01Scope, status and how to read this policy#

This policy explains how the International Insignia of Certified Technical Practitioners (IICTP) handles personal data when you use this website. It covers the public pages, the Check your experience guide, the credential registry search, and every link on the site that opens your email application to write to us.

It does not cover exams, certification applications, training-partner agreements or membership. Those involve different data and a different relationship, and each will have its own notice, shown to you before you provide data for it.

02Laws this policy is written to meet#

IICTP serves practitioners worldwide, so the policy is written to a common high standard rather than to one country’s minimum. Where the law of the place you live gives you more than this policy does, the law prevails.

03Who is responsible (the controller)#

The “controller” is the party that decides why and how personal data is used and is answerable for it. Under this policy that is IICTP. If you want to complain about the handling of your data, this is the party you hold to account.

Service providers named in Section 9 act on our instructions and are “processors”. We are responsible for choosing them carefully and for requiring them, by contract, to protect the data and use it only for us.

04The data we handle, how it is collected, and where it goes#

This is a complete inventory of what the site handles. “Stays on your device” means it is stored in your browser and is not transmitted to us. If a category is not on this list, the site does not handle it.

05Why we may use it: purposes and legal bases#

Most privacy laws forbid using personal data unless there is a recognised legal reason. The reasons we rely on are listed against each purpose. We name the specific provision so that the claim can be tested.

06Analytics and measurement: exactly how it works#

The site includes the code for Microsoft Clarity, a product of Microsoft. This section states precisely what that code does, because it is the one place where data leaves your device to a third party for a purpose that is not strictly needed to run the site.

07Cookies and browser storage#

The site saves four items in your browser: your first name if you give one, your language, your theme, and your analytics choice. They are not cookies, are not sent to us, and are listed one by one, with how to remove them, on the Cookies and Storage page, which forms part of this policy.

08The public credential registry#

The registry lets employers, partners and others check that a credential is genuine. Each record is public by design and shows details such as the holder’s name, the credential, its status and dates. The full list of fields, how records are created, corrected and removed, and what the registry does not prove are set out in the Registry and Data Policy.

09Who we share data with#

We do not sell personal data and we do not share it for cross-context advertising. We use a small number of providers to run and measure the site. Each acts on our instructions and must protect the data.

10International transfers#

IICTP and its providers operate in more than one country, so data may be processed outside the country where you live. Where the law restricts such transfers, it allows them only with a recognised safeguard. The usual ones are an adequacy decision for the destination, standard contractual clauses approved by the regulator, or, in India, transfers to any country not restricted by the Government under the DPDP Act. Where one is required we will put it in place and tell you which on request.

11How long we keep your data#

We keep data only as long as the purpose in Section 5 needs it. A fixed period is stated wherever one is known; a bracketed entry means the period is still to be set and, until it is, data is kept no longer than necessary.

When a period ends we delete the data or make it anonymous so that it can no longer identify you. Backups are overwritten on their normal cycle.

12How we protect your data#

We apply technical and organisational measures proportionate to the data involved. Because the site collects little, most of the risk lies in the registry and in messages sent to us. Our approach, and how to report a vulnerability, are on the Security and Disclosure page.

No system is perfectly secure, and we do not promise otherwise. What we promise is reasonable care and prompt, honest notice.

13Your data-protection rights#

Depending on where you live, you have the rights below. We will help you use them whether or not your country’s law requires it.

14Automated decisions and profiling#

The Check your experience page applies published rules to what you enter, in your browser, and shows a suggested route. It does not decide anything about you and has no legal or similarly significant effect on you. It is a tool for reading the requirements. Eligibility for a credential is decided by people at IICTP against the published requirements and any equivalency review, and you may ask for that decision to be explained and reviewed. We do not profile visitors for advertising or credit-like decisions.

15Children’s data#

The site is meant for working technologists and students, and is not aimed at young children. We do not knowingly collect personal data from a child below the age at which the law of their country requires a parent’s consent for online services (13 in the US; 13 to 16 in the EU depending on the country; 18 under the DPDP Act, 2023, which also bars tracking and targeted advertising aimed at children). If you believe a child has sent us personal data, tell us at privacy@iictp.org and we will delete it.

