deleted — unless a formal dispute has been raised, in which case data is retained until the dispute is resolved.
• We do not use proctoring images for facial recognition, biometric profiling, or any purpose beyond exam integrity verification.

If you object to webcam or screen proctoring, you must contact the Examiner before joining the exam. CBT Land cannot override proctoring settings configured by individual Examiners.

We use the following types of cookies and similar technologies:

We do not use third-party advertising or tracking cookies. You may disable cookies in your browser settings; however, core features like login will not function without session cookies.

Under applicable Nigerian law and in line with global best practices, you have the right to:

• Access: Request a copy of the personal data we hold about you.
• Correction: Ask us to correct inaccurate or incomplete data.
• Deletion: Request deletion of your account and associated personal data (subject to legal retention requirements).
• Portability: Receive your data in a structured, machine-readable format.
• Objection: Object to processing of your data in specific circumstances.

To exercise any of these rights, contact us at message@cbtland.com. We will respond within 30 days.

We retain your personal data for as long as your account is active or as needed to provide our services. Specifically:

• Account data: retained for the life of the account, then deleted upon verified deletion request.
• Exam results and certificates: retained for 7 years for audit and dispute purposes.
• Payment and withdrawal records: retained for 7 years in compliance with Nigerian financial regulations.
• Bank account details: retained while your Examiner account is active; deleted within 30 days of account closure.
• Proctoring captures (webcam/screen images): retained for 90 days after exam completion, then permanently deleted.
• Anti-cheat logs: retained for 12 months then purged.
• Password reset tokens: automatically expired after 1 hour and purged periodically.
• Rate-limiting records: automatically purged after 1 hour.