Privacy Policy | EditingTests.com

Who We Are

EditingTests.com ("we", "us", "our") is operated by EditFast, an unincorporated business based in British Columbia, Canada. Since 1998 we have helped over 21,348 organisations assess editorial talent through our specialist testing platform.

We serve employers ("Clients") who need to evaluate job candidates ("Candidates") for editorial roles across 4,400+ industry specialisms.

Need to contact us about your data?

[email protected]

What This Policy Covers

This Privacy Policy explains how EditingTests.com protects your personal data when you:

• Visit editingtests.com and its subdomains
• Register for a Client account
• Take an assessment as a Candidate
• Download resources or playbook guides
• Contact us via any channel
• Use any feature of our platform

This policy complies with UK GDPR, EU GDPR 2016/679, PIPEDA (Canada), CCPA/CPRA (California), and other applicable data protection legislation worldwide.

Personal Data We Collect

Client Account Information

When you register as a Client, we collect:

✓ Name and job title
✓ Business email address
✓ Company name and sector
✓ Billing information (processed securely by Stripe — we do not store card details)
✓ Account preferences and settings
✓ Usage data (test sessions created, credits purchased and used)

Candidate Assessment Data

When a Candidate takes an assessment, we collect:

✓ Name (if provided by the inviting Client)
✓ Email address (for invitation and result delivery)
✓ Assessment responses, answers and written submissions
✓ Timing data (time taken per question and section)
✓ Browser and device information (for anti-cheat monitoring)
✓ IP address (for session integrity and fraud prevention)
✓ Test scores, percentile rankings and assessment reports

Important for Candidates: We process your data on behalf of the organisation that invited you to test. They control how your data is used in their recruitment process. Contact them directly for questions about your assessment data.

Resource Downloads

When you download guides or playbooks, we collect:

✓ Name
✓ Work email address
✓ Company name
✓ Job function or role (optional)

Contact and Enquiries

When you contact us, we collect your message content, email address, and any information you choose to provide.

Website Analytics

When you browse editingtests.com, we collect:

✓ Pages visited and time spent
✓ Referring URLs
✓ Browser type and version
✓ Device type and operating system
✓ IP address (anonymised for analytics)
✓ Cookie identifiers (see our Cookie Policy)

We use Google Analytics 4 for site measurement, and only where you have accepted analytics cookies in our cookie banner. If you decline, or before you choose, Google Analytics runs in consent-denied mode and stores nothing on your device. We do not enable Google Signals or advertising personalisation, and we do not share this data with any advertising network. Web-server access logs separately capture the above categories for operational and security purposes, are retained for 90 days, and are never linked to individual accounts.

Legal Basis for Processing (GDPR)

Contract Performance

To deliver assessment services and process Candidate evaluations under Client instructions.

Legitimate Interests

Platform improvement, fraud prevention, security, and business analytics—balanced against individual rights.

Consent

Marketing communications, non-essential cookies, and resource follow-ups. Withdraw anytime.

Legal Obligation

Where law requires data retention or disclosure (e.g., financial records for taxation).

How We Use Your Personal Data

→ Create and manage Client accounts
→ Deliver candidate assessment invitations and process test sessions
→ Generate, store and deliver assessment reports
→ Process payments via Stripe Checkout
→ Respond to support and sales enquiries
→ Send essential transactional emails (confirmations, invitations, results)
→ Send marketing communications (where opted in)
→ Improve and develop our platform, tests and content
→ Detect and prevent fraud, cheating, and abuse
→ Maintain anonymised benchmarking data for percentile calculations

Data Sharing and Third-Party Partners

We do not sell personal data to any third party.

We share personal data only with trusted partners who help us deliver our services:

Stripe, Inc.

Payment processing. PCI-DSS compliant. We do not store card numbers.

Hosting Infrastructure

Secure server hosting under applicable data protection standards.

Anthropic (Claude AI)

Content generation for industry-specific materials. Only industry names and vocabulary lists are transmitted—no personal data.

Email relay provider

TLS-secured SMTP relay for transactional email (invitations, receipts, password resets). The current named provider is listed on our Sub-processor List.

Professional Advisers & Legal Requirements

Lawyers, accountants, insurers (under confidentiality), and law enforcement (where legally required).

All third-party processors must follow our documented instructions and comply with applicable data protection law.

Our authoritative sub-processor list — including the current hosting provider (Hetzner Online GmbH, Germany), payment processor, email relay provider, and any other named third-party processors — is maintained at editingtests.com/sub-processors. When we add or change a sub-processor, we give Clients at least 30 days’ advance notice before the change takes effect.

International Data Transfers

EditingTests.com serves clients globally across the UK, EU, Canada, Australia and beyond. Where personal data crosses borders, we ensure robust safeguards:

• Standard Contractual Clauses (SCCs) approved by European Commission or UK ICO
• Adequacy decisions for approved destination countries
• Binding Corporate Rules and other approved transfer mechanisms

Stripe processes payments through US servers under updated data transfer mechanisms and privacy commitments.

