Privacy Policy

Serco Canada Inc. and its subsidiaries and affiliates (collectively “Serco” or “we” or “our”) are committed to respecting your privacy. This Privacy Policy describes how we collect, use, disclose, store, and otherwise process information that may identify you as an individual (“Personal Information”) to provide online security guard and private investigator testing services on behalf of Ontario’s Solicitor General (hereinafter, the “Ministry”) under Agreement No. PSD-0240/ Tender 16704 (hereinafter, “SGT services” or “testing services”).

In addition, this Privacy Policy states how you can control the collection, correction, and/or deletion of your Personal Information. We will not use or share your information with anyone except as described in this Privacy Policy. We urge you to read this Privacy Policy so that you understand our commitment to you and your privacy, and how you can participate in that commitment.

By registering for the SGT services (e.g., taking a proctored test), Serco collects and processes your Personal Information exclusively on behalf of the Ministry of the Solicitor General and in compliance with applicable legislation and this Privacy Policy. In its role as a service provider, Serco acts solely as an agent of the Ministry and only in accordance with Ministry direction and statutory authority.

I. LEGAL AUTHORITY

Your Personal Information is collected on behalf of the Ministry of the Solicitor General under the authority of, and protected by, the Freedom of Information and Protection of Privacy Act, R.S.O. 1990, c. F.31, as amended.

The collection is authorized under section 38(2) of FIPPA as necessary to the proper administration of a lawfully authorized activity, namely the administration of mandatory security guard and private investigator examinations required under the Private Security and Investigative Services Act, 2005, S.O. 2005, c. 34, and Ontario Regulation 26/10 (Training and Testing).

Serco administers testing services as a service provider and agent of the Ministry and has no independent authority to determine the purposes or means of collection or use of Personal Information.

II. PERSONAL INFORMATION WE COLLECT

Serco may collect the following Personal Information, either directly from you or through secure testing platforms and/or approved third-party service providers:

• Name
• Date of Birth
• E-mail address
• Mailing address
• Telephone number
• Gender
• Candidate information / Training Completion Number (“TCN”)
• Test Type/Language
• Timestamp
• Event name
• Technical details
• Audio and video recordings of you taking a test captured via your webcam, microphone, and/or screenshare (that starts a few seconds before the test begins and ends a few seconds after the test is complete)

Serco may collect and process limited Payment Card Information when you complete a transaction. All payments are handled through secure, PCI compliant third party processors. Serco does not store full card numbers or card security codes. Payment information is used solely to complete authorized transactions, prevent fraud, and meet accounting or legal requirements, collected information are not sold or shared except with payment service providers or when required by law.

In addition to the Personal Information listed above, Serco may collect certain technical information through the use of cookies and similar tracking technologies. Cookies are small data files placed on your device that support the functionality, security, and performance of the testing services. Cookies help the platform recognize your device, maintain your session, store your preferences, enable authentication, support performance optimization, and provide analytics to improve service delivery.

The testing services may use both session cookies, which expire when you close your browser, and persistent cookies, which remain on your device for future visits. You may disable cookies through your browser settings; however, doing so may impact on the functionality of the testing services. Serco and its analytics providers may also record certain technical information, such as IP address, browser type, device information, operating systems, date/time stamps, and other system configuration details, to support service integrity, security, and performance.

III. USE OF ARTIFICIAL INTELLIGENCE

Serco uses artificial intelligence (“AI”) supported tools to assist Serco exam proctors to identify potential exam policy violations (i.e.¸”events”), including but not limited to:

• Unauthorized device usage
• Eye and body movements (e.g., gaze onscreen, no person in front of the camera)
• Presence of unauthorized person detection
• Abnormal keystroke patterns or behavior patterns

While AI assists in identifying events, it does not make decisions on whether you violated exam policy. Only AI alerts requiring further review are assessed by human professionals. All decisions affecting your test status are made by trained human proctors.

Personal Information collected through examination or proctoring services is not used to train, retrain, fine‑tune, improve, or develop artificial intelligence systems, and is not used for product development, commercial purposes, system improvement, or secondary uses, unless expressly authorized in writing by the Ministry and permitted by law. AI training is conducted using open-source, synthetic, and employee-generated data.

IV. WHY WE COLLECT THIS INFORMATION

Serco collects your Personal Information to provide you with SGT services on behalf of the Ministry. Personal Information is collected only to the extent necessary to administer mandatory examinations, verify identity, ensure test integrity, support accommodation, process fees, and meet legal and contractual obligations. Personal Information is not used by Serco for independent business purposes or for system training, analytics, or improvement beyond what is necessary to deliver testing services as authorized by the Ministry.

V. CONSENT

Where we ask you for your consent, we will collect and use your Personal Information only to the extent you have consented and as described in this Policy.

Personal Information is collected and used under statutory authority and Ministry mandate. Where consent is requested (for example, by Training Entities sharing information to enable testing eligibility), it is sought in accordance with applicable law and does not replace statutory authority.

Testing is mandatory for licensing eligibility. Withdrawal of consent may affect the ability to administer or complete the examination, subject to Ministry requirements and applicable law.

In some exceptional cases, we shall be legally permitted under applicable law to process your information without your consent.

VI. WHEN AND WITH WHOM WE SHARE YOUR PERSONAL INFORMATION

Only authorized users¹ have access to your Personal Information. Serco shares your Personal Information with the Ministry for the purpose of providing SGT services. Serco may share your Personal Information with third parties such as vendors, contractors, and other service providers who we engage to perform tasks necessary for providing SGT services. Additionally, you may authorize us to share your test results with Service Ontario for licensing purposes. These parties only have access to such information as necessary to perform their functions. Our service providers are contractually required to protect your Personal Information and only use it for the purposes of delivering SGT services.

