How we handle personal data

Two groups, two roles

Website visitors. When you browse exampit.com, write to us or book a demo, Exampit decides what is collected and why. For that data we are the business responsible for it, often called the controller.

Candidates and client staff. When a program uses Exampit to test people, the program decides what data is collected and how it is used. The client is usually the controller, and Exampit acts as its processor or service provider, handling the data only on the client’s documented instructions and under a written agreement.

If you took an exam delivered on Exampit, the organization that gave the exam is your first point of contact for questions about your data. If you write to us instead, we pass your request to that organization promptly and help it respond.

What we collect on this site

Forms. Our contact and demo forms ask for your name, work email, organization and message, and optionally your phone number, the size of your organization, the topic you are interested in, and the times and format you prefer for a call. Each submission also records the date, your IP address and the approximate city and region it came from, which helps us filter spam. Form submissions are delivered to our team by email; the website itself does not store them in a database.

Email and phone. If you write to us or call, we keep what you tell us and our reply, so the next person who helps you has the history.

Analytics. We use cookieless analytics that count page views, referring sites, device types and countries in aggregate. They do not use cookies, build a profile of you or follow you to other sites.

Cookies. This website does not set cookies for analytics, advertising or tracking. We do not use advertising pixels or sell space to ad networks.

Server logs. Our hosting provider keeps short-lived technical logs, such as IP address, browser type, page requested and time, to keep the site running and secure.

What the platform processes

On behalf of our clients, the platform may process the following, depending on how each program is set up:

• Identity and contact details: name, email, candidate ID, and phone or address when the program asks for them.
• Eligibility and application records: education, training or work history, documents the program requires, and decisions on them.
• Accommodation requests and approvals: which may include information about a disability or health condition. We restrict access to these records to the people the client authorizes.
• Responses, scores and results: answers, timing, scores, score reports, certificates and digital credentials.
• Proctoring data, when the client enables it: webcam video, audio, screen recordings, images of the candidate and an identity document taken at check-in, a room scan, and event flags with reviewer notes.
• Technical data: IP address, device and browser details, and session logs that record what happened and when.

We use candidate data only to provide the services our client has contracted for, on its instructions, and to keep those services secure and working. We do not sell candidate data, use it for advertising or combine it across clients. Candidate responses, recordings and personal data are never used to train third-party models.

Education records and FERPA

Many of our clients are schools, colleges and districts subject to the Family Educational Rights and Privacy Act (FERPA). When such a client shares education records with us, our contract treats Exampit as a school official with a legitimate educational interest, under the institution’s direct control for the use and maintenance of those records. In practice, that means we:

• use education records only for the purposes the contract allows;
• do not disclose them to anyone else except as the institution authorizes or the law requires;
• follow the institution’s instructions on access, retention and deletion; and
• help the institution answer requests from parents and eligible students.

Many states add student data privacy laws and data privacy agreements of their own. We work with districts and colleges on the agreements their state requires. This section describes how we act under contract; it is not legal advice, and each institution decides how FERPA and state law apply to its records.

How we use website data

We use the personal data we collect on this website to:

• answer your questions and schedule the demo or call you asked for;
• send the information, proposal or resources you requested;
• understand, in aggregate, which pages are useful so we can improve them;
• keep the website and our systems secure and prevent abuse; and
• meet our legal and accounting obligations.

We send marketing email only to people who have asked for it or who work with us, and every message includes a way to stop receiving them.

Who we share it with

We share personal data only as this policy describes:

• Service providers that host our website and platform, deliver email and support our operations. They are bound by contract to use the data only to provide their service to us, and to protect it.
• Our clients, for candidate data, and anyone a client directs us to share it with, such as a learning management system, a credential verification page or a licensing database.
• Authorities, when the law requires it, such as a valid subpoena or court order. Where the law allows, we tell the affected client first.
• A successor, if Exampit is merged, acquired or sells its assets, under terms that keep this policy’s protections in place.

Clients can request our current list of subprocessors that handle candidate data. We do not sell personal data, and we do not share it for cross-context behavioral advertising.

How long we keep it

• Website inquiries are kept for up to 24 months after our last contact with you, unless you become a client, in which case they are kept for the length of the relationship.
• Server logs are kept for a short period, usually no longer than 30 days, unless needed to investigate a security problem.
• Candidate data is kept for the period each client sets in its agreement and platform settings, including how long proctoring recordings are kept.
• When a client leaves, we provide a complete export and then delete our copies within 30 days, unless the client asks us in writing to keep them or the law requires us to.

We may keep a record that a deletion happened, and the minimum information needed to meet legal, tax or accounting obligations.

How we protect it

Personal data on the platform is encrypted in transit with TLS 1.2 or later and at rest with AES-256. Access follows role-based permissions, so each person sees only what their job needs, and access to candidate records and item banks is logged. Our staff are trained in data handling and work under confidentiality obligations.

If we learn of a security incident that affects personal data, we notify affected clients without undue delay and as their agreement and the law require, and we help them notify anyone else who must be told.

No system is perfectly secure, and we do not claim otherwise. Our security page describes our controls in more detail, and clients can request our security questionnaire answers and architecture overview.

Hosted in the United States

Exampit hosts website and platform data in the United States. If you contact us from outside the United States, your information is transferred to and processed in the United States, where privacy law may differ from the law where you live.

Your choices and rights

Depending on where you live, state privacy laws may give you the right to know what personal data we hold about you, to get a copy, to correct it, to delete it, and to opt out of its sale, targeted advertising or certain profiling. We do not sell personal data or use it for targeted advertising, and we treat a Global Privacy Control signal as a valid opt-out request.

We offer these rights to every website visitor, whether or not a law requires it. To use them, email legal@exampit.com or call (505) 203-1090. We confirm your identity before acting, using information we already hold. You may use an authorized agent, who must show us your permission. We respond within 45 days, and we tell you if we need more time and why.

If we decline your request, we explain why, and you can appeal by replying to our decision. If you are not satisfied with the outcome of an appeal, you may contact the attorney general of your state. We will not treat you differently for using any of these rights.

Candidates: because the testing program controls your data, send requests to that program first. If you send them to us, we forward them promptly and support the program’s response.

Children’s data

This website is not directed to children under 13, and we do not knowingly collect personal data from children through it. If you believe a child has sent us personal data through the website, write to legal@exampit.com and we will delete it.

Some school district clients use the platform with students under 13. In that case the school provides any consent the Children’s Online Privacy Protection Act requires, and we use students’ data only for the school’s educational purposes under our agreement, never for advertising or commercial profiles.

Changes to this policy

When we change this policy, we post the new version here with a new effective date. If a change materially affects how we handle candidate data, we tell our clients in advance as their agreements require.

How to reach us

For privacy questions or requests, contact:

Exampit Tech LLC
6000 Uptown Boulevard NE, Suite 140
Albuquerque, NM 87110

Email: legal@exampit.com
Phone: (505) 203-1090, Monday to Friday, 9 a.m. to 5 p.m. Mountain

Effective date: November 6, 2026.