CIROPrep Privacy Policy

Version 2026-10-v8 — effective October 28, 2026

This English version is a faithful translation of the French version. If the two versions differ, the French version prevails.

1. Who we are

CIROPrep is an independent exam-preparation service for Canadian Investment Regulatory Organization (CIRO) exams. CIROPrep is not affiliated with or endorsed by CIRO.

CIROPrep operates the ciroprep.com store and the ciroprep.academy learning platform. CIROPrep is operated by Ahmed Beddi as a sole proprietor.

We do not collect personal information on behalf of CIRO or any other organization.

2. Person in charge of the protection of personal information

CIROPrep's person in charge of the protection of personal information is:

Ahmed Beddi
Owner of CIROPrep
admin@ciroprep.com

You may contact him with any question about this policy or our privacy practices, to make a request, exercise a right or submit a complaint.

3. How we collect your information

We primarily collect information that you provide directly when you:

• create an account or sign in to CIROPrep;
• complete a diagnostic, answer practice questions or a mock exam, mark a lesson as done, respond to recall flashcards, add a flashcard to your review list, mark a practice or mock-exam question for review, or save an exam tip;
• provide your exam date;
• purchase a product or course;
• provide your exam result or a testimonial;
• subscribe to our emails;
• contact us.

We also receive from Shopify the order information we need to give you access to products you purchased.

Our websites and technology providers may automatically collect certain technical information necessary to operate and secure their services, such as IP address, browser or device type, connection date and time, and certain technical logs.

Information used to analyze website usage, such as pages viewed or the source of a visit, is collected through Google Analytics only if you accept analytics cookies.

4. What we collect and why

Account and access. We collect your email address and language to create and manage your account, authenticate you, send you a sign-in code or link and provide the services you request.

Learning. We collect your answers and results from the diagnostic and practice activities, and the lessons you mark as done, to track your progress, assess your readiness and provide recommendations and a study plan.

If you take a timed mock exam (Exam mode), we keep the questions you were given, your answers, when the exam was started and submitted, and your result, including the counts, your readiness level in each element and the elements to study first, to calculate your result, show you your answers with the explanations and keep a history of your mock exams. We do not record the time spent on each question. If you mark questions for review during a mock exam, we keep which questions you marked while the exam is in progress, so that they are still flagged if you resume it.

When you use a lesson’s recall flashcards, we keep your latest choice for each card (“Got it” or “Not yet”) and the date you last reviewed it so that your recall history can follow you across devices and we can show descriptive counts about your progress through the lesson. We also keep the flashcards you add to your review list, the questions you mark for review and the exam tips you save, to show them to you in Review and on the exam tips tab. At your request, we use your previously saved answers to show you the questions and calculation labs to review, including in a practice set. In a timed practice set, the timer is neither recorded nor sent; each answer is recorded with its time, as in any practice.

We also show descriptive counts calculated from your previously saved answers: the number of practice questions you answered each week and by element and, when you ask for it, the number of correct answers by element based on your latest answer to each question. These counts are not an assessment of your exam readiness.

Exam planning. If you choose to give us your exam date, we use it to pace your study plan and, if you separately agree, to ask for your exam result after the exam.

Purchases. We receive information needed about your purchases, including the product purchased, price, date and order email, to process your order and give you access to purchased products. Payments are processed by Shopify and its payment providers. CIROPrep does not have access to your full payment card number. We also keep a record of the version of the terms of sale accepted with your order, to document the contract. If the payment authorization for an order is declined, has expired or has been cancelled when we try to collect the payment, access to the product is deactivated and the order cancelled automatically, with no person involved; we tell you by email.

Exam results. If you agree to provide your exam result, we may use it to assess the effectiveness of our resources and produce statistics. We do not publish your individual result without your authorization.

Testimonials. We use or publish a testimonial only with your consent. If it includes your name, initials or other identifying information, we publish only the information you authorized.

Communicating with us. When you write to admin@ciroprep.com, we use your email address, the content of your message and any information you choose to share to answer your question, handle your request or complaint and keep a record of how it was handled. We do not add your address to our marketing emails unless you ask us to in writing.

Technical information. Certain technical data, such as IP address, browser, device, request date and time, and error or security logs, may be processed to operate, secure and maintain the reliability of our services.

Analytics information. If you accept analytics cookies, Google Analytics may collect information about your use of the site, including pages viewed, referral source, certain device information and approximate location information. We use this information to understand and improve our websites and content.

We limit collection to information needed for the purposes described above. We do not sell or rent your personal information.

5. Diagnostic, mock exams and profiling

The CIROPrep diagnostic includes a personalization feature that uses your answers and results to assess certain characteristics of your exam preparation, such as the topics in which you are stronger or need more work, and to generate study recommendations.