The Personal Information you provide to Serco is never disclosed to third parties without prior notice and/or your consent, except as follows:

• Serco may be required by law enforcement, government institutions, or judicial or regulatory authorities to provide information on individual users without notifying you.
• Your information may be disclosed on a confidential basis as part of an investigation into a suspected breach of contract, a violation of Serco’s policies or procedures, or a contravention of the law.
• Serco may be required to share your personal information in the context of resolving a data security breach or legal proceedings.

We do not sell your Personal Information to other organizations or companies. Personal Information is not disclosed to service providers for artificial intelligence training, system improvement, or secondary purposes.

VII. DATA LOCATION AND SECURITY

Video conferencing data is processed in the United States; however, all Personal Information is stored within Canada in Canadian data centres. All data is encrypted in transit and at rest using Advanced Encryption Standard 256 (“AES 256”) or higher, in accordance with GO ITS 25.12 – Security Requirements for the Use of Cryptography. All collected information is classified and assigned a sensitivity level in accordance with the Government of Ontario’s Information Security and Privacy Classification (“ISPC”) Policy.

For more information on GO-ITS 25.12, please visit: https://www.ontario.ca/page/go-its-2512-use-cryptography.

Any employee or subcontractor of Serco who has access to Personal Information through Serco, Ministry, or third party systems will have their access revoked immediately upon resignation, termination, permanent layoff, or an extended leave of absence (other than vacation or short term sick leave).

VIII. DATA RETENTION

In accordance with our contract with the Ministry, Serco maintains your Personal Information, except for video and audio recordings, for seven (7) years after the contract ends. Video and audio recording information will be stored on Serco servers in Canada for a period of 30 days. After the applicable retention period, Serco ensures the secure and irreversible destruction of paper or electronic records containing your Personal Information when it is no longer needed to deliver SGT services or to comply with Serco’s obligations under the contract with Ontario or relevant law.

IX. YOUR RIGHTS

You have the right to access, update, delete, or limit the use and disclosure of your Personal Information as provided below. Privacy inquiries may be directed to Serco as the service provider. However, final determinations under FIPPA rest with the Ministry of the Solicitor General.

• Access: You may submit an access request for information relating to your Personal Information held by Serco and/or additional details of all third-party disclosures. If you desire to obtain or transfer your Personal Information, subject to identity verifications, we will provide you with your Personal Information in a structured and commonly used electronic format.
• Update: If your Personal Information changes or is inaccurate, you have the right to request changes to update or correct your information.
• Delete: Except where exemptions apply, you have the right to request Serco delete (or anonymize) your Personal Information on a number of grounds, including but not limited to (i) if the Personal Information is no longer necessary for its original purpose and no new lawful purpose exists; or (ii) if the lawful basis to processing your Personal Information is your consent and you withdraw that consent.
• For example, you may request Serco delete (or anonymize) your Personal Information that Serco is no longer required to retain as per Art. VIII.
• Limit Use and Disclosure: You have the right to restrict the processing of your Personal Information at any time on multiple grounds such as to contest the accuracy of your Personal Information. This right means we will refrain from using your Personal Information during the period for which this right is applied.

All reasonable efforts will be made prior to the release of information to confirm your identity. If you wish, at any time, to exercise any of these rights or otherwise obtain further information, please contact Serco using one of the communication options listed in Art. XIIII below.

X. RESPONDING TO A REQUEST

If Serco receives a request from you to exercise one or more of your rights provided under Art. IX, we will respond within thirty (30) calendar days from receipt. If Serco requires more time, we will inform you of the reason and extension period in writing. Serco will take reasonable steps to verify the identity of the requester and may refuse the request if the identity cannot be confirmed.

Where Serco has disclosed your Personal Information to third parties, as per this Policy, and except where compliance would require disproportionate effort, Serco will notify those third parties of your request.

XI. CHANGES TO THIS PRIVACY POLICY

In order to keep up with changing legislation and best practices, we may revise this Privacy Policy at any time. Any changes to this Privacy Policy will be posted here. Where required by applicable privacy law and there is a significant change to this Privacy Policy, we may alert you by placing a notice on our website. We encourage you to frequently check this page for any changes. We include the date this Policy was last updated at the top of the page. You acknowledge and agree that you are responsible for periodically reviewing this Privacy Policy.

XII. QUESTIONS AND CONTACT INFORMATION

Serco takes full responsibility for the management and confidentiality of the Personal Information it collects through its website, events, products, or services. By providing this Privacy Policy, Serco pledges its continued commitment to protecting the Personal Information you give us. We regularly review our online information handling practices to ensure that we are abiding by this Privacy Policy.

If you believe Serco is not abiding by this Privacy Policy, have concerns about Serco’s Personal Information handling practices, or would like to exercise your rights as described above, please contact us:

Name: Customer Feedback Team
Website: https://ontariosecuritytesting.com/TRV/Home/ContactUs
Via E-mail: sgt@drivetest.ca
Mailing Address: 37 Carl Hall Rd, North York, ON M3K2B6
Toll-Free Telephone: 1-866-248-2555

[1] Authorized users are those who have a need to know for the purposes of providing SGT services and who are specifically authorized by the Ministry to have such access to your Personal Information.