In short: players use ThinkTest to practise and compete, and institutes use it to hold exams. We decide how personal players’ data is used; for institute data, the institute decides and we process it on its behalf. We also keep a small amount of data of our own to run your NVDRA account, bill institutes and keep the service secure. We do not sell personal data and we do not show advertising.
Who we are and our role
ThinkTest is provided by NVDRA Technologies. This policy explains how personal data is handled in ThinkTest.
- Data a institute puts into ThinkTest: the institute decides what to collect and why, and is responsible for it. We process this data only on its instructions, as set out in our Data Processing Terms. If your information was entered by a institute, please contact it first; we will help it answer you.
- Your personal use of ThinkTest: when you practise, take challenges and appear on leaderboards on your own Player profile, NVDRA Technologies decides how that data is used and is responsible for it.
- Data we use for our own purposes (your NVDRA account, billing, security logs, support requests, our public pages): NVDRA Technologies is responsible for it.
Pakistan does not yet have a general personal data protection law in force. We follow the Prevention of Electronic Crimes Act, 2016, the Electronic Transactions Ordinance, 2002 and the other laws that apply to us, and we have designed this policy around widely accepted data protection principles: collecting only what is needed, using it only for clear purposes, keeping it secure, and keeping it no longer than necessary. We will update this policy when a data protection law comes into force.
What personal data is processed
| Whose data | What | Where it comes from |
|---|---|---|
| Everyone with an NVDRA account | Name, email address, mobile / WhatsApp number, password (stored only as a one-way hash), the organisations and roles you belong to, sign-in history. | You, or the institute that invited you |
| Players | Name, profession, country, state and city, tests taken, answers, times, points, accuracy and ranks, challenges, question reports. | You |
| Institute students | Name, class and section, enrolments, exam answers, marks, results, time taken and how often the test window lost focus. | The institute, AdvansEdu (rosters), the student |
| Teachers and institute staff | Name, role, subjects and classes taught, questions written, exams created. | The institute |
| Shared results | A challenge or result you choose to share is visible to anyone with its link. | You |
| Billing | The institute’s name and contact person, invoices and payment proofs (for example, bank transfer receipts). | The Owner |
| Technical data | IP address, browser and device type, sign-in sessions, security and error logs, push notification subscriptions. | Your browser or device |
ThinkTest does not ask for CNIC numbers, addresses or photos. Many students are children; see the section on children below.
How the data is used
- To run practice tests, challenges and leaderboards for players.
- To provide ThinkTest to institutes: question banks, classes, exams, results and analytics.
- To notify people about upcoming exams, results and challenges, by in-app notification, push notification or email.
- To keep exams fair: counting focus loss during tests and reviewing reported questions.
- To sign you in once across NVDRA applications through our single sign-on service.
- To bill institutes and verify payment proofs.
- To keep the Service and its users safe: preventing fraud and abuse and protecting accounts.
- To support you and to fix problems you report.
- To improve the Service using aggregated usage information (for example, how many organisations use a feature), not the contents of your records.
- To meet legal obligations, such as keeping records the law requires and responding to lawful requests.
Our reasons for processing are: performing our contract with the institute and with you; the institute’s instructions; consent where it is needed (for example, push notifications on your device); our legitimate interest in running a secure, reliable service; and legal obligations. We make no decisions about people based solely on automated processing that have legal or similarly significant effects.
Leaderboards and public pages
World and country leaderboards are public. They show a player’s name, profession, city and country, the number of tests, points and accuracy. Results inside an institute are shown only to that institute and the student. If you do not want to appear on public leaderboards, write to us and we will remove you.
Children
- Students who are children use ThinkTest through their institute, which is responsible for their parents’ or guardians’ consent.
- We never use children’s data for advertising or marketing profiles, and we do not sell it.
- Personal Player profiles are for people aged 13 or over.
Who receives the data
We do not sell or rent personal data. It is shared only as follows:
- The public: leaderboards and the challenge or result links you share.
- Within an institute: according to the roles it sets. Teachers see their classes’ results; students see their own.
- AdvansEdu: when a school connects it, class rosters come from AdvansEdu and exam marks are sent back to the school’s AdvansEdu results.
- Service providers who help us run ThinkTest and may only use the data to do so: hosting and backup providers, email delivery providers, and the push services of browser and phone makers (such as Google, Apple and Mozilla).
- Other NVDRA applications the institute connects, which receive only the data needed for the connection.
- Authorities, when required by law, a court order, or a lawful request of an investigating agency under the Prevention of Electronic Crimes Act, 2016, or when needed to protect someone’s safety. Where the law allows, we tell the institute first.
- A buyer or successor of our business, under the same protections, if the Service is transferred. We will tell institutes before that happens.
Where the data is stored
ThinkTest is hosted on servers operated by our hosting providers, which may be located in Pakistan or abroad. Some providers listed above process data in other countries. When data is processed outside Pakistan we use providers that apply recognised security standards, and we limit what they receive to what is needed. If Pakistani law requires certain data to be kept in Pakistan, we will comply.
How long data is kept
- Institute records are kept while the institute’s account is open and as long as the institute keeps them.
- After a institute closes its account, its data stays available for export for 30 days and is then deleted from the live system within a further 60 days. Backups are overwritten on a rolling cycle of up to 90 days.
- Player history: your practice history and leaderboard points are kept while your NVDRA account is open, or until you ask us to delete them.
- Your NVDRA account is kept until you ask us to delete it or it has been inactive for a long period and is no longer linked to any organisation.
- Billing records are kept for as long as tax and accounting laws require.
- Security and access logs are kept for at least one year, as service providers are required to retain traffic data under the Prevention of Electronic Crimes Act, 2016, and longer if needed for an investigation.
How the data is protected
- All connections use HTTPS encryption, and passwords are stored only as one-way hashes; we cannot see them.
- Access is based on roles, so each person sees only what their role needs. Private files are stored outside the public web folder and served only to people allowed to see them.
- Access by NVDRA staff is limited to authorised people for support, security and legal reasons. When a senior administrator signs in as a User from the NVDRA Admin Panel, a reason is required, a banner shows it is NVDRA access, and the session is recorded in audit logs.
If a security incident affects personal data, we will inform the affected institute without undue delay so that it can inform the people concerned, and we will take steps to limit the harm.
Your choices and rights
You can ask to see the personal data held about you, to correct it, to delete it where it is no longer needed, to receive a copy in a common format, or to object to a use of it. You can also turn push notifications off in your browser or phone settings, and change your name, email, phone and password in your NVDRA account.
For records kept by a institute, please contact the institute; it decides on the request and we help it. For anything else, write to support@nvdra.com. We will reply within 30 days. We may need to confirm your identity first, and some data may have to be kept for legal reasons; if so, we will explain why.
Cookies
ThinkTest uses only the cookies and browser storage needed for signing in, security and remembering your choices. It does not use advertising or tracking cookies. See the Cookie Policy.
Changes to this policy
We will update this policy when our practices or the law change, and show the date of the latest version at the top. If a change materially affects how personal data is used, we will tell you by email or in the app before it takes effect.
Contact
NVDRA Technologies
Email: support@nvdra.com