IBACTP® Privacy Policy

The International Board of AI, Cybersecurity & Technology Professionals is a professional certification organization offering vendor-neutral certifications, examinations, education, professional-development programs, credential-verification services, and organizational programs in areas including:

• Artificial intelligence;
• Cybersecurity;
• Digital forensics;
• Data science;
• Cloud computing;
• Information technology;
• Technology management; and
• Related professional disciplines.

For most activities described in this Privacy Policy, IBACTP determines why and how personal information is processed and therefore acts as the data controller, business, or responsible organization under applicable privacy law.

In some circumstances, another organization—such as an employer, university, government agency, authorized training partner, examination provider, or program sponsor—may independently determine how it processes your personal information. That organization’s privacy notice will apply to its independent activities.

This Privacy Policy applies to personal information collected through:

• IBACTP websites;
• Candidate and credential-holder portals;
• Certification applications;
• Eligibility assessments;
• Certification examinations;
• Remote and in-person testing;
• Identity-verification and proctoring activities;
• Self-paced training;
• Virtual instructor-led training;
• In-person training;
• Practical laboratories;
• Management simulations;
• Capstone projects;
• Continuing professional development;
• Certification renewal;
• Credential verification;
• Digital badges and certificates;
• Appeals, complaints, and disciplinary proceedings;
• Corporate and institutional programs;
• University partnerships;
• Authorized training-partner programs;
• Conferences, webinars, and professional events;
• Surveys and research;
• Marketing communications;
• Customer service and technical support; and
• Other services that link to this Privacy Policy.

This Policy does not control the independent privacy practices of third-party websites, social networks, payment processors, training providers, examination platforms, proctoring providers, or other external services.

We encourage you to review the privacy notices of third parties before submitting personal information to them.

The personal information we collect depends on your relationship with IBACTP and the products, programs, or services you use.

3.1 Identity and Contact Information

We may collect:

• Full legal name;
• Preferred name;
• Professional title;
• Employer or organizational affiliation;
• Residential or business address;
• Country, state, province, or region;
• Email address;
• Telephone number;
• Date of birth, when required for identity matching;
• Candidate identification number;
• Credential-holder number;
• Account username;
• Profile photograph; and
• Electronic signature.

We may collect government-issued identification information when reasonably necessary for identity verification, examination security, fraud prevention, or legal compliance.

We will not request a government identification document unless it is reasonably necessary for a defined purpose.

3.2 Account and Authentication Information

When you create or use an IBACTP account, we may collect:

• Username;
• Encrypted or securely processed password information;
• Multifactor-authentication information;
• Account recovery information;
• Security preferences;
• Login history;
• Session information;
• Authentication logs;
• Device information; and
• Records of suspected unauthorized access.

You are responsible for protecting your login credentials and promptly notifying IBACTP if you suspect unauthorized access to your account.

3.3 Certification Application and Eligibility Information

When you apply for certification, we may collect:

• Academic qualifications;
• Degrees, diplomas, and transcripts;
• Professional certifications;
• Licenses;
• Employment history;
• Professional experience;
• Résumé or curriculum vitae;
• References;
• Supporting documents;
• Eligibility declarations;
• Employer verification;
• Professional-development history;
• Signed acknowledgments;
• Ethics declarations; and
• Information needed to determine whether you meet certification requirements.

3.4 Examination and Assessment Information

We may collect:

• Examination registrations;
• Examination dates and locations;
• Examination attempts;
• Examination responses;
• Scores and results;
• Domain-level performance;
• Assessment status;
• Practical laboratory results;
• Assignment submissions;
• Capstone projects;
• Simulation decisions;
• Presentation materials;
• Instructor or evaluator feedback;
• Examination incident reports;
• Retesting information;
• Appeals; and
• Records related to examination integrity.

Examination content, candidate responses, scoring methods, and security records may be subject to additional confidentiality and retention controls.

3.5 Identity Verification and Proctoring Information

To protect examination integrity, IBACTP or an authorized testing provider may collect:

• Government-issued identification images;
• Identity-verification results;
• Candidate photographs;
• Electronic signatures;
• Examination check-in information;
• Internet Protocol addresses;
• Device and operating-system information;
• Browser information;
• Network information;
• Examination-session logs;
• Images of the testing environment;
• Screen recordings;
• Audio recordings;
• Video recordings;
• Proctor observations;
• Records of unusual or prohibited activity; and
• Examination-security investigation records.

