Privacy, terms of use and refunds.

PMCert Global Institute is the controller of the data described on this page and operates the platform at pmcert.org. For any matter concerning personal data, including as the channel of the data protection officer, write to [email protected]. The full identification of the supplier is on the legal information page.

Nothing here is hypothetical: each item corresponds to a field that exists in the system. Name, email and certification exam data are needed for the service: without them we cannot issue the voucher, deliver the exam or award the credential. Profile data is optional.

• Account: your name, your email and, if you create a password, only its hash, never the password in readable form. If you sign in through an external provider, the identifier it returns to us, so that changing your email there does not lock you out here.
• Profile: job title, location and LinkedIn link, all optional and filled in by you.
• Sessions: while you are signed in, we keep the session validity, the browser and the source IP address. The session code itself is never stored, so a leaked database backup does not become access to your account.
• Certification exams: the questions drawn, your answers, the time on each, the name you chose for the certificate, the IP, the country the exam was opened from, the browser and a weak device signature.
• Integrity: exam session events, such as leaving and returning to the exam window and attempts to copy or paste. Exits from the window have an automatic effect, described in the candidate handbook: from the 9th, the credential is issued within 3 business days, and on the 10th the exam is ended.
• Open assessment: the per-domain result of the free assessment, linked to your account only if you are signed in, or to your email if you ask for the result and study plan by email.
• Payment: the amount paid, the currency and the purchase identifier. Card and Pix details never pass through PMCert: payment happens inside the payment processor’s environment.
• Second chance: the code of the coupon received after not passing, the email it is linked to and when it was used.
• Unfinished purchase: the email given to the payment processor and the link to resume the purchase, used only for the single reminder described in the section on emails.
• Content list: email, name and country, if you subscribe.
• Testimonials: the rating, the text, the job title and the name format you choose, if you answer a testimonial request. It is only published with your consent, and you can ask for it to be taken down at any time.
• Delivery failures: addresses that bounce email with a permanent failure go on a suppression list and stop receiving anything beyond essential messages.
• Communication: for each message sent, we keep the recipient, the subject and the date. The email content is not stored.

We process your data on the legal bases provided for in the LGPD and the GDPR. Each purpose has its own, and none of them is "just because".

• Keeping your account, issuing the voucher, delivering the exam and the credential: performance of a contract. It is what you contracted when you bought the exam.
• Exam integrity, with IP, country, device signature and session events: legitimate interest. The interest is the validity of everyone’s credential, including yours: a certification that can be bought by cheating is worth nothing to those who earned it.
• Public register of credentials: performance of a contract and legitimate interest. The credential exists to be checked by third parties; a register that cannot be consulted is not a register.
• Account security, sign-in attempt limits and the administrative log: legitimate interest, and legal obligation where applicable.
• Payment records: performance of a contract and compliance with a legal obligation.
• Cookie-free site measurement: legitimate interest in knowing which pages help people decide, without identifying anyone.
• The single reminder of an unfinished purchase and other relationship emails: legitimate interest, within the relationship you started with PMCert, with one-click unsubscribe.
• Content and news emails: consent, given by you when subscribing and revocable at any time through the unsubscribe link in every message.

The exam score is calculated automatically, by counting correct answers against the published passing score, and you can ask for a human review of the result by writing to support. These signals never fail anyone automatically. They produce flags for human review, and they let us measure whether exam fraud is actually happening before deciding on heavier measures. The device signature is intentionally weak: it can notice thirty exams coming from one machine, and it is not designed to follow you anywhere else. It uses no canvas, no audio and no WebGL, which are the techniques capable of producing a strong, persistent identifier.

PMCert does not sell personal data and does not hand it to anyone for advertising. These are the processors that handle data on our behalf, each within what is necessary:

• Payment: Stripe. It receives your email, the amount, the currency and the exam purchased, plus card or Pix details, which never pass through PMCert.
• Site network and protection: Cloudflare. Every access to the site goes through it, with the IP address and the country of origin.
• Hosting of the application and the database: Hostinger.
• Database backups: Cloudflare R2, with public access disabled.
• Email delivery: DNSPro, which runs the email server of the pmcert.org domain, through which the address and content of messages pass.
• Sign in with Google, only if you choose it: in that flow we receive your identifier, your email and your name.
• Artificial intelligence: OpenAI, for texts you send us, such as a testimonial. Before sending, we remove email addresses, phone numbers, web addresses and proper names.

PMCert serves candidates worldwide, and the processors above handle data in more than one country, including outside yours. Each transfer relies on those processors’ data processing agreements, with the standard contractual clauses provided for in the GDPR and the LGPD, and is limited to the purposes on this page. To find out where a specific piece of data is processed, write to [email protected].

Different periods for different kinds of data:

• Raw exam session events: deleted after 180 days. Only the summary flags linked to the attempt remain.
• Sign-in sessions: deleted when they expire, which happens within 14 days without use.
• Site measurement: deleted after 24 months.
• Unfinished purchase: deleted after 90 days.
• Messages sent through the contact form: deleted after 24 months.
• Database backups: replaced within 30 days.
• Account data, attempts, coupons and communication records: for as long as the account exists.
• Payment records: for the period required for keeping financial records.
• Issued credentials: permanent, for the reasons in the section on deleting your account.