16Links to other sites#

The site links to other sites and loads some resources from them. We do not control them. Their handling of data is their own, and you should read their policies. Following a link leaves the protection of this policy.

17Changes to this policy#

We will post any change here and update the date and version at the top of the page. If a change materially affects how your data is used, we will say so clearly on the site, and where the law requires your consent for the new use we will ask for it again rather than treat continued use as agreement. The table at the foot of the page lists every earlier version, so the text that applied on any date can be shown.

18How to contact us or complain#

Questions or requests about privacy go to privacy@iictp.org. For anything else about these documents, see the Legal hub.

↺Version history

01Agreement to these terms#

These terms are an agreement between you and the International Insignia of Certified Technical Practitioners (“IICTP”, “we”, “us”). If you use the site for an organisation, you confirm that you may bind that organisation, and “you” then includes it.

02Definitions#

Words in quotation marks have the meaning below wherever they appear in these terms and the related documents. Defining them removes room for argument later about what a word was meant to cover.

03Who may use the site#

The site is open to anyone who can form a binding agreement under the law where they live. Students and early-career technologists below that age may use it with a parent’s or guardian’s permission where the law requires. You are responsible for using it lawfully in your country, and for any local rule that restricts what you may view or do.

04What the site is, and is not#

The site describes IICTP, its credentials and its standard, lets you check a credential in the registry, and helps you see where your experience might lead. It provides general information.

• It is not professional, legal, financial, employment or career advice, and no adviser–client relationship arises from using it.
• It does not promise any exam result, certification, job, promotion or salary.
• IICTP is not accredited under ISO/IEC 17024:2012. Where the site mentions that standard, it names it only as a reference, and no statement on the site says or implies that IICTP or its credentials are accredited by any body.
• Sample records, sample questions and sample cases are labelled as samples and are illustrations, not real data.

05The eligibility guide#

The Check your experience page applies published rules to the answers you give and suggests a route. It is a guide.

• It does not decide eligibility, award a credential or reserve an exam place.
• Its dates are estimates based on your answers and on the assumptions stated on the page.
• The calculation runs in your browser. We do not receive your answers, so we cannot reproduce or confirm a result you saw. Keep your own note if you intend to rely on it.
• IICTP decides eligibility when you apply, using the published requirements and, where relevant, an equivalency review.

No reliance. You should not pay a fee, resign, enrol in training or take any step you cannot undo in reliance on the guide alone. If you do, IICTP is not responsible for the outcome, to the extent the law allows.

06Exams and certification#

Sitting an exam, holding a credential, renewing it and using it are governed by a separate certification agreement and the published candidate rules, which apply together with these terms. They are not created by anything you read on the site.

07Fees and figures#

Fees, durations, prerequisites and other figures shown on the site are given in good faith and may change. The figures that apply to you are the ones in force when you apply or book, and we will show them to you before you pay. Training fees are set by each Authorized Training Partner and are not part of IICTP’s exam fees. Prices are shown in US dollars and rupees for convenience and may be converted at the time of payment, so the amount charged can differ with exchange rates. Taxes are added where the law requires.

Error in a price. If a figure on the site is plainly wrong, for example a typing error, we will tell you and give you the choice to proceed at the correct figure or withdraw before you have paid anything.

08Using the credential registry#

You may use the registry to check a credential. Detailed rules, including what you may do with registry data, are in the Registry and Data Policy. In particular you may not scrape it in bulk, build lists from it for marketing, or present its data in a misleading way. A registry result shows the status of a record at the moment you looked; it is not a guarantee about the person.

09Messages you send us#

Where the site opens your email application to send us a message, the message is yours until you send it. When you send it you confirm that it is accurate, that you are entitled to share what it contains, and that we may use it to reply and to deal with your request, as the Privacy Policy describes. Email is not a secure channel. Do not send identity documents or other sensitive data unless we have asked you to and given a secure way to do so.

10Intellectual property and permitted use#

The content, the TPBOK™, the site design and the IICTP names, marks and badges belong to IICTP or its licensors and are protected by copyright, trademark and other law. Using the site does not transfer any right in them to you, other than the limited licence below.

11Feedback#

If you send us ideas or comments about the site or the standard, you give us a non-exclusive, perpetual, royalty-free licence to use them, without obligation to you and without naming you, unless you ask us not to and we agree in writing. Nothing you send us in this way is treated as confidential unless we agreed that in writing before you sent it.