If biometric technologies, facial matching, voice analysis, or other automated identity-verification methods are used, candidates will receive any additional notice required by applicable law. Consent will be obtained where legally required.

IBACTP will require examination and proctoring providers to apply appropriate security, confidentiality, access, and retention controls.

3.6 Training and Learning Information

When you participate in an IBACTP training program, we may collect:

• Course enrollment;
• Attendance;
• Module progress;
• Completion status;
• Knowledge-check results;
• Laboratory work;
• Assignments;
• Discussion contributions;
• Instructor communications;
• Capstone submissions;
• Presentation recordings;
• Peer or instructor feedback;
• Learning-platform activity;
• Resources downloaded; and
• Training evaluations.

Participants must not submit confidential employer information, personal information about another person, proprietary datasets, active investigative evidence, security credentials, regulated information, or malicious code unless expressly authorized and appropriately protected.

3.7 Certification and Credential Records

We may maintain:

• Certification title;
• Credential number;
• Certification date;
• Expiration date;
• Renewal status;
• Continuing professional development records;
• Credential-verification history;
• Digital badge information;
• Certification suspension or revocation;
• Reinstatement history;
• Ethics or disciplinary decisions; and
• Other information required to administer and verify the credential.

Essential credential records may be retained for an extended period so that IBACTP can verify whether a certification was issued and whether it remains valid.

3.8 Payment and Transaction Information

When you purchase an IBACTP product or service, we may collect:

• Billing name and address;
• Product or service purchased;
• Transaction date;
• Payment amount;
• Currency;
• Invoice information;
• Purchase order;
• Discount or promotional code;
• Tax-related information;
• Refund information;
• Payment status; and
• Limited payment-method details supplied by the payment processor.

Complete payment-card numbers and security codes should be collected and processed directly by an authorized payment provider. IBACTP does not intend to store complete payment-card information on its own systems.

3.9 Organizational and Partner Information

For employers, universities, government agencies, instructors, subject-matter experts, sponsors, and authorized training partners, we may collect:

• Organization name;
• Business address;
• Organizational contact information;
• Professional role;
• Authority to act for the organization;
• Program and cohort details;
• Learner rosters;
• Instructor qualifications;
• Agreements and approvals;
• Due-diligence information;
• Quality-review records;
• Audit information;
• Billing and contracting information;
• Performance information; and
• Administrative communications.

3.10 Communications and Support Information

We may collect information contained in:

• Contact forms;
• Support requests;
• Emails;
• Telephone conversations;
• Complaints;
• Appeals;
• Feedback;
• Surveys;
• Meeting notes;
• Event registrations;
• Social-media communications; and
• Other correspondence with IBACTP.

Telephone or virtual sessions may be recorded for quality, training, security, or recordkeeping purposes when legally permitted and after appropriate notice.

3.11 Website, Device, and Usage Information

When you use an IBACTP website or portal, we or our authorized service providers may automatically collect:

• Internet Protocol address;
• Browser type;
• Device type;
• Operating system;
• Device identifiers;
• Language settings;
• Time-zone settings;
• Referring page;
• Exit page;
• Pages viewed;
• Features used;
• Links selected;
• Date and time of access;
• Duration of visits;
• Approximate location derived from an IP address;
• Cookie identifiers;
• Session identifiers;
• Security logs;
• Diagnostic information; and
• Error reports.

3.12 Sensitive Personal Information

Depending on the service and applicable law, some information may be considered sensitive, including:

• Government identification information;
• Account credentials;
• Payment information;
• Identity-verification information;
• Biometric information;
• Health or disability information related to accommodations;
• Precise geolocation, if collected;
• Disciplinary information; and
• Information concerning alleged misconduct.

IBACTP processes sensitive information only when reasonably necessary, with appropriate safeguards, and when supported by a valid legal basis.

IBACTP does not use sensitive personal information to infer characteristics about individuals for advertising purposes.

