Engdemy Education Inc. Privacy Policy

1. Introduction & Who We Are

Engdemy Education Inc. ("Engdemy", "we", "us", or "our") is an educational technology company incorporated in Canada. We operate the English exam preparation services available at www.engdemyeducation.com (the "Services").

We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains what information we collect, why we collect it, how we use and protect it, and what rights you have over your data. It applies to all users worldwide, and we comply with:

• Canada's Personal Information Protection and Electronic Documents Act (PIPEDA)
• Quebec's Act respecting the protection of personal information in the private sector (Law 25 / Bill 64)
• The European Union's General Data Protection Regulation (GDPR) (for users in the EU/EEA)
• Other applicable provincial and territorial privacy legislation

Data Controller: Engdemy Education Inc. is the data controller responsible for your personal information collected through our Services.

2. Information We Collect

We collect only the information necessary to provide and improve our Services:

2.1 Information You Provide Directly

• Account Information: Name, email address, and password when you register.
• Payment Information: Billing details processed securely through our payment processors. We do not store full credit card numbers on our servers.
• Communications: Messages or inquiries you send us via email or contact forms.
• Test & Assessment Data: Answers, scores, and writing samples submitted while using our practice tests.

2.2 Information Collected Automatically

• Usage Data: Pages visited, features used, time spent, and actions taken on our platform.
• Device & Log Data: IP address, browser type, operating system, referring URLs, and crash reports.
• Cookies & Similar Technologies: See Section 6 for full details.

2.3 Information from Third Parties

• If you sign in via a third-party provider (e.g., Google), we receive your name and email from that provider, subject to their privacy policy.

3. Legal Basis for Processing (GDPR & PIPEDA)

We process your personal information only when we have a valid legal basis. Depending on the activity, we rely on the following legal grounds:

• Contract Performance: Processing is necessary to provide our Services to you under our Terms & Conditions (e.g., account management, delivering courses).
• Legitimate Interests: We process certain data to improve our platform, detect fraud, and ensure security, where these interests are not overridden by your rights.
• Consent: For optional activities such as marketing emails or non-essential cookies, we rely on your explicit consent, which you may withdraw at any time.
• Legal Obligation: Where we are required to process data to comply with applicable law (e.g., tax records, responding to court orders).

Under PIPEDA and Quebec Law 25, we obtain meaningful consent before or at the time of collection of personal information. You may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice, by contacting us at the address below.

4. How We Use Your Information

We use your personal information to:

• Create & Manage Your Account: Authenticate your identity and maintain your user profile.
• Provide Services: Deliver practice tests, track your progress, and personalize your learning experience.
• AI-Powered Scoring: Send writing samples to our AI scoring service solely to generate feedback. Your data is processed under our AI provider's data processing agreement and is not used to train their models under our enterprise terms.
• Process Payments: Fulfill purchases securely via our payment processor.
• Customer Support: Respond to your inquiries and resolve issues.
• Service Improvement: Analyze usage patterns to improve functionality, content, and user experience.
• Communications: Send transactional emails (e.g., receipts, password resets) and, with your consent, marketing communications.
• Security & Fraud Prevention: Monitor for suspicious activity and protect against unauthorized access.
• Legal Compliance: Meet our obligations under applicable law.

We will not use your personal information for any purpose not described in this policy without first obtaining your consent.

5. How We Share Your Information

We do not sell, rent, or trade your personal information. We share it only in the following limited circumstances:

• Service Providers: Trusted third-party vendors who assist in operating our platform (e.g., cloud hosting, payment processing, AI scoring, email delivery). All service providers are bound by data processing agreements and may only use your data on our behalf.
• Legal Requirements: We may disclose information if required by law, regulation, court order, or governmental authority.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred. We will notify you before your information becomes subject to a different privacy policy.
• Protection of Rights: To enforce our Terms & Conditions, protect our rights, or prevent harm or illegal activity.
• With Your Consent: For any other purpose with your explicit consent.

Cross-Border Transfers:

Some of our service providers may be located outside Canada (e.g., United States). When transferring personal information internationally, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) for EU users (GDPR) or equivalent contractual protections required under PIPEDA. Your data may be subject to the laws of the country where these providers operate.