This feature constitutes a form of profiling under Québec privacy law.

It is not activated automatically. You activate it by choosing to start the diagnostic. If you do not start the diagnostic, CIROPrep does not create this readiness profile.

You can use the other features available to you without completing the diagnostic, but you will not receive the personalized diagnostic result or related study plan.

Exam mode also includes a profiling feature: from your answers to a mock exam, it assesses your readiness in each element of the syllabus and identifies the elements to study first. It is not activated automatically: you activate it by clicking “Start the mock exam,” below a notice that explains it. If you do not start a mock exam, CIROPrep does not create this profile. Exam mode comes with the complete course; you can use the other features available to you without taking a mock exam.

We do not use these profiling features for behavioural advertising.

If you choose to save your diagnostic to your account, we keep your answers, your result and your exam date with your account to show your priority elements and study plan on your dashboard. When you save a new diagnostic, the one you saved earlier is removed from your account and, if it is yours, deleted. A diagnostic is yours if it is tied to no email address or to your account's address. A diagnostic tied to another email address can't be saved to your account. You can delete the diagnostics saved to your account that are yours at any time from your account. A diagnostic tied to another email address is never deleted from your account: it is only removed from it and stays with that address. If it is yours, write to us from that address to have it deleted (section 10).

CIROPrep does not personalize its marketing emails based on your diagnostic or your purchases. If we ever offer this personalization, we will first ask for your separate consent. Our email service provider, Resend, receives your email address, your language and the content of the emails it delivers to you. CIROPrep does not collect subscriber-level email-open or link-click information for marketing analytics.

6. Optional consent

Where your consent is required for an optional use, we ask for it separately.

This may include:

• promotional or educational emails;
• asking you for your exam result after the exam;
• using or publishing a testimonial;
• analytics cookies.

Consent boxes are not pre-selected, and the price of a course does not depend on accepting these optional uses.

You may withdraw consent at any time, including through the applicable unsubscribe link, settings available in your CIROPrep account or by writing to admin@ciroprep.com.

Withdrawing consent to marketing emails does not prevent CIROPrep from sending messages needed to operate your account or complete a transaction, such as a sign-in code, order confirmation or important notice about your access.

7. Cookies and similar technologies

We use cookies or similar technologies necessary to operate our services, including for the shopping cart, sign-in, security, language preferences and, at your request, saving your diagnostic result to your account when you sign in. These technologies may remain active because they are necessary to provide the service.

We also use your browser's local storage to let you resume a course where you left off on this device. This information stays in your browser, is not sent to CIROPrep and is cleared when you sign out. To keep resume information separate between accounts used on the same device, the browser also keeps a pseudonymous identifier for your account. It is cleared when you sign out.

Google Analytics is off by default. It is activated only if you accept analytics cookies through our cookie management tool.

You can change your choice later through the cookie settings available on the site.

CIROPrep does not use Google Analytics for advertising profiling and does not use your learning profile for behavioural advertising.

8. Who can access your information

Within CIROPrep, only the owner and authorized collaborators or service providers who need personal information to perform their work may access it. Access is limited to what is necessary for their responsibilities, and appropriate confidentiality obligations apply.

We also use technology providers to operate CIROPrep:

These providers may use their own subprocessors to provide their services.

9. Processing outside Québec

Some of our providers or their subprocessors may process personal information outside Québec, including elsewhere in Canada, in the United States or in other countries.

This means personal information may be subject to the laws that apply in the jurisdictions where it is processed.

CIROPrep takes its privacy obligations into account when entrusting personal information to providers located outside Québec.

10. Retention and destruction

We keep personal information only for as long as necessary for the purposes for which it was collected, subject to legal retention requirements.

As a general rule, we keep information associated with your account while you have an account or active access.

Your recall history (the latest choice and the date of your last review for each recall flashcard) is kept while you have access to the element concerned. When that access ends, it is no longer shown and is deleted 90 days later, unless access is restored in the meantime. It is also deleted with your account. You can ask us to delete your recall history by writing to admin@ciroprep.com.

The flashcards on your review list, the questions you mark for review and the exam tips you save are kept while you have access to the relevant element, until you remove them. When that access ends, they are no longer displayed and are deleted 90 days later unless your access is restored in the meantime. They are also deleted with your account.

Questions you mark for review during a mock exam remain marked only for that exam. Those flags are deleted when the exam is submitted, either by you or automatically when time runs out. If the exam is abandoned, they are deleted at the latest the night after time runs out.

Your mock exams—the questions you were given, your answers and your results—are kept in your account history, including after your course access ends, and are deleted with your account. You can ask us to delete them by writing to admin@ciroprep.com.

An account with no activity for 24 months, no active product access and no active optional consent may be deleted. Where reasonably possible, we send an email notice at least 30 days before deletion. Signing in is sufficient to make the account active again.