IBACTP may collect personal information:

• Directly from you;
• Through an IBACTP website or portal;
• From an employer, university, government agency, sponsor, or training partner;
• From instructors, evaluators, and proctors;
• From examination and identity-verification providers;
• From payment and fraud-prevention providers;
• From references or qualification-verification sources you authorize;
• Automatically through cookies, logs, and similar technologies;
• From publicly available professional sources, where permitted;
• From service providers supporting IBACTP operations; and
• From individuals or organizations involved in a complaint, appeal, ethics matter, or examination-security investigation.

If you provide personal information about another person, you represent that you have appropriate authority to provide it and have supplied any notice required by law.

5.1 Providing Websites and Online Services

We may use personal information to:

• Create and administer accounts;
• Authenticate users;
• Maintain website and portal functionality;
• Provide requested information;
• Process forms;
• Provide customer support;
• Diagnose technical problems;
• Communicate service notices; and
• Improve accessibility and usability.

5.2 Administering Certifications

We may use personal information to:

• Review applications;
• Determine eligibility;
• Verify education or experience;
• Register candidates;
• Schedule examinations;
• Provide examination accommodations;
• Administer and score examinations;
• Evaluate projects and practical assessments;
• Issue certificates and digital badges;
• Maintain certification records;
• Process renewals;
• Manage continuing-development requirements;
• Verify credentials;
• Investigate irregularities;
• Administer appeals;
• Enforce certification rules; and
• Suspend, revoke, reinstate, or retire credentials when permitted under applicable policies.

5.3 Protecting Examination Integrity

We may use personal information to:

• Verify candidate identity;
• Prevent impersonation;
• Detect unauthorized materials;
• Detect prohibited collaboration;
• Investigate plagiarism;
• Detect unauthorized use of AI;
• Identify examination-content theft;
• Investigate unusual testing patterns;
• Review proctoring incidents;
• Prevent fraud;
• Protect confidential examination materials; and
• Maintain public confidence in IBACTP credentials.

Materially adverse examination or disciplinary decisions should receive qualified human review before they become final.

5.4 Delivering Training and Professional Development

We may use information to:

• Enroll participants;
• Provide course materials;
• Deliver virtual or in-person instruction;
• Track attendance and progress;
• Administer knowledge checks;
• Facilitate laboratories and simulations;
• Evaluate assignments and capstones;
• Provide feedback;
• Issue completion records;
• Support instructors;
• Improve curriculum; and
• Measure program effectiveness.

5.5 Issuing and Verifying Credentials

IBACTP may operate a credential-verification service.

Credential verification may display or confirm:

• Credential holder’s name;
• Certification title;
• Credential number or identifier;
• Date of issuance;
• Expiration date;
• Renewal status; and
• Current credential status.

Public verification information will be limited to what is reasonably necessary to confirm the identity and status of a credential.

IBACTP may offer optional professional-directory features. Participation in an optional directory will be based on appropriate notice and choice. Essential credential-verification records may remain available even when a credential holder does not participate in a directory.

5.6 Processing Payments and Transactions

We may use information to:

• Process registrations and purchases;
• Generate invoices and receipts;
• Administer discounts;
• Process refunds;
• Detect payment fraud;
• Maintain financial records;
• Meet tax and accounting requirements; and
• Enforce payment and contractual terms.

5.7 Managing Organizational and Partner Programs

We may process information to:

• Administer corporate and institutional cohorts;
• Manage university relationships;
• Approve and monitor training partners;
• Verify instructor qualifications;
• Manage participant rosters;
• Coordinate program delivery;
• Conduct quality reviews;
• Perform audits;
• Enforce contractual requirements;
• Manage partner status; and
• Communicate program information.

5.8 Maintaining Security

We may use information to:

• Protect accounts;
• Detect unauthorized access;
• Monitor system security;
• Investigate cyber incidents;
• Prevent fraud;
• Protect examination content;
• Enforce acceptable-use requirements;
• Protect IBACTP intellectual property;
• Protect candidates, credential holders, partners, and the public; and
• Maintain business continuity.

5.9 Communicating with You

We may send:

• Account notices;
• Application updates;
• Examination confirmations;
• Training communications;
• Results;
• Certification and renewal notices;
• Security alerts;
• Policy updates;
• Support responses;
• Event information;
• Newsletters; and
• Marketing communications where permitted.