12Acceptable use#

You agree to follow the Acceptable Use Policy. Do not break the law, interfere with the site or its security, claim a credential you do not hold, or misuse exam content.

13Other sites and providers#

The site links to and loads resources from other parties. We do not control them and are not responsible for their content, availability or handling of data. A link is not an endorsement. Authorized Training Partners are independent; any contract for training is between you and the partner.

14Availability and changes to the site#

We work to keep the site accurate and available, but it may be unavailable from time to time, and we may change, suspend or remove any part of it. We are not liable for interruptions beyond our reasonable control, such as network failure, a provider outage or an attack, provided we take reasonable steps to restore it.

15No warranty#

To the extent the law allows, the site is provided “as is” and “as available”. We do not promise that it will be complete, error-free or uninterrupted, or that any estimate or guide it gives is correct for your case. This does not remove any guarantee that the law gives you as a consumer and that cannot be excluded.

16Limitation of liability#

A limit on liability is enforced only where it is clear, fair and does not reach what the law forbids it to reach. We have therefore written the limit narrowly and put the exceptions first.

17Your responsibility#

If you break these terms or misuse the site, and that causes loss to IICTP or to others, you are responsible for that loss to the extent the law allows. We do not ask a consumer to indemnify us for our own fault.

18Suspension and termination#

We may restrict or end your access to the site, or part of it, if you break these terms or the Acceptable Use Policy, or if we must to meet a legal duty or protect the site. Before we end access we will usually tell you why and give you a chance to respond, unless the law, safety or an urgent attack prevents it. Ending access does not affect rights that have already arisen, or terms that by their nature continue, such as intellectual property, liability and disputes.

19Governing law and jurisdiction#

This section must name a law and a forum to be usable. They are not yet chosen, because they depend on where the legal entity is established. They are left open here rather than guessed.

20General legal provisions#

• Whole agreement. These terms, with the documents listed above, are the whole agreement about the site and replace anything said earlier about it.
• If part is unenforceable. A court may strike or narrow it. The rest stays in force.
• No waiver. Not enforcing a term at once does not mean we give it up. A waiver is valid only in writing.
• Transfer. We may transfer our rights and duties to a successor body that takes over the registry and agrees to honour these terms. You may not transfer yours without our written consent.
• No third-party rights. Only you and IICTP can enforce these terms, except where the law gives a right to someone else.
• Language. If a translation differs from the English text, the English text applies, except where the law of your country says your language prevails.
• Notices. We may notify you by posting on the site. You may notify us at legal@iictp.org and, for formal notices, by post at the address we send you on request. A notice by email takes effect when sent unless it bounces.
• Force majeure. Neither side is in breach for delay caused by events beyond its reasonable control.

21Changes to these terms#

We may update these terms. The date and version at the top show the latest one, and the table at the foot lists earlier versions so that the text that applied on any date can be shown. A change applies from the date it is posted and does not alter a dispute that had already begun. If a change is material and affects a right you already hold, we will give notice on the site before it takes effect. If you keep using the site after that date, you accept the new terms; if you do not accept them, you should stop using the site.

22Contact#

Questions about these terms go to legal@iictp.org. For a postal address for formal notices, write to us and we will send it.

↺Version history

01What cookies are#

Websites can keep small pieces of data on your device. Some are cookies, which your browser sends back to the site with every request. Others use browser storage (such as local storage), which the page can read on your device but which is not sent with requests. This page lists every one this site uses, and every outside script that can set or read one.

It forms part of the Privacy Policy, which explains how personal data is handled more broadly.

02How we group them, and which need consent#

03What we save: the complete list#

04Analytics and performance#

The site includes the code for Microsoft Clarity. When that code runs it may set cookies in your browser to recognise a visit across pages, and it sends usage data (clicks, scrolling, device details and screen recordings of a visit) to Microsoft. Cookie names and lifetimes are set by Microsoft and may change, so we do not list them as fixed. Microsoft describes them in its own documentation. [The exact names and lifetimes seen on the live site are to be recorded here after testing.]