6. Cookies & Tracking Technologies

We use cookies and similar technologies to operate and improve our Services:

• Essential Cookies: Required for the platform to function (e.g., authentication sessions). These cannot be disabled.
• Analytics Cookies: Help us understand how users interact with our platform to improve performance. Used only with your consent.
• Preference Cookies: Remember your settings and preferences for a better experience.

You can control cookie preferences through your browser settings or our cookie preference manager (where available). Disabling certain cookies may limit the functionality of our Services. Under Quebec Law 25, we obtain consent before using non-essential cookies.

7. Data Security

We implement industry-standard technical and organizational security measures to protect your personal information, including:

• Encryption of data in transit using TLS (HTTPS)
• Hashed and salted password storage
• Access controls limiting data access to authorized personnel only
• Regular security reviews of our systems and practices

Despite our efforts, no method of transmission over the internet or electronic storage is 100% secure. In the event of a data breach that poses a real risk of significant harm, we will notify the Office of the Privacy Commissioner of Canada (OPC), relevant provincial authorities, and affected individuals as required under PIPEDA and Quebec Law 25 (within 72 hours under GDPR for EU-impacting breaches).

8. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes described in this policy, or as required by law. Specifically:

• Account Data: Retained for the duration of your account and up to 2 years after account deletion or last activity, unless a longer period is required by law.
• Transaction Records: Retained for 7 years as required by Canadian tax legislation.
• Test & Assessment Data: Retained for the duration of your account to support your progress tracking, then deleted upon account deletion.
• Log Data: Typically retained for 90 days for security and diagnostic purposes.

When your information is no longer needed, we securely delete or anonymize it.

9. Your Privacy Rights

Depending on your location and applicable law, you have the following rights regarding your personal information. We will respond to all verifiable requests within 30 days(or within the timeframe required by applicable law).

9.1 Rights Under PIPEDA & Quebec Law 25 (Canadian Users)

• Right to Access: Request a copy of the personal information we hold about you.
• Right to Correction: Request correction of inaccurate or incomplete information.
• Right to Withdraw Consent: Withdraw consent at any time (subject to legal or contractual restrictions).
• Right to File a Complaint: Lodge a complaint with the Office of the Privacy Commissioner of Canada (OPC) at www.priv.gc.ca or with the Commission d'accès à l'information (CAI) for Quebec users.
• Right to be Informed of Automated Decision-Making: Be informed of any significant decisions made about you through automated means (Quebec Law 25).

9.2 Additional Rights Under GDPR (EU/EEA Users)

• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data under certain circumstances.
• Right to Restriction of Processing: Request that we limit how we use your data under certain circumstances.
• Right to Data Portability: Receive your data in a structured, machine-readable format and transfer it to another controller.
• Right to Object: Object to processing based on legitimate interests or for direct marketing purposes.
• Right Not to Be Subject to Automated Decisions: Not be subject to solely automated decisions that significantly affect you, including profiling.
• Right to Lodge a Complaint: File a complaint with your local EU data protection authority (DPA).

To exercise any of these rights, please contact our Privacy Officer at info@engdemy.com. We may need to verify your identity before processing your request.

10. Children's Privacy

Our Services are not directed to children under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected personal information from a child under 16 without verified parental consent, we will take steps to delete that information promptly. If you believe a child has provided us with personal information, please contact us at info@engdemy.com.

11. Third-Party Links & Services

Our Services may contain links to third-party websites or integrate with third-party tools. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party sites you visit.

12. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices or applicable law. When we make material changes, we will:

• Post the updated policy on this page with a new "Last Reviewed" date.
• Notify you by email or prominent notice on our platform at least 30 days before significant changes take effect (where required by law).
• Re-obtain your consent where the change affects how we process data based on consent.

Continued use of our Services after changes become effective constitutes acceptance of the updated policy, where permitted by law.

13. Privacy Officer & Contact Us

We have designated a Privacy Officer responsible for overseeing compliance with this policy and applicable privacy laws.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact:

If you are not satisfied with our response, you may escalate your complaint to:

• Office of the Privacy Commissioner of Canada (OPC): www.priv.gc.ca
• Commission d'accès à l'information du Québec (CAI): www.cai.gouv.qc.ca (Quebec users)
• Your EU Data Protection Authority (EU/EEA users)

14. Governing Law

This Privacy Policy is governed by the laws of Canada, including PIPEDA and applicable provincial legislation. For users in the European Union or European Economic Area, the GDPR applies to our processing of your personal data.