You may unsubscribe from promotional emails at any time. You may continue to receive essential administrative, transactional, examination, certification, security, or policy communications.

5.10 Research, Analytics, and Improvement

We may use information to:

• Understand how services are used;
• Improve websites and platforms;
• Develop new certifications;
• Improve examinations;
• Evaluate examination-item performance;
• Measure assessment reliability;
• Improve training content;
• Conduct quality assurance;
• Produce organizational reports; and
• Develop aggregated statistics.

Where reasonably possible, we use aggregated, anonymized, or de-identified information for research and analytics.

IBACTP will not attempt to reidentify properly de-identified information except as permitted to test or improve de-identification safeguards.

5.11 Legal and Compliance Purposes

We may use information to:

• Comply with applicable law;
• Respond to lawful legal process;
• Respond to regulators;
• Conduct audits;
• Maintain tax and accounting records;
• Establish, exercise, or defend legal claims;
• Enforce agreements;
• Apply legal holds;
• Manage insurance and risk; and
• Protect safety, rights, property, and public interests.

Where applicable law requires a legal basis, IBACTP relies on one or more of the following:

Contract

Processing may be necessary to provide a certification, examination, training program, account, transaction, or other requested service.

Legitimate Interests

IBACTP may process information for legitimate interests such as:

• Operating and improving services;
• Administering professional credentials;
• Protecting examination integrity;
• Preventing fraud;
• Maintaining security;
• Communicating with organizational contacts;
• Conducting quality assurance; and
• Protecting legal rights.

We consider whether these interests are outweighed by the individual’s rights and freedoms.

Legal Obligations

Processing may be required to comply with tax, accounting, accessibility, regulatory, employment, legal-process, or other obligations.

Consent

We may rely on consent for:

• Certain cookies;
• Marketing communications;
• Optional directories;
• Recordings;
• Biometric processing;
• Sensitive information; or
• Other activities where consent is required.

You may withdraw consent at any time. Withdrawal does not affect processing completed before consent was withdrawn.

Legal Claims and Substantial Public Interest

Where permitted, we may process information to establish, exercise, or defend legal claims; prevent fraud; investigate misconduct; or protect substantial public interests.

Vital Interests

In limited circumstances, we may process information to protect the life, safety, or vital interests of an individual.

IBACTP may disclose personal information to the following recipients.

7.1 Service Providers

We may engage service providers for:

• Website hosting;
• Cloud infrastructure;
• Account authentication;
• Payment processing;
• Examination delivery;
• Identity verification;
• Remote proctoring;
• Learning management;
• Digital certificates and badges;
• Email delivery;
• Customer support;
• Analytics;
• Consent management;
• Fraud prevention;
• Cybersecurity;
• Data storage;
• Backup and disaster recovery;
• Electronic signatures; and
• Professional consulting.

Service providers are required to protect personal information and use it only for authorized purposes, subject to applicable law and contract.

7.2 Employers, Universities, Sponsors, and Training Partners

If an organization registers, sponsors, pays for, administers, or requires your participation, we may provide the organization with information reasonably related to the program, including:

• Enrollment;
• Attendance;
• Completion;
• Certification status; and
• Results, where appropriate and disclosed.

IBACTP will not provide detailed examination responses or unnecessary personal information merely because an organization paid for the service.

The applicable program notice or agreement should explain the information that will be reported to the sponsoring organization.

7.3 Credential Verification

We may confirm certification status to employers, clients, regulators, members of the public, or other parties using IBACTP’s verification services.

7.4 Legal and Protective Disclosures

We may disclose information when reasonably necessary to:

• Comply with applicable law;
• Respond to a subpoena or court order;
• Respond to a lawful government request;
• Cooperate with a regulator;
• Investigate fraud or misconduct;
• Protect examination integrity;
• Address a security threat;
• Enforce an agreement or policy;
• Establish or defend a legal claim; or
• Protect the rights, safety, security, or property of IBACTP or another person.

7.5 Organizational Transactions

If IBACTP is involved in a merger, restructuring, financing, sale of assets, or similar transaction, personal information may be reviewed or transferred subject to appropriate confidentiality and legal safeguards.