05Fonts from other providers#

The site’s typefaces are served by Google Fonts. When a page loads, your browser asks Google’s servers for the font files directly. Google therefore receives your IP address and browser details, whether or not you have agreed to anything, because the request cannot be made without them. Google does not set tracking cookies for this on our behalf, but Google’s own documentation governs what it does with the request.

06Your choices, and how to withdraw#

07Browser signals#

Some browsers send a Do Not Track signal or a Global Privacy Control signal to say you do not want to be tracked or to have your data sold or shared. Global Privacy Control is legally recognised as an opt-out request in some places, for example under California law. The site does not sell or share personal data for advertising, so there is nothing for such a signal to switch off in that respect. Analytics runs only if you choose to accept it, so these signals do not add anything to what is collected.

08Proof of what we told you#

Because the lawfulness of cookies depends on what was disclosed and what was agreed, we keep this page’s version history. The table at the foot shows the text that applied on each date. The site records only your accepted or rejected choice, in your browser. The GDPR (Article 7(1)) requires a party relying on consent to be able to demonstrate it, so counsel must decide whether a fuller record (time, page version) is kept on a server.

09Changes to this notice#

If the site starts to save or read something new, this page will be updated first, or at the same time. Where the new item needs consent, we will ask for it rather than assume it. The version history at the foot of the page shows what changed and when.

↺Version history

01Purpose of this policy#

This policy keeps the site, and the credential registry in particular, fair, reliable and trustworthy. It applies to everyone who uses the site and forms part of the Terms and Conditions.

02What you are welcome to do#

• Read and share pages, and link to them.
• Search the registry to check a credential, as often as a person reasonably would.
• Use the Check your experience guide for yourself or to advise someone you support.
• Use your own credential and badge in line with the Trademark and Brand Use page.
• Quote short extracts with credit.

03Prohibited activities#

04Security testing and penetration testing: who may, who may not#

Testing a system means sending it input meant to find or use a weakness. It is lawful only when the owner has authorised it. This section says what we authorise, to whom, and what we forbid. It is deliberately precise, because unauthorised access to a computer is an offence in most countries, and a clear rule is what lets us act against it and lets honest researchers know where they stand.

Asking is always safe. To request permission, or to report something you found, write to security@iictp.org and read the Security and Disclosure page first.

05Automated access#

Ordinary browsers, accessibility tools, search-engine crawlers and AI crawlers are welcome to read the public pages of the site, and our robots.txt says so. That welcome has conditions, which are what separate a crawler from an attack. A crawler must:

• identify itself honestly, with a user-agent that names the operator and, where it can, a contact address;
• follow robots.txt and any limits we publish, and keep its request rate low enough not to affect other visitors, so that it does not amount to the load testing forbidden in Section 4;
• stay on public pages, and not try to defeat any block, or reach anything not linked publicly;
• stop when we ask, at registry@iictp.org.

Two limits apply to every automated tool, including those we welcome:

• The registry. Bulk collection of registry records, or building a list of credential holders, is not allowed without our written permission (see Section 3).
• Exam content. Collecting or republishing exam questions or answers is never allowed.

robots.txt is a technical signal and not a licence. Being allowed to fetch a page does not give ownership of it, or any right beyond the Terms and Conditions.

For permission to do anything beyond this, such as higher volume, write to registry@iictp.org.

06Reporting abuse#

If you see a credential being misrepresented, exam content being shared, or the site being misused, tell us at legal@iictp.org with the details and any links. For a security weakness, use the process on the Security and Disclosure page instead.

07Monitoring and enforcement#

We respond in proportion to the harm and to whether it was deliberate. Steps may include the following, and we may skip steps for serious or repeated cases.

08Changes#

We may update this policy as the site changes. The version history at the foot of the page lists earlier versions.

↺Version history

01Purpose of the registry#

The registry gives employers, partners, recruiters and the public a trustworthy way to check that a person holds a credential, and that it is current. Each credential is also issued with a digital badge that carries a decentralized identifier (DID), so a check does not depend on trusting a screenshot or a certificate file.

02What a record shows#

A record can show the following. Not every field is shown for every credential.

03How a record is created#

1. A candidate passes the assessment and meets the credential’s requirements.
2. IICTP issues the credential and adds the record to the registry, with the verifiable digital badge.
3. The holder is told, at certification, that the record is public and what it shows.

