Privacy Policy

1. Scope of this policy

This Privacy Policy applies to personal data processed by Frikanda Ltd, trading as "TiobExam" ("we", "us"), through the TiobExam platform and our website. It should be read together with our Terms of Service and Cookie Policy.

2. Our role: controller and processor

We act as a data controller for personal data relating to account administration, billing, and operating our website (for example, the names and email addresses of account holders). For the content that institutions and their users upload to the platform — which may include personal data about staff or students — we generally act as a data processor, handling that data on behalf of and under the instructions of the institution, which is the controller.

3. Data we collect

Account data

Name, email address, role, institutional affiliation, and authentication details you provide when registering or accepting an invitation.

Usage data

Technical and activity information such as log data, device and browser details, IP address, and how you interact with the platform, used to operate, secure, and improve the Services.

Customer Content

Materials, documents, questions, and other content you upload or generate. This may incidentally contain personal data, which you control.

Communications

Information you provide when you contact support or correspond with us.

4. How and why we use data

We use personal data to:

• provide, maintain, secure, and improve the Services;
• authenticate users and manage access, roles, and account administration;
• process AI-assisted operations you request;
• communicate with you about your account, support requests, and service updates;
• monitor usage, prevent abuse, and meet legal and security obligations.

5. Legal bases

Where the Ghana Data Protection Act, 2012 (Act 843) or, where applicable, the EU/UK GDPR governs our processing, we rely on one or more of the following: performance of a contract with you; our legitimate interests in operating and securing the Services; your consent (which you may withdraw); and compliance with legal obligations. Where we process institutional content as a processor, we do so on the documented instructions of the institution.

6. AI processing & sub-processors

To deliver AI-assisted features, we use trusted third-party providers (for example, for AI processing, document extraction, hosting, email, and analytics). These sub-processors act on our behalf under appropriate contractual and security safeguards, and only to the extent needed to provide the Services. We do not use your Customer Content to sell advertising.

7. When we share data

We do not sell personal data. We share it only with: sub-processors who help us run the Services; other users within your institution as required by the platform's collaboration and role features; and authorities or advisers where required by law, to enforce our terms, or to protect rights and safety. If we are involved in a merger or acquisition, data may transfer subject to this policy.

8. Data retention

We retain personal data for as long as needed to provide the Services and for legitimate business or legal purposes. The platform supports soft deletion and configurable retention periods; deleted content may be recoverable for a limited period before it is permanently removed. Institutions can request deletion of their content, subject to legal retention obligations.

9. Security

We use appropriate technical and organisational measures — including access controls, encryption in transit, audit logging, and optional multi-factor authentication — to protect personal data. No system is completely secure, and we cannot guarantee absolute security, but we work to protect your data and to respond promptly to incidents.

10. International transfers

We and our sub-processors may process data in countries other than your own. Where data is transferred across borders, we take steps to ensure an appropriate level of protection consistent with applicable data-protection law.

11. Your rights

Subject to applicable law, you may have the right to access, correct, update, delete, restrict, or object to the processing of your personal data, and to data portability. The platform provides data-export tools to help institutions exercise these rights. To make a request relating to account data, contact us using the details below; for institutional content, please contact your institution, which controls that data. You may also have the right to complain to a data-protection authority, such as the Data Protection Commission of Ghana.

12. Student and children's data

The platform is designed for use by institutions and educators, not for direct use by students or children. Where institutions upload data relating to students, they are responsible for ensuring they have a lawful basis and any required consents, and for complying with applicable laws protecting that data.

13. Cookies

We use cookies and similar technologies as described in our Cookie Policy.

14. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version with a new effective date and, where changes are material, take reasonable steps to notify you.

15. Contact us

For privacy questions or to exercise your rights, contact us at support@tiobexam.com, or write to Frikanda Ltd (TiobExam), 5 Bobo Street, East Legon, Accra, Ghana.

This document was last updated on 21 June 2026. We may update it from time to time; the date above always reflects the current version.