Privacy Policy

Serco Canada Inc. and its subsidiaries and affiliates (collectively “Serco” or “we” or “our”) are committed to respecting your privacy. This Privacy Policy describes how we collect, use, disclose, store, and otherwise process information that may identify you as an individual (“Personal Information”) to provide online security guard and private investigator testing services on behalf of Ontario’s Solicitor General (hereinafter, the “Ministry”) under Agreement No. PSD-0240/ Tender 16704 (hereinafter, “SGT services” or “testing services”).

In addition, this Privacy Policy states how you can control the collection, correction, and/or deletion of your Personal Information. We will not use or share your information with anyone except as described in this Privacy Policy. We urge you to read this Privacy Policy so that you understand our commitment to you and your privacy, and how you can participate in that commitment.

By registering for SGT services (e.g., taking a proctored test) and providing your Personal Information to Serco, you acknowledge and consent to Serco collecting, using, transferring, processing, and/or storing your Personal Information in accordance with this Policy and any supplementary privacy statement that may be relevant to you.

I. LEGAL AUTHORITY

Your Personal Information is collected under the authority of and protected under the Freedom of Information and Protection of Privacy Act, R.S.O. 1990, c. F. 31, as amended. The use of this artificial intelligence-assisted proctoring software is necessary for the lawful and legitimate business purpose of conducting and proctoring online security guard and private investigator testing services (hereinafter, “SGT services” or “testing services”).

When you registered for SGT services, you provided explicit consent for Serco to use your Personal Information to enhance and train Serco’s AI and proctoring systems. If you wish to withdraw this consent, please refer to Art. V.

II. PERSONAL INFORMATION WE COLLECT

Serco will collect, either directly from you or indirectly through the testing service platform and/or third-party service providers, the following personal information:

• Name
• Date of Birth
• E-mail address
• Mailing address
• Telephone number
• Gender
• Candidate information / Training Completion Number (“TCN”)
• Test Type/Language
• Timestamp
• Event name
• Technical details
• Audio and video recordings of you taking a test captured via your webcam, microphone, and/or screenshare (that starts a few seconds before the test begins and ends a few seconds after the test is complete)

Cookies and Other Tracking Technologies:

• We use various technologies to collect information, including cookies. A cookie is a small file placed onto your device. Across the web, cookies do lots of different jobs, like letting you navigate between pages efficiently, storing your preferences, and generally improving your experience on a website. Cookies make the interaction between you and the website faster and easier. If a website does not use cookies, it will think you are a new visitor every time you move to a new page on the site – for example, when you enter your login details and move to another page it will not recognize you, and it will not be able to keep you logged in.
• Our Services use cookies and similar technologies, to identify your device and enable the functioning of our features, including the ability to log into your account, authentication, security, preferences retention, performance optimization, and data analytics.
• If you do not want to receive cookies, you can change your browser settings. If you use our Services without changing your browser settings, we will assume that you’ve agreed to receive all cookies on the Company websites. Please note that our Services will not function properly without cookies.
• Some of our cookie remains after you close your web browser and may be used on subsequent visits to our Services to enable us to recognize you as an existing user.
• We record certain information and store it in log files when you interact with our Services. This information may include IP address, browser information, device information, internet service provider, operating system, date/time stamp, and other system configuration information. We and our analytics providers also collect and store analytics information when you use our Services to help us improve our Services.

III. USE OF ARTIFICIAL INTELLIGENCE

Serco uses artificial intelligence (“AI”) to assist Serco exam proctors identify potential exam policy violations (i.e.¸”events”), including but not limited to:

• Unauthorized device usage
• Eye and body movements (e.g., gaze onscreen, no person in front of the camera)
• Unauthorized person detected
• Keystroke patterns

While AI assists in identifying events, it does not make decisions on whether you violated exam policy. Only AI alerts requiring further review are assessed by human professionals.

AI training is conducted using open-source, synthetic, and employee-generated data. Serco also may use your Personal Information to enhance and train Serco’s AI and proctoring systems.

For additional information on Serco’s use of AI during your proctoring experience, please contact us using one of the communication options listed in Art. XII below.

IV. WHY WE COLLECT THIS INFORMATION

Serco collects your Personal Information to provide you with SGT services on behalf of the Ministry.

To ensure the security for and the integrity of the exam process, monitor, review, and may record the exam session through your webcam, microphone, or screenshare to detect behavior or activities indicative of potential cheating (i.e., “events”), including but not limited to device or phone use, looking off-screen, or the presence of another person. While Serco employs AI to generate alerts and detect possible events that may occur during the exam process as discussed above, proctors are responsible for determining whether to eject a test-taker from the exam based on the audio and/or video data reviewed.

We also may use your Personal Information for our legitimate business purposes related to improving our SGT services; for improving the content and functionality of the testing services; and for the other legitimate purposes of ourselves and the Ministry. For example, Serco may use your Personal Information to enhance and train Serco’s AI and proctoring systems.

V. CONSENT

Where we ask you for your consent, we will collect and use your Personal Information only to the extent you have consented and as described in this Policy.

You can withdraw your consent at any time by exercising your rights as described under Art. IX of this Policy. Please note that revoking your consent may affect our ability to provide you with the necessary SGT services and could impact your ability to obtain and/or renew your license with the Ministry.

In some exceptional cases, we shall be legally permitted under applicable law to process your information without your consent.

