How we handle your data

Who we are

The OTO English Benchmark is run by OTO Group, LLC (trading as OTO Courses), CRN 130513, Tax Card 545-465-400, 14/5 Al Lasilki St., Maadi, Cairo. A company arranged the assessment and receives your results. That company is usually your employer. It can also be a company you are applying to: some cohorts are for job applicants rather than employees, and this notice applies to you in the same way. How that company uses and keeps your result on their side is their decision, so ask them if you want to know more.

What we collect

If you run a company account

• Account details: your work email, your name if you give it, your role in the account (owner or HR), and the company you belong to.
• Sign-in links: we sign you in by emailing a single-use link that expires after 15 minutes. We store the link only in a scrambled (hashed) form, along with when it was sent and used, and a scrambled form of the IP address it was requested from.
• Sign-in times: when you last signed in, so your colleagues can see who is active on the account.
• Notification settings: the addresses your company chooses for reminder emails, and whether anyone has unsubscribed. Every notification email has an unsubscribe link, which stops these emails for the whole company account.

If a company invites you by email

• Invitation details: your work email and, if they give it, your name. Their HR team provides these so we can send you a personal invitation link.
• Invitation status: whether the invitation was sent, when you opened your personal link, and when you enrolled. We do not put tracking pixels in our emails.

From everyone who takes the assessment

• Enrolment details: your name, work email, department or role if you give it, and the company cohort your access code belongs to.
• Your answers: the options you choose, your written texts, and when you answered each question.
• Speaking: during the device check and the Speaking section, your voice is streamed to Microsoft Azure AI Speech, which returns a transcript and pronunciation and fluency scores. We store the transcript and the scores. We do not store audio of your voice.
• Your result: your levels, report, certificate and certificate ID.
• Your history with that company: assessments you take for the same company are linked by your email address, in whichever cohorts they were taken. The company sees them together, with how your overall level and each skill have changed, and when you are due to be assessed again. Their HR team may also record your department, job title and a target level for you.
• Session and device: a random device identifier that ties your test to one browser, and the time of your last activity while the test is open. This stops the test running on two devices at once.
• Security data: your IP address, used briefly to limit repeated sign-in and enrolment attempts.
• Cookies: only essential cookies, which keep you signed in (up to 6 hours for candidates, 12 hours for HR and company accounts) and tie your test to your device. We do not use advertising or analytics cookies.

Additionally, if your cohort allows breaks between sections

• Sittings: the start and end time of each sitting, the section you paused after, and the date by which the test must be finished. The HR team sees these on the dashboard and in your report.
• Resume code: a code that lets you continue on another computer. We store it only in a scrambled (hashed) form, and a new one is made each time you take a break. If email sending is set up, we also email it to you.

Additionally, if your HR team lets you redo a section

• Retake history: which sections you were allowed to redo, when, whether you finished, and your result for each redone section before and after. Earlier results are kept, not overwritten, and your report shows them. The latest result counts.
• Retake link: a personal link to start the retake. We store it only in a scrambled (hashed) form. If your HR team chooses, we email it to you.
• Reissued certificate: your certificate is reissued with a new ID. The old ID stays on our verification page, marked as superseded, with the date and the new ID.

The microphone during the speaking section

During the speaking section the microphone stays on between recordings, while the question is on screen and while you prepare. A simple check runs in your browser for speech-like sound. No audio is recorded, sent to us or stored, we do not know whose voice it was or what was said, and it does not affect your integrity score. Only a note of the time and how long it lasted is saved, which the HR team of the company that invited you can see. Please stay quiet while you prepare.

Additionally, if your cohort uses integrity flags (the standard mode)

• With your consent, your camera is analysed on your own device while you take the test. The analysis notices when no face is visible, more than one person is present, you look away from the screen, or you turn your head away, for more than a few seconds.
• Test-window events are also recorded: leaving full screen, switching tabs or windows, blocked attempts to paste, drop, copy or autocorrect text, blocked keyboard shortcuts, the test open in a second tab, a second screen, and writing-assistant extensions.
• No video or image leaves your device in this mode. Only the type, time and duration of each event is sent to us.

Additionally, if your cohort uses snapshots

• Everything under integrity flags.
• With your separate, explicit consent, a small photo (320×240 pixels) is taken from your camera when one of the camera events is detected, up to 12 photos per test.
• Snapshots are visible only to OTO and the inviting company's HR team, and are deleted after 90 days.
• Snapshot mode is off unless OTO has switched it on for your cohort.

If your cohort does not use the camera

The camera is not used and no test-window events are recorded. Only what is listed under “from everyone” (and your invitation, sittings and retakes, where they apply) is collected.

Why we use it

• To run company accounts, sign the right people in, and keep track of how many seats a company has used.
• To invite you to the assessment when a company asks us to.
• To run the assessment, score your answers and work out your level.
• Where your cohort allows it, to let you take breaks between sections and continue later.
• When the company allows it, to let you redo a section and update your result and certificate.
• To give that company your report, and to issue your certificate.
• To show them how your level has changed between assessments, how you compare with the target they set, and when you are due to be assessed again.
• To send the reminder emails a company has asked for, such as who has not started, whose deadline is close, who is due a retest, who is below target, and a weekly summary.
• To show them how many OTO courses would take you to their target level.
• In proctored cohorts, to protect the fairness of the assessment through the events and score described here.
• To keep the service secure and make sure each test runs on only one device.

We use the camera, and snapshots where enabled, only with your explicit consent, which you give separately, in Arabic or English, before the test starts. If you decline, you cannot start a proctored test. Contact the HR team that invited you to discuss alternatives.

How integrity signals are used

In proctored cohorts, events are combined into an integrity score out of 100 (Clear, Review or Flagged) with a timeline. These are automated signals for human review, not proof of cheating. Nobody is failed automatically. The HR team decides what, if anything, to do, and can allow a retake.

Who can see your data

• The HR team of the company that invited you, and their colleagues on the same company account: your invitation status, enrolment details, sittings, retake history, your assessments over time, result, report and certificate. In proctored cohorts, also your integrity score and events, and snapshots if used.
• OTO staff who run the service.
• Anyone with your certificate ID can confirm on our public verification page that it is genuine. The page shows your name, level, test date and company. If your certificate was reissued after a retake, the old ID shows as superseded and points to the new one.

We do not sell your data or use it for advertising.

Service providers and where your data is processed

Your data is processed outside Egypt, in the European Union and in the United States. These providers run parts of the service for us:

Our pages also load typefaces from Google Fonts, so your browser connects to Google's font servers. No test data is sent to Google.

How long we keep it

Your rights

Under Egypt's Personal Data Protection Law (Law No. 151 of 2020) you have the right to:

• know what personal data we hold about you, and get access to it;
• have it corrected, updated or completed;
• ask us to erase it;
• ask us to limit how we process it, or object to processing;
• withdraw your consent at any time (this does not affect processing already done);
• be told if a breach affects your personal data;
• complain to the Personal Data Protection Center.

To use any of these rights, call our hotline on 02 2122 1230, or write to us via www.otocourses.com. Please tell us your name, your work email and the company that invited you. You can also contact that company's HR team.

Changes to this notice

If we change how we use your data, we will update this notice and its version number. If a change affects something you consented to, we will ask for your consent again.

See also our assessment terms and accessibility page.

This notice is also published in Arabic. The Arabic text is a translation of this English one, and if the two differ, this English version governs.