Legal

Privacy Policy

How we collect, use, store, and protect personal data — including the candidate data our customers process through Assess.

Effective date: 4 August 2026

The short version.

We hold two kinds of personal data. For your account users, we decide how the data is used and you deal with us directly. For participants, the organisation decides — we only process what it instructs, and candidate requests go to that organisation. We do not sell personal data.

1. Who we are

Deployza Labs Private Limited operates the ZiniApps Assess assessment platform and this website. Where this policy says "we", "us", "ZiniApps", or "the platform", it refers to that company.

Registered office

Deployza Labs Private Limited
Empire Estate, Bicholi Mardana
Bypass Road, Indore
Madhya Pradesh 452016, India

For privacy questions, create a ticket, or write to us at the address above.

2. Our two roles

Assess processes two different categories of personal data under two different legal roles. The distinction determines who you contact about your data.

Whose data	Our role	What that means
Customer users admins, reviewers, anyone with a ZiniApps login	Controller	We determine why and how this data is processed. Exercise your rights with us directly.
Candidates people invited to sit an assessment	Processor	The organisation running the assessment is the controller. We act only on its instructions. Participant rights requests are directed to that organisation.

If you are a candidate and do not know which organisation to contact, write to us and we will route your request to the organisation that issued your assessment.

Candidates: who is responsible for your data. The organisation that invited you to an assessment decides what is collected, why, and for how long. It is responsible for obtaining your consent where consent is required, and for telling you before the assessment that it is proctored and what is recorded. We store and process that data on its instructions and do not use it for our own purposes.

3. Information we collect

3.1 Account and contact data

Name, work email address, organisation name, role, and the country selected at signup.

3.2 Participant data supplied by our customers

Participant name, contact details, and the profile an assessment is conducted for. This data is supplied by the organisation running the assessment, not collected by us from participants directly.

3.3 Assessment data

Answers submitted, scores, section-wise results, start and end times, and the status of each attempt.

3.4 Proctoring data

Where an assessment is proctored, we process on the instructions of the organisation running it:

periodic camera stills and screen images;
short audio clips;
fullscreen and focus events, each timestamped;
device fingerprint snapshots (a baseline and subsequent changes);
the participant's self-declared camera and microphone status;
which client produced the evidence.

Proctoring observes and records. It does not block an attempt, and it produces no automated decision about a participant. See our Proctoring page.

3.5 Billing data

Organisation billing profile, orders, credits purchased, and invoices. Card details are handled by our payment provider and never reach our systems.

3.6 Usage, cookies, and device data

Log data, IP address, browser and device characteristics, and cookie identifiers. See our Cookie Policy.

4. Legal basis for processing

Where the GDPR or UK GDPR applies and we act as controller, we rely on the following bases:

Basis	Used for
Performance of a contract	Providing the platform to our customers, billing, and support.
Legitimate interests	Securing the platform, preventing abuse, and improving the service — balanced against your rights.
Consent	Non-essential cookies and optional marketing communications, withdrawable at any time.
Legal obligation	Tax, accounting, and responding to lawful requests.

For participant data we act as processor: the lawful basis is determined by the organisation, which is responsible for establishing it and for notifying candidates that an assessment is proctored and what is captured.

5. How we use your information

Deliver the platform: create tests, issue invitations, run and score assessments.
Make proctoring evidence available to reviewers in the owning organisation.
Process payments, generate invoices, and maintain credit balances.
Secure the platform, investigate abuse, and maintain audit records.
Provide support and send service communications.
Meet our legal and regulatory obligations.

We do not use candidate data to train models, and we do not make automated decisions that produce legal or similarly significant effects on candidates.

We do not sell personal data. We share it only as follows:

The organisation running the assessment — participant data and results are available to reviewers in the organisation that issued the assessment.
Legal requirements — where we are required to disclose by law or valid legal process.
Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this policy continuing to apply.

6.1 Categories of sub-processor

We engage service providers to operate the platform. Each is bound by contract to process personal data only on our instructions and to maintain appropriate security. We use providers in the following categories:

cloud hosting and infrastructure providers;
object storage providers (used for proctoring evidence);
payment processing providers;
email delivery providers;
bot-protection and captcha providers;
website analytics providers;
chat and customer-support system providers.

If you need the current list of named providers — for example for a vendor assessment or a data protection impact assessment — contact us and we will supply it.

7. Data retention

We keep personal data only as long as needed for the purposes above, or as required by law. Account data is retained for the life of the account and a limited period after closure; billing records are retained for the period required by tax law; assessment results and proctoring evidence are retained on behalf of that organisation and deleted on its instruction or at the end of the agreed retention period.

Proctoring evidence — camera stills, screen images, and audio clips — is retained on behalf of that organisation for as long as it maintains an active account with us, and is deleted on that organisation's instruction. An organisation may request deletion of a specific attempt's evidence at any time.

Where we are required by law to retain records — tax and accounting records in particular — we retain them for the period that law prescribes, even if you ask us to delete them earlier.

8. Your rights

8.1 If you are a customer user

Subject to applicable law, you may request access to your data, correction of inaccurate data, erasure, restriction of processing, portability, and you may object to processing based on legitimate interests. Contact us to exercise any of these.

8.2 If you are a candidate

Direct your request to the organisation that invited you to the assessment — it is the controller of your data and instructs us on what to do with it. We will assist that organisation in responding. If you cannot identify or reach it, contact us and we will route your request.

8.3 Regional rights

EU / UK (GDPR, UK GDPR) — the rights listed above, plus the right to lodge a complaint with your supervisory authority.
California (CCPA/CPRA) — rights to know, delete, correct, and to opt out of sale or sharing. We do not sell or share personal information as those terms are defined.
India (DPDP Act) — rights of access, correction, erasure, and grievance redressal.
Brazil (LGPD), Canada (PIPEDA), Singapore and Thailand (PDPA) — equivalent access, correction, and deletion rights under those regimes.

We do not discriminate against anyone for exercising a privacy right.

9. International data transfers

Personal data may be processed in countries other than the one you live in. Where we transfer data out of the EEA, the UK, or another jurisdiction with transfer restrictions, we rely on an appropriate safeguard — typically Standard Contractual Clauses or an adequacy decision.

10. Children's privacy

The platform is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child's data has been provided to us, contact us and we will delete it.

11. Security

We apply technical and organisational measures appropriate to the risk: encryption in transit, organisation-scoped access to every record, role-based permissions, and storage of proctoring evidence in object storage separate from application data. See our Security page. No system is perfectly secure, and we do not claim otherwise.

12. Cookies

Our use of cookies and similar technologies is described in the Cookie Policy, including how to manage or withdraw consent.

13. Policy updates

We may update this policy. Where a change is material, we will give notice through the platform or by email before it takes effect. The effective date at the top of this page always reflects the current version.

14. Contact

Privacy enquiries: create a ticket, or write to us at the postal address below.