Privacy Policy

Understand how TestInvite safeguards your data
Effective Date: 12 September 2025

Who are we?

Vanilya Elektronik Hizmetler ve Bilişim Tic. A.Ş. a joint stock company (anonim şirket) registered at Istanbul Trade Registry with number 926625 and with its registered office at Esentepe Mah. Kore Sehitleri Cad. No: 29, Zincirlikuyu, Şişli, Istanbul, Turkey. (“TestInvite” or “We”)

What is the purpose of this Privacy Policy?

This Privacy Policy describes the manner in which we collect, use, maintain, disclose and otherwise process personal data collected from our clients, Participants (as defined below) and website visitors (each, a "Visitor"). Visitors who have signed up for an account (“Customer”) on our website (“Website”) can create content on the Website (e.g. exams), which content can be accessed and used by the participants (“Participants”).

TestInvite generally collects personal data on behalf of its Customers for purposes of providing exam-related services to those Customers’ Participants. In such cases, the Customer will be the “data controller” of the applicable personal data, and TestInvite is the “data processor,” as those terms are used in applicable data and privacy laws.

In our role as a data processor, TestInvite only processes personal data in accordance with the applicable contract for purposes of providing its exam-related services to its Customers.

For more information on our data processor rights and obligations please refer to the template Data Processing Addendum available on the Website, which is or as amended is a legally binding agreement between TestInvite and the Customer.

What data do we collect?

We may collect the following categories of data (as applicable) from our Visitors, Customers and/or Participants (“You”).

If you are a Participant, we may collect:

Category 1 - Exam Response Data

  • The Participant’s full name, email address and phone number, group name that the company associates with the person, tags, notes taken about the person and similar
    • The Participant’s answers to exam questions
      • Selected options
        • Matches made
          • Written texts
            • Saved images and videos (camera, microphone, screen)
              • Any type of file uploaded (including image, video, document files)
              • All results obtained from the exam (general results, section results)
                • Information such as browser, operating system and IP from which the exam was accessed
                  • All logs recorded during the exam
                    • Flow records such as navigation, viewing and answering within the exam
                      • Technical information, such as Internet Protocol (IP) address, login information, browser type and version, screen resolution, time zone setting, browser plug-in types and versions, browser access, operating system, platform and traffic data, cookies data, web logs and other communication data.

                        Category 2 - Supplementary Test Taker Data

                        • Camera and screenshots captured of the Participant or its mouse movements, that are not within the scope of Category 1 data, shortly before, during and after the exam (Monitoring/Proctoring files)
                          • Any files, pictures taken or uploaded by the Participant, that are not within the scope of Category 1 data, before, during or after the exam. (Pre-start submissions)

                            If you get in touch with us via email, phone, post or other form of communication, we may keep records of those correspondences and their content in order to be able to respond to you or document your complaint.

                            If you are a Customer we may also collect:

                            • Registration information: When you register for an account, we collect your first and last name, username, password and email address.
                              • Billing information: If you make a payment to TestInvite, we require you to provide your billing details, a name, address, email address and financial information corresponding to your selected method of payment (e.g. a credit card number and expiration date or a bank account number).
                                • Account settings: You can set various preferences and personal details on pages like your account settings page.

                                  If you supply us with personal data about other people (for example if you are a representative from a Customer providing information about the Participant, you represent that you have the authority to provide this information on their behalf, that they have provided informed consent to such disclosure and you should direct them to this privacy notice.

                                  How do we use the data we collect?

                                  We will collect, process and store the personal data we have collected for creating and updating:

                                  • Information about your organization (User profile & Billing information)
                                    • User accounts (Customers/Participants)
                                      • Question Bank
                                        • Tests (i.e. Exams)
                                          • Tasks (Welcome pages, instructions etc.)
                                            • Information about Participants (students, candidates, employees etc.)
                                              • E-mail templates
                                                • Answers given during the examinations

                                                  The personal data collected will be further processed for:

                                                  • Proctoring media materials collected during the exams
                                                    • enable you to access and use the Website, when signing up and during subsequent visits;
                                                      • to prevent you from navigating away from the test window while an exam is ongoing;
                                                        • contact you when necessary and respond to your requests and enquiries;
                                                          • provide technical assistance, troubleshooting problems, detect and protect against error;
                                                            • market products and services to you, provided that, where required, we have obtained your consent to do so;
                                                              • fulfill legal and regulatory requirements;
                                                                • detect and prevent fraud, suspicious activities, and other illegal activities;
                                                                  • analyse and improve products and services, collect feedback, enhance the Website, and evaluate the effectiveness of our marketing activities and overall services;
                                                                    • perform statistical analyses on users of the Website and track your use of the Website; and
                                                                      • on an aggregated and anonymised basis, share the data and statistical analyses with our Customers.