An email address associated with no purchase and no activity for 24 months may also be removed from our active systems.

Customer-profile information that is no longer needed is deleted according to our retention schedule. Order and transaction information that we must retain for tax, accounting or legal purposes is kept for the period required by law. We limit those records to the information necessary for those purposes.

Emails exchanged with admin@ciroprep.com are kept according to their purpose. An ordinary support request is deleted once it is no longer needed and, as a general rule, no later than 24 months after the last exchange. The record of a formal request for access, correction, deletion or portability, or of a privacy complaint, and the proof of how it was handled, are kept for five years after the request is closed. These periods may be extended where a legal proceeding, investigation, dispute or other legal obligation requires it.

An unconfirmed sign-up request expires after 7 days. We then keep only the information needed to keep the cancellation or unsubscribe mechanism operational for 60 days after the confirmation email was sent, and then delete it.

Proof of acceptance of the Terms of Sale is kept for the term of the contract and for three years after it ends, then deleted unless a complaint, dispute, proceeding or other obligation requires longer retention. Transaction information required for tax purposes follows its own retention schedule.

When a diagnostic is removed from an account because it doesn't seem to belong to the account holder (with "Not my diagnostic", or automatically because it is tied to another email address), we keep a record of that confidentiality incident for five years, with no name or email address. A deletion request doesn't erase that record, but it can then no longer identify you. A deletion request deletes the diagnostics that are yours; another person's diagnostic saved to your account is removed from it, without being deleted.

The record of a decision based exclusively on automated processing, such as removing access after a declined payment, is kept for one year after the decision or its review, longer while a review you requested is pending or a complaint, dispute or proceeding is open. Information about an order whose payment was declined before the sale was completed is kept for one year after the decision or its review, then deleted, unless a dispute or investigation is open.

If you ask us in writing to receive our emails again, we keep that message as proof of your consent for as long as we rely on it, and for five years after you withdraw it.

When you withdraw consent, or when your account or email address is deleted, we keep a minimal record of your consents and withdrawals for five years after that withdrawal or deletion. This record includes information such as the type of consent, the relevant dates, the version of the wording shown to you and the source. It is linked to a pseudonymised identifier—a code that replaces your email address—so that we can demonstrate that your choices were respected.

When information is no longer required and there is no legal obligation to retain it, we destroy it in accordance with our retention practices.

11. Security

CIROPrep uses administrative and technological measures intended to protect personal information against unauthorized access, use, disclosure, loss or alteration.

Access to systems containing personal information is limited to the people and providers who need it to provide or administer our services.

The primary database containing learning information is configured in Supabase/AWS's Canadian region.

No information system, however, can guarantee absolute security.

If a confidentiality incident creates a risk of serious injury, we will take the steps required by law, including notifying the Commission d'accès à l'information du Québec and affected individuals when required.

12. Your rights

Depending on applicable law, you may ask to:

• access personal information we hold about you;
• correct inaccurate, incomplete or ambiguous information;
• have information deleted where the law gives you that right;
• withdraw consent to an optional use or disclosure;
• receive certain computerized personal information that we collected from you in a structured, commonly used technological format;
• where permitted by law, have that information communicated to a person or organization authorized to receive it.

When a decision about you is based exclusively on automated processing, such as removing access after a declined payment, you can also ask for the personal information used to make it, the reasons and the principal factors and parameters that led to it, and the correction of that information, and submit your observations to a person at CIROPrep who can review the decision.

To exercise these rights, write to admin@ciroprep.com.

For formal access or correction requests, and requests about an automated decision, we will respond in writing within the period required by law, generally no later than 30 days after receiving the request.

We may need to verify your identity before responding.

Some rights are subject to exceptions provided by law. If we refuse all or part of a request, we will explain the reasons where required by law.

13. Complaints

If you have a concern or complaint about how CIROPrep handles your personal information, contact the person in charge of the protection of personal information at admin@ciroprep.com.

We will review your concern and attempt to resolve it.

If you are not satisfied with our response, you may contact the applicable privacy regulator, including the Commission d'accès à l'information du Québec or, where its jurisdiction applies, the Office of the Privacy Commissioner of Canada.

14. Minors

CIROPrep services are designed for adult users and are not intended for anyone under 18.

If you believe that a minor has improperly provided personal information to us, contact us at admin@ciroprep.com.

15. Changes to this policy

We may update this policy when our practices, services, providers or legal requirements change.

The version number and effective date appear at the top of this page.

We will provide notice of any change by a means appropriate to reach the people concerned, such as a notice on ciroprep.com, ciroprep.academy, in the user account or, where a change is significant for affected users, by email.

Where a new use of your information requires new consent, we will ask for that consent before using your information for the new purpose.