Privacy notice · Version 2026-10-14 · Prime360 Holding Ltd
How candidate information is processed
GlobalPass+ is operated by Prime360 Holding Ltd (Malta C106226). This notice is the public record of how we process personal data on the live service.
This notice describes the information the GlobalPass+ software actually processes today: accounts, preparation, practice and paid assessment sittings, optional public ranking, organisation campaigns, Stripe payments, credentials and integrity review. It does not sell candidate information.
Who is responsible
The controller is Prime360 Holding Ltd, a limited company registered in Malta (Registration No. C106226), registered office 1, Triq Il-Kurat Schembri, Mosta, Malta. GlobalPass+ is the product name for the service at globalpassplus.com. The supervisory authority is the Information and Data Protection Commissioner of Malta (IDPC).
Information we use
Depending on how you use the service, we may process:
- Account details: email, display name, password hash, country, date of birth, education stage and role.
- Assessment material: practice and paid-sitting responses, timings, flags, breaks, accommodations and session events disclosed before a sitting.
- Results and credentials: scores, integrity status, certificates, verification payloads and revocation records.
- Optional public ranking: if you choose to publish an eligible result to the GlobalPass Index, your selected public profile information may include your display name, country, optional university, assessment, GlobalPass Score and ranking. You can withdraw from the Index later. Ranking is off by default.
- Organisation and campaign records: invitations, members, enquiry forms and, where a sitting is later granted, the documented relationship.
- Payment references: Stripe identifiers, not full card numbers.
- Support and security logs: IP address on consent and audit events, and operational logs needed to run the service.
Identity documents and selfies are not required to start an assessment. If an integrity check collects them, that is disclosed immediately before the sitting. We do not use candidate responses to train public generative models.
Why we use it
We use this information to create and secure accounts, deliver preparation and assessments, time and recover sittings, produce result records, process payments, run optional ranking, administer organisations, enqueue mail you request, and keep an audit trail. Lawful bases under the GDPR for Prime360 Holding Ltd are: contract for the account and sitting; consent for optional ranking, sharing and marketing mail; legitimate interests for security, fraud and service integrity; and legal obligation for tax or retention where it applies.
How decisions are made
Scores on a submitted assessment are calculated automatically by pinned scoring rules. Integrity flags and appeals require a human reviewer. No session event is an automatic cheating finding.
Children and guardians
Date of birth is optional at registration and is used for age-related safeguards. Where the platform requires it, candidates under 18 need guardian consent. Public ranking stays off by default. We do not profile children for advertising.
Public index and sharing
Public ranking is optional. Eligible published profiles can show display name, country, optional university, assessment, GlobalPass Score and public ranks (global, continent and assessment). University is candidate-controlled and is not published against a genuine candidate’s preference. There is no organisation API for scores, competencies or reports. A candidate can create an expiring share link to the public verification card. Campaign invitations grant an assessment entitlement when the organisation programme is active.
Who else sees information
Hosting, database, mail (Hostinger SMTP from support@globalpassplus.com) and Stripe. We do not sell lists. Staff access uses accounts, MFA for privileged actions and an audit log.
Where it is stored
The live service runs on a privately controlled host operated for Prime360 Holding Ltd. Encrypted recovery copies are also stored offsite. Hostinger (mail and hosting), Backblaze (backup storage) and Stripe act as processors. Transfers outside the EEA use those suppliers’ published GDPR transfer tools.
How long we keep it
You can export your data or request deletion from the privacy centre. Approved deletion removes account access, anonymises account and reviewer profile details, and removes identity documents and stored credential files. Organisation owners must first arrange another active owner or archive the organisation; outstanding billing and email delivery must also be resolved before deletion completes.
Historical assessment, payment, security and review records remain to preserve accounting and assessment history while your account is active, and after an approved deletion the retained accounting and audit records are kept only for the operator’s legal accounting duties with profile details anonymised. Retained audit records can include personal information. Encrypted recovery copies follow a fixed schedule — 7 daily, 5 weekly and 12 monthly snapshots — so a deleted account leaves recovery copies within about thirteen months; account deletion does not immediately remove data from existing backups. Operational logs are kept for 14 days and service metrics for 15 days.
Your controls and rights
The candidate privacy centre provides export, correction, deletion request and Index opt-in controls. Under the GDPR you may request access, rectification, erasure, restriction, portability or objection, and you may complain to the IDPC in Malta.
Changes
Material changes get a new version date on this page. New accounts record the version they accepted. See also the assessment terms and security pages.
Contact
Privacy and security questions: security@globalpassplus.com. Account help: helpdesk@globalpassplus.com.