04Credential statuses defined#

05How to check a credential#

1. Open the verify page and enter the credential ID, which looks like CTP-2024-88412, or the holder’s name.
2. Read the result: status, dates and the signed record.
3. For the strongest check, compare the DID and verification hash with the holder’s badge.

06What a record proves, and does not#

07Requesting corrections#

08After a credential ends#

When a credential expires, lapses or is withdrawn, the record stays so a check shows the true state, with the status updated. It is not removed after that, because a check must always show the true state.

09Using registry data#

See the Acceptable Use Policy for the full rules, including the rules for automated access.

10Integrity of the registry#

Records are signed and carry a verification hash so tampering can be detected. Our approach to protecting the registry, and how to report a weakness, is on the Security and Disclosure page.

11Contact#

Registry questions, corrections and permission requests go to registry@iictp.org. Privacy requests go to privacy@iictp.org.

↺Version history

01Our marks#

IICTP’s names, marks and badges are valuable because they stand for an independent standard. The table lists those in use. Registration status varies by country, and each mark is shown with the symbol that fits how it is used.

02If you hold a credential#

While your credential is active, you may:

• state it on a CV, profile, email signature, business card or website;
• show the digital badge, unaltered, linked to your registry record where you can;
• use the post-nominal after your name, for example “Jane Doe, CTP®”.

03Do and do not#

04Training partners and employers#

05Press, writers and educators#

You may name IICTP and its credentials in news, commentary, research and teaching, and quote short extracts with credit. Please use the names as written above, and link to the relevant page. For images, logos or interviews, write to brand@iictp.org.

06The TPBOK™ and other content#

The TPBOK™, exam content and the site’s text and design are protected content. You may cite and link to them. Reproducing or adapting them beyond fair quotation needs written permission, as the Terms and Conditions say.

07Reporting and enforcement#

If you see a mark misused, or a credential claimed falsely, tell us at brand@iictp.org. We may ask the person to correct it, report it to the platform or employer concerned, mark a record, or take legal steps. See the Acceptable Use Policy.

08Asking permission#

For anything this page does not allow, write to brand@iictp.org with what you would like to do, where it will appear, and for how long. We aim to reply within 48 hours.

↺Version history

01Our security commitment#

A credential registry is only worth anything if it can be trusted. We take care to protect the site, the registry and the data they hold, and we welcome reports from people who find a weakness.

02Scope of coordinated disclosure#

Scope matters legally. Safe harbour in Section 7 covers research inside the scope and does not cover research outside it.

If you are not sure whether something is in scope, ask before testing. Asking is always safe.

03Who may test, and who may not#

This page is not a general permission to test the site. Testing is authorised only for the people and in the way the Acceptable Use Policy sets out (Section 4 there). In short:

• Authorised: IICTP staff and contractors within a written scope, outside firms under a signed engagement, and anyone to whom the Security Office has given specific written permission in advance.
• Narrowly permitted: a good-faith researcher with no permission may do only the low-impact observation described in Section 5 below, and report it.
• Not permitted: penetration testing, automated scanning, fuzzing, load or denial-of-service testing, credential attacks, tampering with registry records or badges, social engineering and phishing, attacks on our providers, and evading protections. These need written permission first.

If you want to carry out any prohibited test, ask first at security@iictp.org. We will tell you the scope, window and rules, or decline. Do not start before you have it in writing.

04How to report#

Email security@iictp.org with a clear subject line. If you wish to encrypt your message, ask for our key first. [Encryption key and a security.txt file to publish.] Do not send a report through a public channel, a social platform or the contact forms of third parties.

A report that is incomplete is still welcome. We will ask for what is missing.

05Rules for research#

These rules define what is authorised. Staying inside them is what brings you under the protection in Section 7.

• Test only against your own data and accounts, and stop as soon as you have shown the issue. Do not go on to see how far it reaches.
• Do not access, change, copy or delete other people’s data, or the registry’s. If you reach personal data by accident, stop, do not keep or share it, and tell us.
• Do not run automated vulnerability scanners, fuzzers, exploit tools or load tests, at any volume, without written permission from the Security Office. Observe the site as an ordinary visitor and with your browser’s own tools.
• Do not go beyond proving that the weakness exists. Do not exploit it to read data, run code, change a record or reach another system.
• Do not use a finding to demand payment or other advantage from us. A demand of that kind is extortion in many countries and takes you outside the safe harbour.
• Keep the details private until we have fixed the issue, or until 90 days after your report, whichever is first. After that you may publish. If we have not fixed it by then, we ask that you tell us before you publish.
• Follow the Acceptable Use Policy.