7.6 At Your Direction

We may disclose information when you direct or authorize us to:

• Send a transcript;
• Issue a digital badge;
• Verify experience;
• Share a credential;
• Communicate with an employer; or
• Provide information to another designated recipient.

IBACTP does not sell personal information for monetary compensation.

IBACTP does not knowingly sell or share personal information belonging to individuals under 18.

Certain privacy laws define “sale,” “sharing,” or “targeted advertising” broadly enough to include some disclosures involving advertising cookies, pixels, analytics services, or online identifiers.

Where IBACTP uses technologies that fall within these definitions, we will provide any notice and opt-out mechanism required by applicable law.

IBACTP and authorized service providers may use cookies, pixels, local storage, session technologies, and similar tools.

9.1 Strictly Necessary Technologies

These support:

• Website security;
• Authentication;
• Session management;
• Form submission;
• Shopping carts;
• Account access; and
• Essential website functionality.

9.2 Preference Technologies

These may remember:

• Language;
• Region;
• Display preferences;
• Login preferences; and
• Other user-selected settings.

9.3 Analytics Technologies

These help us understand:

• Website traffic;
• Page performance;
• User navigation;
• Technical errors;
• Service use; and
• General audience engagement.

9.4 Marketing Technologies

Where used and legally permitted, these may help:

• Measure campaigns;
• Understand referrals;
• Limit repeated advertisements; and
• Deliver relevant promotional content.

9.5 Managing Cookie Preferences

Where required, nonessential cookies will not be activated until you make a choice.

You may manage cookies through:

• IBACTP’s cookie-preferences tool;
• Your browser settings;
• Device settings; or
• Other legally required opt-out mechanisms.

Blocking certain cookies may affect website functionality.

IBACTP will honor qualifying Global Privacy Control signals where legally required and technically applicable.

IBACTP may use automated systems or AI-assisted tools to support:

• Identity verification;
• Fraud detection;
• Examination security;
• Plagiarism detection;
• Customer support;
• Content administration;
• Data analysis;
• Document classification; and
• Initial review of information.

IBACTP will not rely exclusively on automated processing to make a legally or similarly significant adverse decision when applicable law requires meaningful human review.

Suspected examination misconduct, certification discipline, accommodation decisions, or other significant adverse actions should receive review by qualified personnel.

Personal information submitted to IBACTP will not be used to train a general-purpose third-party AI model unless IBACTP has:

• A valid legal basis;
• Appropriate contractual protections;
• A documented security assessment;
• A defined business purpose; and
• Any notice or consent required by law.

IBACTP serves individuals and organizations internationally.

Personal information may be processed in the United States or another country where IBACTP, its partners, or service providers operate. Privacy laws in those countries may differ from the laws where you live.

When required, IBACTP will use an approved transfer mechanism, such as:

• An adequacy decision;
• Standard contractual clauses;
• The United Kingdom International Data Transfer Agreement;
• The United Kingdom Addendum;
• Contractual data-protection safeguards; or
• Another lawful transfer mechanism.

You may contact IBACTP for more information about transfer safeguards, subject to legal and confidentiality limitations.

IBACTP retains personal information only for as long as reasonably necessary to:

• Provide services;
• Administer certifications;
• Verify credentials;
• Protect examination integrity;
• Maintain security;
• Resolve disputes;
• Enforce agreements;
• Meet legal obligations;
• Support audits;
• Maintain financial records; and
• Defend legal claims.

Retention periods depend on the type of information and the purpose for which it was collected.

12.1 Account Information

Account information may be retained while an account is active and for a reasonable period after closure.

12.2 Certification Records

Essential credential records may be retained long term to verify:

• Credential issuance;
• Certification status;
• Expiration;
• Renewal;
• Suspension;
• Revocation; and
• Reinstatement.

12.3 Examination Records

Examination responses, scoring records, incident records, and assessment information may be retained for certification administration, quality assurance, appeals, security, fraud prevention, and legal compliance.

12.4 Proctoring and Identity Information

Identity documents, recordings, photographs, and examination-session data will be retained for the shortest period reasonably compatible with:

• Identity verification;
• Examination-security review;
• Appeals;
• Fraud prevention;
• Contractual requirements; and
• Applicable law.

12.5 Accommodation Information

Accommodation and health-related information will receive restricted access and will be retained only as long as reasonably necessary.

