How candidate information is processed
GlobalPass+ is operated by Prime360 Holding Ltd (Malta C106226). This notice is the public record of how we process personal data on the live service.
This notice describes the information the GlobalPass+ software actually processes today: accounts, preparation, practice and paid assessment sittings, optional public ranking, organisation campaigns, Stripe payments, credentials and integrity review. It does not sell candidate information.
Who is responsible
The controller is Prime360 Holding Ltd, a limited company registered in Malta (Registration No. C106226), registered office 1, Triq Il-Kurat Schembri, Mosta, Malta. GlobalPass+ is the product name for the service at globalpassplus.com. The supervisory authority is the Information and Data Protection Commissioner of Malta (IDPC).
Information we use
Depending on how you use the service, we may process:
- Account details: email, display name, password hash, country, date of birth, education stage and role.
- Assessment material: practice and paid-sitting responses, timings, flags, breaks, accommodations and session events disclosed before a sitting.
- Results and credentials: scores, integrity status, certificates, verification payloads and revocation records.
- Optional public ranking: if you choose to publish an eligible result to the GlobalPass Index, your selected public profile information may include your display name, country, optional university, assessment, GlobalPass Score and ranking. You can withdraw from the Index later. Ranking is off by default.
- Organisation and campaign records: invitations, members, enquiry forms and, where a sitting is later granted, the documented relationship.
- Payment references: Stripe identifiers, not full card numbers.
- Support and security logs: IP address on consent and audit events, and operational logs needed to run the service.
Identity documents and selfies are not required to start an assessment. If an integrity check collects them, that is disclosed immediately before the sitting. We do not use candidate responses to train public generative models.
Why we use it
We use this information to create and secure accounts, deliver preparation and assessments, time and recover sittings, produce result records, process payments, run optional ranking, administer organisations, enqueue mail you request, and keep an audit trail. Lawful bases under the GDPR for Prime360 Holding Ltd are: contract for the account and sitting; consent for optional ranking, sharing and marketing mail; legitimate interests for security, fraud and service integrity; and legal obligation for tax or retention where it applies.
How decisions are made
Scores on a submitted assessment are calculated automatically by pinned scoring rules. Integrity flags and appeals require a human reviewer. No session event is an automatic cheating finding.
Children and guardians
Date of birth is optional at registration and is used for age-related safeguards. Where the platform requires it, candidates under 18 need guardian consent. Public ranking stays off by default. We do not profile children for advertising.
Public index and sharing
Public ranking is optional. Eligible published profiles can show display name, country, optional university, assessment, GlobalPass Score and public ranks (global, continent and assessment). University is candidate-controlled and is not published against a genuine candidate’s preference. There is no organisation API for scores, competencies or reports. A candidate can create an expiring share link to the public verification card. Campaign invitations grant an assessment entitlement when the organisation programme is active.
Who else sees information
Hosting, database, mail (Hostinger SMTP from support@globalpassplus.com) and Stripe. We do not sell lists. Staff access uses accounts, MFA for privileged actions and an audit log.
Where it is stored
The live service and encrypted backups run on a privately controlled host operated for Prime360 Holding Ltd. Hostinger (mail and hosting) and Stripe act as processors. Transfers outside the EEA use those suppliers’ published GDPR transfer tools.
How long we keep it
Records are kept while the account is open and until an approved deletion request is completed. You can export or request deletion from the privacy centre.
Cookies
We only set cookies that are needed to run the service: a signed-in session, a CSRF token, and an assessment-session token during a sitting. We do not set analytics or advertising cookies, so there is no non-essential cookie banner.
Your controls and rights
The candidate privacy centre provides export, correction, deletion request and Index opt-in controls. Under the GDPR you may request access, rectification, erasure, restriction, portability or objection, and you may complain to the IDPC in Malta.
Changes
Material changes get a new version date on this page. New accounts record the version they accepted. See also the assessment terms and security pages.
Contact
Privacy and security questions: security@globalpassplus.com. Account help: helpdesk@globalpassplus.com.