Privacy Policy

Last updated: September 2026 · OFM TEST (ofmtest.com)

1. Who we are

OFM TEST is a candidate assessment and training platform operated for hiring agencies ("Agency", "customer"). When you apply through OFM TEST, the Agency you applied to is the data controller for your application data, and OFM TEST acts as the processor. For platform accounts (agency sign-ups), OFM TEST is the controller.

2. What data we collect

• Account data: name, email, password (hashed), WhatsApp, Telegram, country, role applied for
• Assessment data: test answers, scores, final written answers, recorded speaking clip
• Proctoring data: periodic camera snapshots during tests, window focus events, paste attempts, fullscreen exits, screenshot attempts
• Integrity signals: your IP address and a device fingerprint (a hashed identifier derived from your browser) — used to detect duplicate applications, shared devices and retakes
• KYC documents (only if you progress to training/hire): a photo of your ID document and a selfie holding it
• Agreements: your typed name, drawn signature image, signing timestamp and IP for the NDA and hire agreement
• Invitation measurement: per-link session hashes, campaign labels, referrer hostnames, playback/click events and a temporary link to registrations, as described below
• Billing data (agencies): payment sessions, on-chain transaction hashes, subscription dates. We never see your private keys.

3. Why we process it (legal basis, GDPR Art. 6)

• Contract (6(1)(b)): running your application and assessment, and providing the service to the Agency
• Consent (6(1)(a)): proctoring snapshots, KYC uploads and data sharing with the Agency — you explicitly tick this when signing the assessment agreement
• Legitimate interest (6(1)(f)): fraud prevention, duplicate detection via IP/device signals, platform security
• Legal obligation (6(1)(c)): age-verification records for adult-industry compliance where required

4. Who can see your data

• The Agency you applied to — your profile, test results, integrity signals (including IP flags), proctoring snapshots while your application is open, KYC documents and signed agreements
• OFM TEST — as the technical processor, to run and secure the service
• Service providers strictly as needed (email delivery, AI test features via agency-supplied or platform keys)
• We never sell your data. Data of one agency is never visible to another agency.

5. Retention & deletion

• Proctoring snapshots are deleted automatically the moment the Agency makes a hiring decision (advance/reject), and after 30 days of inactivity in any case
• KYC documents and signed agreements are retained while the working relationship exists and for 24 months for compliance
• Invitation visit records, events and registration links are retained for approximately 90 days
• Other application data is retained while the application is active; the Agency can delete a candidate at any time

6. Your GDPR rights

Candidates can, at any time from their dashboard:

• Access & portability — one click exports all your data as a downloadable JSON file
• Erasure — one click permanently deletes your account, test data, proctoring images and KYC documents
• Rectification — correct your contact details from your profile
• Withdraw consent — you may stop the process at any point; withdrawal does not affect processing already lawfully completed

To exercise rights regarding agency-held records, contact the Agency or email privacy@ofmtest.com. We respond within 30 days.

7. Cookies & tracking

We use a session cookie for login and the invitation flow. For recruiter invite links, we also measure visits, first-entry campaign labels (UTM source, medium and campaign), referrer hostname, video playback milestones and apply-button clicks. This first-party measurement uses a per-link hash of the random session identifier, not a raw IP address or device fingerprint. A new visit begins after 30 minutes of inactivity. We do not use Google Analytics or advertising trackers for invitation measurement.

If you register during a tracked visit, a temporary link to that account lets the Agency measure email-verified signups using actual application records rather than browser claims. Agency dashboards show aggregate invitation statistics. Visit records, events and these signup links are removed after approximately 90 days; deleting your candidate account removes its signup link. Candidate records follow the retention rules above. Do not put personal information in campaign labels.

8. Security

Data is stored on an access-controlled server in the EU region, transported over TLS, and served through authenticated endpoints. Passwords are bcrypt-hashed. Snapshot and KYC media are only reachable by the owning agency's authenticated staff.

9. International transfers

AI-based test features may process text via external model providers. Where this happens, data leaves the EU only with the safeguards described in the agreement you signed (or, for agencies, the terms accepted at sign-up).

10. Contact

Data protection questions: privacy@ofmtest.com