Last updated: 14 August 2026
This statement explains what personal data ICTCP® collects, why we collect it, how long we keep it, and what you can ask us to do with it. It applies to our website, to our courses, and to the proctored examinations we deliver online.
We have tried to write it in plain language. If anything here is unclear, please ask us — we would rather explain it than have you agree to something you have not understood.
1. Who we are
ICTCP® is a trading name of:
AfterImage B.V.
Wassenaarseweg 145
2596 CP The Hague
The Netherlands
Chamber of Commerce (KvK): 85196533
VAT number: NL863542232B01
AfterImage B.V. is the controller for the personal data described in this statement, except where we say otherwise in section 5.
2. The personal data we process
2.1 When you visit the website or hold an account
- your first and last name;
- your email address;
- your account name or alias;
- the messages you send us and our replies.
2.2 When you buy a course or an examination
- the transaction: what you bought, when, for how much, and in which country;
- your VAT number, if you are buying as a business;
- payment card details are handled entirely by our payment provider and never reach our systems.
2.3 When you sit a proctored examination
Examinations are proctored remotely. This is the most extensive processing we carry out, so it is set out in full:
- a photograph of the front and the back of the identity document you present, and the information printed on it — which includes your document number, date of birth, nationality and photograph;
- five photographs of the room you are sitting in, taken by you at our request;
- a photograph taken by your webcam every five seconds for the duration of the examination;
- the declarations you make about each photograph, and the exact wording you were shown when you made them;
- your answers, your result, and the times at which you started and submitted;
- technical measurements of image sharpness and brightness, calculated in your own browser, which we keep as a record of what our checks saw;
- audio, only if audio recording is enabled for your examination. We will tell you beforehand if it is.
2.4 When you hold a certificate
- your name, the certificate, the date it was issued, and its certificate number;
- the continuing professional education (CPE) hours you report to us, and when you reported them;
- the date your certification expires or is withdrawn.
3. Why we process it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Answering your questions and providing support | Our legitimate interest in responding to you, or performance of our agreement with you |
| Creating and running your account | Performance of our agreement with you |
| Delivering courses and examinations | Performance of our agreement with you |
| Proctoring examinations — establishing that you are the person entitled to sit the examination, and that you sat it unaided | Performance of our agreement with you, and our legitimate interest in the integrity of the certificates we issue |
| Issuing certificates, maintaining the certification register, and recording CPE | Performance of our agreement with you |
| Investigating a suspected irregularity, and defending a result that is challenged | Our legitimate interest in the integrity of our certification, and establishing or defending legal claims |
| Keeping our financial administration | Compliance with our legal obligations under Dutch tax law |
| Sending our newsletter | Your consent, which you may withdraw at any time |
Where we rely on your consent, you can withdraw it at any time and we will stop. Withdrawing consent does not affect anything we did before you withdrew it.
Proctoring is not based on your consent. Before your camera is switched on we ask you to confirm that you have read and understood what will be recorded, and during the capture we ask you to declare what each photograph shows. Those confirmations record what you were told and what you stated; they are not the legal basis for the processing, and you cannot be asked to consent to something you would have to accept in order to sit an examination at all.
4. How long we keep it
Different things stop being necessary at different times, so they have different retention periods. Photographs of you are kept for the shortest periods in this table; the record of your examination, which contains no photographs, is kept the longest.
| What | How long | Counted from |
|---|---|---|
| Audio, where recorded | 1 month | the examination |
| Photographs of your identity document and of your room | 6 months | the examination |
| The full webcam image stream | 6 months | the examination |
| A reduced webcam record, one image per minute | 12 months | the examination |
| Your examination record: answers, result, declarations | 7 years | the examination |
| Your certification record: name, certificate, CPE, expiry | 7 years | the end of your certification |
| Financial administration | 7 years | the end of the financial year |
| Your account details | while your certification is current, and one month thereafter so that it can be reinstated | — |
| Support correspondence | 24 months | the matter being closed |
| Newsletter subscription | until you unsubscribe | — |
The periods for photographs are set by how long a result can still be challenged under our Examination Regulations. Once that period has passed, keeping a photograph of your room defends nothing.
If a result is disputed, the evidence relating to it is kept until the dispute is finally resolved, however long that takes.
Deletion is permanent. We cannot restore an examination recording once its period has passed.
5. Who else receives your data
| Who | Where | What for |
|---|---|---|
| Hetzner Online GmbH | Germany | Storing examination recordings. They are encrypted before transfer and Hetzner cannot read them. |
| Scaleway SAS | France | Sending email |
| Stripe, Inc. | United States | Processing payments |
| CPION / SPEN | The Netherlands | For programmes registered as a Registeropleiding, we pass your name, the programme and your result to CPION/SPEN, who maintain the candidate register for those programmes. They are an independent controller for that register and their own privacy statement applies to it. |
We do not sell your personal data, and we do not share it for anyone else’s marketing.
Your examination recordings are never sent to any third-party analysis service. They are analysed on our own systems.
6. Where your data is stored
Your data is stored in the European Union, with the exception of payment processing by Stripe, Inc. in the United States. That transfer is made under the safeguards permitted by the GDPR for transfers to the United States.
7. How examination recordings are protected
We consider examination recordings to be the most sensitive data we hold, and they are protected accordingly:
- every recording is encrypted before it leaves the examination server (the server can only write evidence, but cannot read it back);
- the key that can read them is held offline, separately, by ICTCP®;
- the storage provider holds only encrypted files that it cannot read;
- recordings are grouped so that each category can be deleted on its own schedule, and deleting a category destroys the ability to read it.
8. Automated decision-making
We should be precise about this, because one part of it is automatic and the rest is not.
Multiple-choice examinations are marked automatically. Your result is produced by counting the answers you got right and comparing that number with a pass mark set in advance. No judgement is applied, the criteria are published before you sit the examination, and the comparison is made on the number of questions rather than on a rounded percentage. We do this because it is necessary to deliver the examination you registered for.
Nothing else is decided automatically. Our software measures your recordings and flags anything that looks unusual, but a flag is not a decision and never fails an examination by itself. No irregularity is found, no result is withheld or declared invalid, no sanction is imposed and no certification is refused or withdrawn except by a decision of the Examination Board, which is made by people.
Where your certification expires because the required CPE hours were not reported, you may apply for reinstatement, and that application is decided by a person.
9. Your rights
You can ask us to:
- tell you what personal data we hold about you, why, and for how long;
- give you a copy of it;
- correct it if it is wrong or incomplete;
- delete it, where we are not required to keep it;
- restrict what we do with it while a question about it is resolved;
- send it to you or to another organization in a portable format, where the processing is based on your consent or on our agreement with you;
- stop processing it where we rely on our legitimate interests, by objecting;
- withdraw your consent, where we rely on it.
Exercising these rights is always free of charge. The fee described in our Complaint Resolution Policy applies to the certification complaints procedure only, and never to a request about your personal data.
10. Complaints
If you are not satisfied with how we have handled your personal data, please tell us first — we would like the chance to put it right.
You also have the right to complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or to the supervisory authority in the country where you live or work. Complaining to a supervisory authority is free.
11. Cookies
Our use of cookies is described in our Cookie Policy.
12. Changes to this statement
We update this statement when what we do changes. The date at the top shows when it was last changed. If a change materially affects how we process your data, we will tell account holders directly rather than rely on you noticing.
13. Contact
For any question about this statement or about your personal data:
AfterImage B.V.
Wassenaarseweg 145
2596 CP The Hague
The Netherlands