06Response timeline and process#

These are targets, not guarantees, because a fair promise is one we can keep. If we miss one, we will tell you why.

We will treat your report and identity as confidential and will not share your identity with a third party without your agreement, unless the law compels it.

07Safe harbour: what we promise and what we cannot#

If you act in good faith, stay in scope and follow the rules in Section 5, then in respect of your research we:

• consider it authorised access, so we will not treat it as unlawful access under the terms of the site or under the Acceptable Use Policy;
• will not bring or support any civil or criminal action against you for it;
• will say, if another party starts action over it, that you acted within these rules.

08How we protect the site#

Statements here are limited to what is true of the site today.

• Small surface. The public site is a static front end that collects very little data and has no sign-in or payments, which keeps the exposed surface small.
• Tamper evidence. Registry records carry a verification hash, and the digital badge carries a decentralized identifier, so alteration can be detected by anyone who checks.
• Data minimisation. Personal data is limited to what is needed, as the Privacy Policy describes. Data we never collect cannot be lost.
• On-device processing. The eligibility guide runs in your browser; your answers do not reach our servers.

09If something goes wrong#

If an incident affects personal data or the integrity of the registry, we will investigate, contain it, correct the record and notify those who must be told.

After an incident we will record what happened and what we changed. We keep that record so that the facts can be shown later.

10Contact#

Security reports go to security@iictp.org. For privacy requests, write to privacy@iictp.org. For legal notices, legal@iictp.org.

↺Version history

01Our commitment#

IICTP’s standard is for technical practitioners everywhere, including people who use assistive technology. We want the site and the exam information on it to be usable by as many people as possible, and we treat a barrier as a defect to be fixed, not a favour to be granted.

02Why this is a legal duty#

Accessibility is not only good practice. In many places it is required, and a statement like this one is evidence of what the organisation knew and promised. The laws below are the ones most likely to be relied on. We name them so that the standard we are measured against is clear.

03The standard we aim for#

We are working towards conformance with WCAG 2.2 at level AA, which covers perceivable, operable, understandable and robust content.

04What we have designed in#

These are design intentions that we are checking in the audit, not claims of conformance. Each row names the WCAG area it addresses so that it can be tested.

05Known limitations#

We will list known issues here once the audit is done, with a note of when each will be fixed. Stating a known failure is better than hiding it: it lets you plan around it and shows we are acting. Areas we are checking first include:

• the animated contour and plate graphics on page headers (WCAG 2.2.2, 2.3.3);
• the header menus, which open on hover and on click (1.4.13 Content on Hover or Focus, 2.1.1);
• data tables, which can be wide on small screens (1.4.10 Reflow);
• drag or pointer-only actions, if any are found (2.5.7 Dragging Movements, 2.5.8 Target Size);
• PDF or downloadable documents, none of which are published yet.

06If you cannot use something#

If a part of the site is not accessible to you, we will provide the same information or service another way, such as by email, in another format, or with help from a person. Ask at accessibility@iictp.org. You are not required to explain or prove your reason, and you will not be charged.

07Exams and adjustments#

Exams are invigilated. If you need an adjustment, such as extra time, a different format, a screen reader or other assistive technology, ask when you apply. A request for an adjustment is treated as confidential, is used only to arrange the adjustment, and does not count against you. A senior member of staff decides, normally within 48 hours. We ask only for the evidence needed to arrange the adjustment.

08Feedback and contact information#

09If you are not satisfied: escalation#

1. Ask for review. Write to us again and ask for the reply to be reviewed by a senior person who was not involved. We aim to answer in 15 working days.
2. Go to the regulator or equality body. You may contact the body for your country.
3. Legal remedy. You may have a right to bring a claim in court or before a tribunal. Nothing in this statement limits that right, and it is not a waiver of any claim.

10Technical details#

This statement should be read with the Terms and Conditions, which do not reduce any right in it.

↺Version history