Home » Privacy Policy

Privacy Policy

Personal Information Protection Policy

Canadian Test Centre is committed to safeguarding the personal information entrusted to us by our clients. This policy outlines the principles and practices we follow in protecting your personal information.

This policy applies to Canadian Test Centre and also applies to any person or company providing services on our behalf.

A copy of this policy is provided to any client on request.

What personal information do we collect?

Personal information means information about an identifiable individual. CTC collects a student’s name, ID number, date of birth, age, gender, and test scores/reports. CTC also collects the name and contact information for a teacher, principal, or district/division office staff member.

We collect only the personal information that we need for the purposes of providing services to our clients, including personal information needed to:

open and manage an account
deliver testing materials to a client or setup online access to tests
manage client data to process, score and report student assessment data
contact clients for training and support
follow up with clients to determine satisfaction with products and services
notify clients about available products and services

We normally collect client information directly from our clients. We may collect your information from other persons with your consent or as authorized by law.

We inform our clients, before or at the time of collecting personal information, of the purposes for which we are collecting the information. However, we don’t provide this notification when a client volunteers information for an obvious purpose (for example, producing a billing address).

Use of Service Providers outside Canada

Our service providers in the U.S.A. may (with your consent) use or disclose your personal information for the purpose of providing CTC with scannable answer documents with barcodes that identify a school and/or individual.

We ask for consent to collect, use or disclose client personal information, except in specific circumstances where collection, use or disclosure without consent is authorized or required by law. We may assume your consent in cases where you volunteer information for an obvious purpose.

In cases where we collected personal information before January 1, 2004, we assume your consent to our use and, where applicable, disclosure for the purpose for which the information was collected.

We ask for your express consent for some purposes and may not be able to provide certain services if you are unwilling to provide consent to the collection, use or disclosure of certain personal information. Where express consent is needed, we will normally ask clients to provide their consent orally (in person, by telephone), in writing (by signing a consent form, by checking a box on a form, or electronically (by clicking a button).

A client may withdraw consent to the use and disclosure of personal information at any time, unless the personal information is necessary for us to fulfil our legal obligations. We will respect your decision, but we may not be able to provide you with certain products and services if we do not have the necessary personal information.

We may collect, use or disclose client personal information without consent only as authorized by law. For example, we may not request consent when the information is publicly available, or to collect a debt owed to Canadian Test Centre, or to repay to a client money owed by Canadian Test Centre.

How do we use and disclose personal information?

We use and disclose client personal information only for the purposes for which the information was collected, except as authorized by law. For example, we may use student information to create class lists for teachers doing online testing, and we may also use them to create test score reports for use by schools and/or school jurisdictions. We may use client contact information to deliver testing materials or to set up accounts for online testing. The law also allows us to use contact information for the purpose of collecting a debt owed to our organization, should that be necessary.

If we wish to use or disclose your personal information for any new business purpose, we will ask for your consent.

How do we safeguard personal information?

We make every reasonable effort to ensure that client information is accurate and complete. We rely on our clients to notify us if there is a change to their personal information that may affect their relationship with our organization. If you are aware of an error in our information about you, please let us know and we will correct it on request wherever possible.

In some cases we may ask for a written request for correction.

We protect client personal information in a manner appropriate for the sensitivity of the information. We make every reasonable effort to prevent any loss, misuse, disclosure or modification of personal information, as well as any unauthorized access to personal information.

We will notify you, without delay, of a security breach affecting personal information if it creates a real risk of significant harm to individuals.

We retain client personal information only as long as is reasonable to fulfil the purposes for which the information was collected or for legal or business purposes. We keep test papers for 6 months after receiving them and then shred them. We keep electronic data files and electronic copies of score reports for 10 years and then permanently delete them.

The CTC Data Centre has a number of safeguards for data privacy and security. (Our protocols can also be modified to meet client requirements.) We currently use the following data security protocols.