How Long We Keep Your Data

How long each data type is kept, and why
Data Type	Retention Period	Reason
Client account data	Account lifetime + 7 years	Financial and legal compliance
Candidate assessments	24 months from last test session, or on candidate request	Service delivery; deleted on request (Art.17)
Resource downloads	24 months or until unsubscribe	Marketing communications
Contact enquiries	3 years from last contact	Customer service
Payment records	7 years	Tax and accounting compliance
Analytics data	Indefinitely (anonymised)	Platform improvement

Your Data Protection Rights

Subject to applicable law, you have comprehensive rights regarding your personal data:

Right of Access

Request a copy of personal data we hold about you

Right to Rectification

Request correction of inaccurate or incomplete data

Right to Erasure

Request deletion where no overriding legal basis exists

Right to Restrict Processing

Limit how we use your data while disputes are resolved

Right to Data Portability

Receive data in machine-readable format (GDPR)

Right to Object

Object to processing based on legitimate interests or marketing

How to Exercise Your Rights

Email [email protected] with subject line "Data Subject Request"

Response timeframes: 30 days (UK/EU GDPR), 30 days (PIPEDA), 45 days (CCPA). Identity verification may be required.

Candidates: For assessment results access, contact the organisation that invited you first. We'll assist Clients in fulfilling their obligations to you.

Right to Lodge a Complaint

If you believe we have not handled your personal data lawfully, you may complain to us directly at [email protected], and you have the right to lodge a complaint with a data protection supervisory authority. You may complain to the authority in the country where you live, where you work, or where the alleged infringement took place.

•United Kingdom: the Information Commissioner's Office (ico.org.uk).
•European Economic Area: the supervisory authority of your Member State; the full list is published by the European Data Protection Board.
•Canada: the Office of the Privacy Commissioner of Canada (priv.gc.ca).
•Australia: the Office of the Australian Information Commissioner (oaic.gov.au).

Exercising this right does not affect any other remedy available to you, and you do not have to contact us first.

Automated Decision-Making and Profiling

Our service scores editorial skills assessments, and part of that scoring is automated. We set out below which parts are automated and which involve a person, because you are entitled to know before you sit an assessment.

•Scored automatically, with no human step: multiple-choice and true/false answers — the Grammar Test, the Industry Vocabulary Test, and Part A of the MS Word Test. Your answers are compared against a stored answer key and a percentage is produced.
•Machine first pass, then human review before release: the Editing Test, the Proofreading Test, and Part B of the MS Word Test. A first-pass score is produced by comparing your work against a master copy; a trained editor then confirms or overrides it. The result is withheld from the employer until that review is complete.
•Scored by a person end to end: the Writing Test. There is no automated scoring step.

Scores are also placed in a percentile band against other candidates who have taken the same product at the same difficulty. We do not build behavioural or personality profiles, we do not use facial recognition, webcam monitoring or biometric analysis, and we do not train AI models on your submitted work.

We do not make hiring decisions. We return an assessment result to the organisation that invited you; that organisation decides what to do with it. Any decision about your employment is theirs, and is made by them.

You may ask for a human re-review of any result, including a result that was scored automatically, by emailing [email protected]. You may also decline to take an automated assessment; we recommend telling the employer directly, as they can usually offer an alternative. Our AI & Automated Scoring Notice describes all of this in full and forms part of this policy.

California Privacy Rights (CCPA/CPRA)

California residents have additional rights:

• Right to know what information is collected, used, shared or sold
• Right to delete personal information (subject to legal exceptions)
• Right to opt-out of sale — we do not sell personal information
• Right to non-discrimination for exercising CCPA rights
• Right to correct inaccurate personal information
• Right to limit use of sensitive personal information

Submit CCPA requests: [email protected]

Canadian Privacy Rights (PIPEDA)

Canadian residents have rights under the Personal Information Protection and Electronic Documents Act. You may request access to or correction of personal information we hold about you.

We collect only necessary information with your knowledge and consent. Contact: [email protected]

Security Measures

We implement comprehensive technical and organisational measures to protect your personal data:

Encryption

TLS/HTTPS for data in transit; encrypted disk volumes for data at rest.

Access Controls

Role-based permissions and access restrictions

Anti-Cheat Protection

Tab-switch detection, clipboard controls during assessments

Monitoring & Response

Regular security reviews, breach notification procedures

In case of a personal data breach posing risk to your rights, we'll notify relevant authorities within 72 hours and affected individuals without undue delay, as required by GDPR.

Children's Privacy

EditingTests.com is a professional B2B platform. Our services are not directed at individuals under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us immediately for prompt deletion.

Changes to This Policy

We may update this policy from time to time — for example when we add a feature, change a sub-processor, or a law changes. The current version is always the one published on this page, and the "last updated" date at the top of the page tells you when it last changed. Where a change materially affects how we handle your personal data, we will tell registered account holders by email before it takes effect.

How to Contact Us

For any question about this policy, or to exercise any of the rights described above, email [email protected]. We aim to respond within five business days, and to complete a data-subject request within one month, as GDPR requires.

You can also reach us through our contact page. If you are in the UK or the EU and you are not satisfied with our response, you have the right to complain to your national data protection supervisory authority.