VI. WHEN AND WITH WHOM WE SHARE YOUR PERSONAL INFORMATION

Only authorized users have access to your Personal Information. Serco shares your Personal Information with the Ministry for the purposes of providing SGT services. Serco may share your Personal Information with third parties such as vendors, contractors, and other service providers who we engage to perform tasks necessary for providing SGT services. Additionally, you may authorize us to share your test results with Service Ontario for licensing purposes. These parties only have access to such information as necessary to perform their functions.

The Personal Information you provide to Serco is never disclosed to third parties without prior notice and/or your consent, except as follows:

• Serco may be required by law enforcement, government institutions, or judicial or regulatory authorities to provide information on individual users without notifying you.
• Your information may be disclosed on a confidential basis as part of an investigation into a suspected breach of contract, a violation of Serco’s policies or procedures, or a contravention of the law.
• Serco may be required to share your personal information in the context of resolving a data security breach or legal proceedings.

We do not sell your Personal Information to other organizations or companies.

VII. DATA LOCATION AND SECURITY

Video conferencing data is processed in the United States, but all Personal Information is stored inside Canada residing in Canadian data centres. All data is encrypted in transit and at rest using Advanced Encryption Standard 256 (“AES256”) or higher, as per GO-ITS 25.12 - Security Requirements for the Use of Cryptography. All collected information will be classified and applied sensitivity in accordance with GOITS 25.12 - Security Requirements for the Use of Cryptography, the Government of Ontario Information Security and Privacy Classification (“ISPC”) Policy is encrypted in transit and at rest. For more information on GO-ITS 25.12, please visit https://www.ontario.ca/page/go-its-2512-use-cryptography.

Any employee or subcontractor of Serco that has any level of access to Personal Information as an authorized user of any Serco, Ministry, or third-party electronic systems used to collect Personal Information will have their user access revoked immediately upon their resignation, termination, permanent lay-off, or an extended leave of absence (other than vacation or short-term sick leaves).

VIII. DATA RETENTION

In accordance with our contract with the Ministry, Serco maintains your Personal Information, except for video and audio recordings, for seven (7) years after the contract ends. Video and audio recording information will be stored on Serco servers in Canada for a period of 30 days. After the applicable retention period, Serco ensures the secure and irreversible destruction of paper or electronic records containing your Personal Information when it is no longer needed to deliver SGT services or to comply with Serco’s obligations under the contract with Ontario or relevant law.

IX. YOUR RIGHTS

You have the right to access, update, delete, or limit the use and disclosure of your Personal Information as provided below. Note, however, decisions regarding any request you make about your Personal Information ultimately rest with the Ministry.

• Access: You may submit an access request for information relating to your Personal Information held by Serco and/or additional details of all third-party disclosures. If you desire to obtain or transfer your Personal Information, subject to identity verifications, we will provide you with your Personal Information in a structured and commonly used electronic format.
• Update: If your Personal Information changes or is inaccurate, you have the right to request changes to update or correct your information.
• Delete: Except where exemptions apply, you have the right to request Serco delete (or anonymize) your Personal Information on a number of grounds, including but not limited to (i) if the Personal Information is no longer necessary for its original purpose and no new lawful purpose exists; or (ii) if the lawful basis to processing your Personal Information is your consent and you withdraw that consent.
• For example, you may request Serco delete (or anonymize) your Personal Information that Serco is no longer required to retain as per Art. VIII.
• Limit Use and Disclosure: You have the right restrict the processing of your Personal Information at any time on multiple grounds such as to contest the accuracy of your Personal Information. This right means we will refrain from using your Personal Information during the period for which this right is applied.

All reasonable efforts will be made prior to the release of information to confirm your identity. If you wish, at any time, to exercise any of these rights or otherwise obtain further information, please contact Serco using one of the communication options listed in Art. XII below.

X. RESPONDING TO A REQUEST

If Serco receives a request from you to exercise one or more of your rights, we will respond within thirty (30) calendar days from receipt. If Serco requires more time, we will inform you of the reason and extension period in writing. Serco will take reasonable steps to verify the identity of the requester and may refuse the request if the identity cannot be confirmed.

Where Serco has disclosed your Personal Information to third parties, as per this Policy, and except where compliance would require disproportionate effort, Serco will notify those third parties of your request.

XI. CHANGES TO THIS PRIVACY POLICY

In order to keep up with changing legislation and best practices, we may revise this Privacy Policy at any time. Any changes to this Privacy Policy will be posted here. Where required by applicable privacy law and there is a significant change to this Privacy Policy, we may alert you by placing a notice on our website. We encourage you to frequently check this page for any changes. We include the date this Policy was last updated at the top of the page. You acknowledge and agree that you are responsible for periodically reviewing this Privacy Policy.

XII. QUESTIONS AND CONTACT INFORMATION

Serco takes full responsibility for the management and confidentiality of the Personal Information it collects through its website, events, products, or services. By providing this Privacy Policy, Serco pledges its continued commitment to protecting the Personal Information you give us. We regularly review our online information handling practices to ensure that we are abiding by this Privacy Policy.

If you believe Serco is not abiding by this Privacy Policy, have concerns about Serco’s Personal Information handling practices, or would like to exercise your rights as described above, please contact us:

Name: Customer Feedback Team
Website: https://ontariosecuritytesting.com/TRV/Home/ContactUs
E-mail: sgt@drivetest.ca
Mailing Address: 37 Carl Hall Rd, North York, ON M3K2B6
Toll-Free Telephone: 1-866-248-2555

[1] Authorized users are those who have a need to know for the purposes of providing SGT services and who are specifically authorized by the Ministry to have such access to your Personal Information.