List of active policies

Full policy

1. Who we are

The data controller for ExamSimul Academy is BITIL.COM S.A.S. di Raffaele Restaino, Via Tenente Corrado 22, 83100 Avellino (AV), Italy. VAT and tax code 02480550645, business register REA AV-161313 (CCIAA Irpinia Sannio). Legal representative: Raffaele Restaino.

For any question about your personal data, or to exercise the rights described below, write to training@examsimul.com.

2. What data we collect

• Account data – first and last name, email address, password (stored hashed, never in readable form), and optionally city and country.
• Learning data – course enrolments, quiz and exam-simulation attempts and answers, scores, activity completion, progress, forum and glossary contributions.
• Technical data – IP address, browser and device identification, pages visited and actions taken, with date and time.
• Payment data – whether a payment succeeded, its amount, date and reference.

We never see your card details. Payments are handled entirely on Stripe’s or PayPal’s own systems; this platform receives only the outcome of the transaction. No card or bank account number is stored here at any point.

Please note that technical data is detailed: every resource you open and every quiz you start is recorded with your identity, your IP address and a timestamp. This is what makes progress tracking and attendance records possible.

3. Why we process it, and on what legal basis

• Delivering the courses you or your employer paid for, tracking progress, issuing attendance and completion records – performance of a contract (Art. 6(1)(b) GDPR).
• Keeping the platform secure: detecting abuse, investigating incidents, blocking brute-force attacks – legitimate interest (Art. 6(1)(f) GDPR).
• Invoicing and accounting – legal obligation (Art. 6(1)(c) GDPR).
• Service messages about your courses: enrolment confirmations, reminders, deadlines – performance of a contract (Art. 6(1)(b) GDPR).

We do not send commercial or promotional email through this platform, and we do not profile you for advertising.

4. Who your data is shared with

We do not sell your data and we do not share it for anyone else’s marketing.

• Aruba S.p.A. (Italy) – processor, hosting provider for the platform, its database and its backups.
• Stripe and PayPal – independent controllers for the payment transaction.
• Your employer, where they commissioned the training – see section 8.

If you sit a certification examination, you register for it directly with the certification body and we do not transmit your data to them.

5. How long we keep your data

• Account and learning data – while your account is active, then 24 months after your last access.
• Access logs – 12 months.
• Course backups – 35 days.
• Accounting records relating to payments – 10 years, as required by Italian law.

After data is deleted from the live platform it may still exist in backups for up to 35 days, and in our hosting provider’s own backups for the period set out in their contract.

6. Your rights

Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or hand it over in a portable format. You can also lodge a complaint with the Garante per la protezione dei dati personali.

We answer within one month, free of charge, unless a request is manifestly excessive or repetitive.

You can request an export or a deletion of your data directly from your profile on this platform, without writing to anyone.

Two limits apply. Deletion is not always possible: where you hold a certification obtained through a course delivered here, or where an invoice is unpaid, we may have to keep the related records to meet legal and accounting obligations. If your employer enrolled you, requests about your participation in their training normally have to go through them, because for that data they are the controller and we act on their instructions.

7. Cookies

This platform uses only the cookies it needs to work: MoodleSession, which keeps you logged in as you move between pages and is deleted when you close your browser, and MOODLEID1_, which remembers your username on the login page. Both are strictly necessary and neither requires consent.

There is no advertising, no third-party analytics and no cross-site tracking here. If a payment takes you to Stripe or PayPal, those pages set their own cookies under their own policies.

8. When your employer commissioned the training

When your employer commissions the training, they decide that you will attend and what happens to the record of it: they are the data controller and we act as processor on their instructions, under a separate agreement. When you buy a course yourself, we are the controller.

What your employer receives is limited to what they are paying for: who was enrolled, who attended, who completed, and the results where the course involves an assessment. They do not receive your browsing history on the platform or your access logs.

9. Changes to this notice

We may update this notice as the platform or the law changes. When a change is substantive – a new purpose, a new recipient, a longer retention period – we will ask you to read and accept the new version the next time you log in, and we keep a record of that acceptance. Minor corrections are published without asking you again.