PAPER TESTING

CTC office doors are dead-bolt locked and only CTC can gain access or give access to others.
The office security system alarm triggers a phone call and then a visit from a security company.
Student data is kept on a CTC server and can be accessed only from within the office; data cannot be accessed remotely.
Staff are not allowed to remove data (paper or electronic files) from the CTC office.
All staff working in the Data Centre must sign a confidentiality agreement.
Staff computers are password protected and daily backed up to the CTC office local server and weekly backed up to an offsite secure dedicated drive. All backup is encrypted.
At the client’s request, data can be temporarily uploaded to our secure FTP site for easy access (downloading) by client; the client must have login and password to access files. Authorized CTC staff remove all the reports/data from CTC’s secure site after the district/school finishes downloading the reports/data.
School Database Upload
- A client could upload their school database files to CTC’s secure site (with a username and password); the uploaded files are encrypted.
- Authorized CTC staff would download the database files, keep them on a password-protected computer at office, and then remove them immediately from the secure site.
- CTC could use the school database files for shipping materials and/or data management.
- CTC could also, if requested by the client, provide the database files to a vendor for printing identifying barcodes on testing documents. Authorized CTC staff would centrally upload the database files through an admin site which is password protected, and the data transmission is encrypted. The vendor would permanently delete the database files once the job has been completed.
Student answer documents are securely transported from our warehouse to a secure shredding company. The shredding company provides CTC with a Certificate of Destruction, certifying that everything was shredded on the day of removal.
Data files are kept for 10 years and then deleted (unless the client has a different requirement).

ONLINE TESTING

School and Student Database Upload

Clients upload their school and student database files to CTC’s secure site (with a username and password) using templates provided by CTC; the uploaded files are encrypted.
Authorized CTC staff download the database files, keep them on a password-protected computer at office, and then remove them immediately from the secure site.
Authorized CTC staff centrally upload the school and student database files to the online testing system through an admin site which is password protected and the data transmission is encrypted.
Client databases remain on servers located in Canada.

Test Data Download

Authorized CTC staff download student test data in the admin site through the data export functionality.
Authorized CTC staff generate reports once they download the data.
Clients download the reports from CTC’s secure site (with a username and password).
Authorized CTC staff remove all the reports/data from CTC’s secure site after the district/school finishes downloading the reports/data.
Client databases are permanently deleted from the online testing system each summer.

Access to records containing personal information

Clients of Canadian Test Centre have a right of access to their own personal information in a record that is in our custody or under our control, subject to some exceptions. For example, organizations are required under the Personal Information Protection Act to refuse to provide access to information that would reveal personal information about another individual. Organizations are authorized under the Act to refuse access to personal information if disclosure would reveal confidential business information. Access may also be refused if the information is privileged or contained in mediation records.

If we refuse a request in whole or in part, we will provide the reasons for the refusal. In some cases where exceptions to access apply, we may withhold that information and provide you with the remainder of the record.

You may make a request for access to your personal information by writing to David Galati, Director of Operations. You must provide sufficient information in your request to allow us to identify the information you are seeking.

You may also request information about our use of your personal information and any disclosure of that information to persons outside our organization. For personal information collected before January 2004, if we do not have a record of disclosures, we will provide information about any disclosure of your information that is likely to have occurred.

You may also request a correction of an error or omission in your personal information.

We will respond to your request within 45 calendar days, unless an extension is granted. We may charge a reasonable fee to provide information, but not to make a correction. We will advise you of any fees that may apply before beginning to process your request.

In the event of a privacy breach

In the event of a privacy breach, CTC would:

immediately notify the client of the privacy breach;
act immediately to mitigate the breach of privacy by identifying the source and closing the breach and would attempt to recover the private information;
if the source of the breach is technology-based, act immediately to enhance the technological safeguards;
if the source of the breach is human-based, act immediately to understand the reason for the breach and immediately implement additional training, discipline or employment termination, depending on the degree to which the breach was intentional and/or with malicious intent.
keep the client informed about how the breach has been addressed and is being addressed.

CTC Online Assessments

Terms of Use

CTC/Canadian Test Centre Inc. grants to users of its online assessment products a non-exclusive right to use its online assessments to the extent limited by contractual agreement between CTC and the user. This non-exclusive right is not transferable. All content and software applications provided to the client are copyright protected and may not be altered, reproduced or redistributed. The user shall not reverse engineer, recompile, or reverse assemble the software application. The user shall not capture images or in any other way make copies of the content or in an way describe the specific content found in the online assessments.

The web-based application stores the information provided by the user on a server in British Columbia, Canada. The information is used only for providing the web-based services to the end user. The end user shall be deemed to have agreed to such storage and use of information.

CTC and its third-party service providers make no warranty regarding the performance of the web-based applications or the accuracy of the content found in the applications. Software bugs and/or content errors, if discovered, would be fixed at the expense of CTC and its third-party service providers.

In no event will CTC or its third-party service providers be liable or responsible for damages arising for the user and/or damages due to claim for damage compensation made against the user by a third party arising out of the use of the web-based applications.

Questions and complaints

If you have a question or concern about any collection, use or disclosure of personal information by Canadian Test Centre, or about a request for access to your own personal information, please contact:

David Galati
Canadian Test Centre
david.galati@canadiantestcentre.com

If you are not satisfied with the response you receive, you should contact the Information and Privacy Commissioner for your province/territory.