12.6 Financial Records

Transaction, invoice, tax, refund, and accounting records will be retained for the applicable financial, audit, and legal periods.

12.7 Complaints and Discipline

Complaints, appeals, ethics matters, disciplinary decisions, and investigation records may be retained according to legal, fairness, risk, and certification-integrity requirements.

12.8 Marketing Records

Marketing information may be retained until you opt out or until it is no longer necessary. IBACTP may retain a limited suppression record to ensure that an opt-out continues to be honored.

When information is no longer required, it will be securely deleted, destroyed, anonymized, or de-identified.

Legal holds, litigation, investigations, or regulatory requirements may extend a retention period.

IBACTP uses reasonable administrative, technical, physical, and organizational safeguards appropriate to the nature and sensitivity of the information.

Safeguards may include:

• Role-based access;
• Least-privilege access;
• Multifactor authentication;
• Encryption in transit;
• Encryption at rest where appropriate;
• Secure hosting;
• Network protection;
• Logging and monitoring;
• Vulnerability management;
• Data backup;
• Business continuity;
• Vendor due diligence;
• Confidentiality agreements;
• Personnel security training;
• Secure software-development practices;
• Incident-response procedures; and
• Periodic security and privacy reviews.

No system can be guaranteed completely secure.

You are responsible for:

• Protecting your password;
• Using a unique password;
• Securing your devices;
• Logging out of shared devices;
• Avoiding suspicious links; and
• Promptly reporting suspected unauthorized access.

IBACTP maintains procedures to identify, assess, contain, investigate, and remediate security incidents.

If an incident affecting personal information creates a notification obligation, IBACTP will notify affected individuals, regulators, customers, or other parties as required by applicable law.

A notification may include:

• The nature of the incident;
• The information involved;
• Actions taken by IBACTP;
• Recommended protective steps; and
• Contact information for questions.

Depending on your location and subject to applicable exceptions, you may have the right to:

• Confirm whether IBACTP processes your information;
• Access your personal information;
• Obtain a copy of your information;
• Correct inaccurate information;
• Delete personal information;
• Restrict processing;
• Object to processing;
• Withdraw consent;
• Receive certain information in a portable format;
• Opt out of sale or sharing;
• Opt out of targeted advertising;
• Opt out of certain profiling;
• Limit certain uses of sensitive information;
• Appeal the denial of a privacy request;
• Obtain information about international transfers; and
• Lodge a complaint with a privacy regulator.

These rights are not absolute.

For example, IBACTP may need to retain information to:

• Verify a credential;
• Protect examination integrity;
• Prevent fraud;
• Comply with tax or accounting obligations;
• Resolve an appeal;
• Maintain disciplinary records;
• Enforce an agreement; or
• Establish or defend legal claims.

Deleting essential certification information may prevent IBACTP from verifying your credential.

Submit a privacy request by emailing:

info@ibactp.org

You may also send a written request to the address provided in the “Contact IBACTP” section.

Please include:

• Your full name;
• The email address associated with your account;
• The IBACTP service involved;
• A clear description of your request; and
• Your preferred method of response.

Do not send passwords, complete payment-card details, complete government identification numbers, examination content, or other highly sensitive information through ordinary email.

IBACTP may verify your identity before completing a request. Verification will be proportionate to the sensitivity of the requested information.

An authorized agent may submit a request where permitted by law. IBACTP may require evidence of the agent’s authority and direct verification from the individual.

IBACTP will respond within the period required by applicable law.

If a request is denied, we will explain the reason when legally permitted and provide appeal instructions when required.

IBACTP will not unlawfully discriminate against an individual for exercising a privacy right.

Residents of California and certain other U.S. states may have rights concerning:

• Access;
• Correction;
• Deletion;
• Portability;
• Sale;
• Sharing;
• Targeted advertising;
• Profiling; and
• Sensitive personal information.

The categories of personal information IBACTP may collect are described in Section 3. The purposes of processing are described in Section 5. The categories of recipients are described in Section 7.

IBACTP does not use sensitive personal information to infer characteristics for advertising purposes.

IBACTP does not knowingly sell or share the personal information of individuals under 18.

If IBACTP uses website technologies that constitute sale, sharing, or targeted advertising under applicable state law, IBACTP will provide an appropriate opt-out mechanism.