                                                                        We do not sell your personal data. We may disclose your personal data:

                                                                        • to our Customers for the purpose of exam administration;
                                                                          • to our marketing partners, where you have opted-in to sharing for marketing purposes;
                                                                            • to the extent required by law or regulation or as requested by a court or regulatory authority in connection with law enforcement;
                                                                              • in connection with any current or prospective legal proceedings;
                                                                                • in connection with a sale, merger, acquisition, or other transaction affecting the associated business; and
                                                                                  • to our third party service providers, such as:
                                                                                    • Google Cloud
                                                                                      • Personal data processed: contact details, proctoring media materials, answers given in an exam.
                                                                                        • Purpose: Used for administering exams
                                                                                          • Place: United States
                                                                                          • Amazon Web Services, Inc.
                                                                                            • Personal data processed: contact details, e-mail content.
                                                                                              • Purpose: Used for sending e-mails
                                                                                                • Place: United States
                                                                                                • Mailgun Technologies, Inc.
                                                                                                  • Personal data processed: contact details, e-mail content.
                                                                                                    • Purpose: Used for sending e-mails
                                                                                                      • Place: United States
                                                                                                      • Twilio Inc.
                                                                                                        • Personal data processed: contact details, e-mail content.
                                                                                                          • Purpose: Used for sending e-mails
                                                                                                            • Place: United States
                                                                                                            • Google Analytics
                                                                                                              • TestInvite uses software such as Google Analytics to help understand use of our Services. Google Analytics collects information sent by your browser as part of a web page request, including cookies and your IP address. Google also receives this information and their use of it is governed by their Privacy Policy.
                                                                                                                • Place: United States

                                                                                                              The above third parties to whom we disclose information are certified EU – U.S. Privacy Shield organisations.

                                                                                                              All third parties to whom we disclose personal data are required by law and/or contractual requirements to keep your personal data confidential and secure.

                                                                                                              International Transfers

                                                                                                              The Website is hosted on Google Cloud and all its data are stored in the United States. TestInvite uses the following service providers (all in US) in order to store its data:

                                                                                                              • Google Cloud Firebase Hosting in United States
                                                                                                                • Google Cloud Firestore Database in United States
                                                                                                                  • Google Cloud Functions in in United States
                                                                                                                    • Amazon Web Services, Inc. in United States
                                                                                                                      • Twilio Inc. in United States
                                                                                                                        • Mailgun Technologies, Inc. in United States
                                                                                                                          • Stripe Inc. in United States

                                                                                                                            Therefore, personal data collected by TestInvite worldwide (including within the E.U. and Switzerland) may be transferred to the United States for processing. By using TestInvite’s services or submitting personal data to TestInvite, you consent to the transmission of your information outside your own country.

                                                                                                                            All companies listed above are certified EU – U.S. Privacy Shield organizations.

                                                                                                                            Following Shrems II decision of the European Union Court of Justice dated 16 July 2020, international data transfers we make within its scope are made within the framework of standard contractual clauses. These terms are available in the Data Processing Addendum on the Website.

                                                                                                                            In cases where the KVKK (Turkish Personal Data Protection Law) applies, the transfer of personal data provided to us abroad is carried out in accordance with Article 9 of the KVKK by ensuring appropriate safeguards. In this context, the Standard Contract published by the Turkish Personal Data Protection Authority is used.

                                                                                                                            As of the update date of this Privacy Policy, the following foreign data sub-processors have signed the standard contract, and the application to the Authority has been submitted and the approval process completed:

                                                                                                                            • Amazon Web Services, Inc., United States
                                                                                                                              • Google Cloud EMEA Limited, Ireland

                                                                                                                                Security Measures

                                                                                                                                We follow industry best practices in information security. We implement security measures appropriate to the size and nature of our business, all with the aim of keeping your personal data safe and secure.

                                                                                                                                Physical Security

                                                                                                                                TestInvite uses cloud services for its operations. The physical facilities where TestInvite is located requires an RFID chip to gain access.

                                                                                                                                Information Access

                                                                                                                                Employees only have access to data contained in business applications on a 'need-to-know' basis. Privileged users are granted on a 'need-to-access' basis.

                                                                                                                                Endpoint Security

                                                                                                                                TestInvite uses Sophos for end-point security and protection against viruses and ransomware. All devices are encrypted with a remote swipe enabled should the device be lost or stolen.

                                                                                                                                While we take reasonable precautions to protect your personal data from loss, unauthorized access, disclosure and destruction, no method of transmission over the Internet, or method of electronic storage is 100% secure and therefore we cannot guarantee its absolute security.

                                                                                                                                Created on 2023/11/26 Updated on 2025/09/30 Share
                                                                                                                                Go Back

                                                                                                                                Talk to a representative

                                                                                                                                Discover how TestInvite can support your organization’s assessment goals