GTConcepts NGCBT
GTConcepts CBT · Legal

Privacy Policy

How GTConcepts CBT collects, uses, protects and shares personal information about organisations, their team members and candidates.

⇩ Download PDF Read the Terms of Use Last updated: 27 September 2026

This Privacy Policy explains how GTConcepts NG ("GTConcepts", "we", "us") collects, uses, shares and protects personal information when you use GTConcepts CBT at cbt.gtconcepts.com.ng, including the organisation portal, the candidate exam area and our support channels. It is written to meet the Nigeria Data Protection Act 2023 (NDPA) and the guidance of the Nigeria Data Protection Commission (NDPC).

1. Who is responsible for your information

GTConcepts CBT is used by schools, companies, training providers, recruiters and other organisations ("Organisations") to run computer-based tests for their candidates.

  • Organisation accounts and team members: GTConcepts decides how this information is used and is the data controller.
  • Candidates: the Organisation that registers you and sets your exam decides why your information is collected and what happens to your results. The Organisation is the data controller and GTConcepts processes that information on its behalf, following its instructions and this policy.

If you are a candidate, please contact the Organisation that invited you first for questions about your exam, results or records. We will help them respond.

2. Information we collect

Information you or your Organisation give us

  • Account details: name, email address, phone number, organisation name, job title and password (stored only as a secure one-way hash).
  • Candidate details added by an Organisation: name, username, email or phone number, candidate number, group, class or department, and any other fields the Organisation chooses to record.
  • Exam content: question banks, instructions, attachments and settings created by the Organisation.
  • Exam activity: answers, marks, scores, time taken, start and finish times, attempts, certificates and result documents.
  • Billing information: selected plan, invoices, payment references, vouchers and proof of payment you upload. Card details are entered on the payment provider's secure page; we do not see or store full card numbers.
  • Messages you send us through email, the contact form or the support assistant.

Information collected automatically

  • Security and usage records: sign-in times, IP address, browser and device type, pages visited and actions taken, kept in audit logs to protect accounts and investigate problems.
  • Exam integrity signals, where the Organisation has switched them on: for example leaving the exam window, full-screen exits, copy and paste attempts and, for enhanced proctoring, camera snapshots taken during the exam.
  • Cookies needed to keep you signed in and to protect forms against misuse (see section 9).

3. How we use information

  • To create and manage accounts, workspaces, team access and candidate log-ins.
  • To deliver exams, mark objective answers automatically, record results and produce result slips and certificates.
  • To process subscriptions, verify payments, issue receipts and send renewal reminders.
  • To keep the platform secure: detecting unusual sign-ins, preventing abuse, applying request limits and keeping audit trails.
  • To provide support, answer enquiries and send important service messages such as verification codes, password resets and changes to these terms.
  • To improve the service using aggregated statistics that do not identify individuals.
  • To meet legal, tax, accounting and regulatory obligations.

We do not sell personal information and we do not use candidate information for advertising.

  • Contract: to provide the service an Organisation or individual has signed up for.
  • Legitimate interests: to secure the platform, prevent fraud and improve the service, balanced against your rights.
  • Legal obligation: to keep financial records and respond to lawful requests.
  • Consent: where the law requires it, for example optional marketing messages. You may withdraw consent at any time.

For candidate information, the Organisation is responsible for having a lawful basis and for telling candidates how their information is used, including any proctoring.

5. Exam integrity and automated marking

Objective questions are marked automatically against the answers set by the Organisation. Written answers may be marked by the Organisation's staff. Integrity signals and proctoring evidence are provided to help the Organisation supervise the exam; on their own they do not prove misconduct. The Organisation, not GTConcepts, decides on results and any action taken, and candidates who disagree with a result should contact that Organisation.

6. Who we share information with

  • The Organisation: candidate records, answers, results and integrity evidence are available to the Organisation that set the exam and to the team members it authorises.
  • Service providers that help us run the platform, under confidentiality and data protection terms: web hosting, email delivery, payment processing, backup storage and security services.
  • Connected systems: where an Organisation uses our API or integrations, information is sent to the systems that Organisation connects.
  • Authorities: where required by law, court order or to protect the rights, property or safety of users or the public.
  • Business changes: a buyer or successor if our business is reorganised or sold, under the same protections.

7. International transfers

Some of our service providers (for example email, backup or payment services) may store or process information outside Nigeria. Where this happens we rely on the safeguards allowed under the NDPA, such as adequacy decisions, contractual protections or your consent, and we choose providers with recognised security standards.

8. How long we keep information

  • Account and Organisation records are kept while the account is active and for a reasonable period afterwards to handle renewals, disputes and legal duties.
  • Candidate records, answers and results are kept for as long as the Organisation keeps them in its workspace, or until it asks us to delete them.
  • Proctoring evidence, audit logs, verification codes and other temporary security records are deleted automatically after set retention periods.
  • Financial records are kept for as long as tax and accounting law requires.
  • Backups are overwritten on a rolling basis.

9. Cookies

We use essential cookies only: a session cookie that keeps you signed in, and a security token that protects forms. These are required for the service to work and are removed when you sign out or close your browser. We do not use advertising or cross-site tracking cookies.

10. How we protect information

  • Encrypted connections (HTTPS) for all pages.
  • Passwords stored as one-way hashes; optional two-step sign-in for administrators.
  • Separation of each Organisation's data, role-based access for team members and audit logging.
  • Request limits, firewall protection and regular backups kept in private storage.

No system is completely secure. Please keep passwords private, give team members only the access they need and protect any results or candidate lists you export.

11. Your rights

Under the NDPA you may ask to:

  • access the personal information held about you;
  • correct information that is wrong or incomplete;
  • delete information that is no longer needed;
  • restrict or object to certain processing;
  • receive your information in a portable format;
  • withdraw consent where processing is based on consent.

Candidates should send requests to their Organisation, which controls their records; we will support the Organisation in responding. Account holders can contact us directly at cbt-support@gtconcepts.com.ng. We may need to confirm your identity first and will respond within the time the law allows. You also have the right to complain to the Nigeria Data Protection Commission (ndpc.gov.ng).

12. Children

Schools and other Organisations may register candidates under 18. The Organisation is responsible for obtaining any consent required from a parent or guardian and for giving them the information in this policy. We use children's information only to deliver the exams set by their Organisation.

13. Data breaches

If a breach affects personal information, we will act to contain it, inform affected Organisations without undue delay and notify the Nigeria Data Protection Commission and affected people where the law requires.

14. Changes to this policy

We may update this policy as the service or the law changes. The date at the top of this page shows the latest version. For significant changes we will notify Organisation owners by email or in the portal.

15. Contact us

Questions about this document? Contact us⇩ Download PDF