Where applicable, you may appeal a denied privacy request by replying to the decision or emailing info@ibactp.org with the subject line:

Privacy Appeal

Individuals in the European Economic Area, United Kingdom, or Switzerland may have rights to:

• Access;
• Correction;
• Erasure;
• Restriction;
• Objection;
• Data portability;
• Withdrawal of consent; and
• Complaint to a supervisory authority.

You may object to processing based on legitimate interests.

You may object at any time to the use of your information for direct marketing. IBACTP will stop sending direct marketing, although it may retain a limited suppression record to continue honoring your request.

IBACTP’s services are intended primarily for adults, university students, and working professionals.

IBACTP services are not directed to children under 13, and we do not knowingly collect personal information from children under 13 through our general services.

Individuals under 18 may participate only when:

• The applicable program permits their participation;
• Required parent or guardian authorization has been obtained;
• Appropriate privacy and security safeguards are in place; and
• Applicable law permits the processing.

If we learn that personal information was collected from a child contrary to applicable law, we will take reasonable steps to delete it.

Contact info@ibactp.org if you believe a child has improperly provided personal information.

IBACTP may collect information necessary to evaluate and provide a reasonable accommodation.

Accommodation and health-related information will be:

• Limited to what is reasonably necessary;
• Used only for accommodation and legal-compliance purposes;
• Available only to personnel and providers with a legitimate need;
• Protected by appropriate safeguards;
• Kept separate from public credential records; and
• Retained only as long as reasonably necessary.

Accommodation information will not be used for advertising or general marketing.

IBACTP may investigate suspected:

• Candidate impersonation;
• Unauthorized collaboration;
• Plagiarism;
• Use of prohibited materials;
• Prohibited AI assistance;
• Examination-content theft;
• Falsified education or experience;
• Fraudulent identity documents;
• Credential misuse;
• Ethics violations; or
• Other violations of certification policies.

An investigation may involve:

• Examination logs;
• Proctoring records;
• Audio or video recordings;
• Device and network information;
• Submitted assignments;
• Similarity reports;
• Communications;
• Prior testing records;
• Witness information;
• Provider records; and
• Relevant sponsor or partner information.

Access to investigation information will be restricted.

Information may be disclosed when reasonably necessary for:

• Internal review;
• Appeal;
• Policy enforcement;
• Legal compliance;
• Credential protection; or
• Protection of the public.

A materially adverse decision should include appropriate notice and a reasonable opportunity for review or appeal under IBACTP’s published policies.

IBACTP websites may contain links to third-party websites, services, social networks, or applications.

IBACTP does not control and is not responsible for the independent privacy practices of those third parties.

Information posted publicly on a social platform may be visible to the platform, other users, and the public.

Review the relevant third-party privacy notice before submitting personal information.

IBACTP may update this Privacy Policy to reflect changes in:

• Applicable law;
• Technology;
• Certification programs;
• Vendors;
• Services;
• Security practices; or
• Organizational operations.

The revised Policy will be posted on the IBACTP website with an updated “Last Updated” date.

If a change materially affects how personal information is used, IBACTP will provide additional notice where required, such as through:

• Email;
• An account notification;
• A website banner; or
• Another prominent notice.

Continued use of an IBACTP service will not constitute consent when applicable law requires a separate affirmative choice.

Questions, requests, complaints, or concerns about this Privacy Policy or IBACTP’s privacy practices may be directed to:

International Board of AI, Cybersecurity & Technology Professionals (IBACTP®)IBACTP® HeadquartersAttn: Privacy Office122 W John Carpenter Fwy, Suite 325Irving, TX 75039United States

General and Privacy Inquiries: info@ibactp.orgCertification Inquiries: certification@ibactp.orgAdministrative and Partner Inquiries: admin@ibactp.org

When contacting IBACTP, do not send passwords, complete payment-card details, complete government identification numbers, confidential examination content, or sensitive records through ordinary email.

IBACTP encourages you to contact us first so that we can review and attempt to resolve your concern.

Depending on your location, you may also have the right to submit a complaint to:

• A state attorney general;
• A data-protection authority;
• A privacy regulator;
• A consumer-protection agency; or
• Another competent supervisory authority.