A certification only means something if a third party can check it. So part of your data is public by product decision, and it matters that you know exactly which part:

• An issued credential is public: your name, which certification you hold, the code and the date of issue. Scores and per-domain performance are never published; they belong to you and appear only in your account and on the certificate you choose to share.
• Your public profile starts switched on, and it shows your name, your credentials and whatever you filled in for job title, location and LinkedIn. Public profiles are listed in the site directory and in the sitemap.
• You can switch the public profile off at any time, in your account. Switched off, it leaves the directory, the search and the sitemap.
• Only if you switch it on in your account may PMCert celebrate a new credential on its social networks, with your first name and a link to your public profile. It starts off, and switching it off removes from the queue whatever has not been published yet.
• The code verifier keeps working even with the profile switched off, and it shows the holder name. Whoever holds the code must be able to check it: that is the register, and the profile is a different thing.
• The credential’s digital badge (Open Badges standard) is public like the credential. Instead of your email, it carries a hashed imprint of the address, which only confirms the email to someone who already knows it.

The platform uses seven cookies, all needed for it to work or keeping a choice of yours. There is no measurement, advertising or third-party tracking cookie, which is why we do not ask you to accept anything:

• Session, which keeps you signed in, lasting 14 days.
• Language, which remembers the language you chose so the site does not ask again on every visit, lasting one year.
• Currency, created only if you pick another currency in the price selector, lasting one year.
• Second factor, which lasts five minutes and exists only between the password and the authenticator app code.
• Trusted computer, created only if you tick “Trust this computer” when entering the second-factor code, and which skips the code in that browser for 60 days.
• External sign-in state, which lasts ten minutes and protects that flow against forgery.
• Support return, created only when an administrator opens a view of your account to help with a request, and used to return them to their own account.

The tools at /tools work without an account. What you type stays in the page address and in this browser’s storage, so your work is not lost when you reload; it does not go to our server or to measurement, and that storage is not a cookie and is not used to identify you. There are three exceptions, all triggered by you:

• Create link: we keep the result on the server (without name or email) so anyone with the link can open it. It is deleted 180 days after the last visit and, at most, one year after it was created.
• Get it by email: we keep your email and the result link, with two-step confirmation, and send up to four emails about the tool’s domain, with one-click opt-out.
• Automatic suggestions, when the feature is switched on: the text you wrote goes to the artificial intelligence processor only to generate the suggestion, without email, phone, web address or proper names. We keep only the generated suggestion, linked to a code calculated from the input, so the same answer is not requested twice.

To know which pages help people decide, we record site events, such as a visit to a certification page, the start of a purchase and the result of an open assessment. This record uses no cookie or storage in your browser and does not store your IP address. Each event carries only the language, the country, the page and an identifier for the day, computed from the truncated IP and the browser with a key that changes every day. It allows counting visits within one day and does not allow following you from one day to the next.

There are three kinds of message, each with its own rule:

• Transactional: voucher, receipt, result, password recovery and email confirmation. They are part of the contracted service and are always sent.
• Relationship: messages tied to a relationship you already have with PMCert, such as the single reminder of a purchase you started and did not finish, the reminder of a voucher not yet used, the second-chance coupon, the suggestion of the next certification for holders, the testimonial request after an exam or the single invitation to the weekly tools series, which only starts if you confirm. Basis: legitimate interest, with one-click unsubscribe in every message. The purchase reminder is not sent to buyers in Europe, the United Kingdom and Switzerland.
• Content and news: only with your consent, recorded when you confirm the subscription through the link we send to your email, and with unsubscribe in every message. The subscription includes the monthly newsletter and a series of 60 weekly emails, each about a free product management tool.
• Our emails have no open-tracking pixel. Links carry the campaign name, not yours: we count how many visits arrived through each message without knowing who clicked.

The LGPD and the GDPR give you the right to request: confirmation that we process your data, access to it, correction of anything wrong, portability, information about who we share it with, erasure, objection to processing based on legitimate interest, and withdrawal of consent for content emails. To exercise any of them, write to [email protected]. We answer within 3 business days, free of charge. You may also complain to the data protection authority of the country where you live.

Deletion happens on request: write to [email protected] from the address on the account. We delete your account, your attempts, your exam telemetry, your vouchers and your communication records. What cannot simply disappear is a credential already issued: an employer who verified it must still be able to verify it, and a register that can be quietly erased is not a register. If a credential has to be withdrawn, that is a revocation, and it stays visible marked as revoked rather than vanishing. Authorship records for internal content remain, with the identification removed.

Passwords are stored only as a hash, using a slow derivation algorithm, and never in readable form. Your session code is not written to the database, only a fingerprint of it. Repeated sign-in attempts are rate limited. You can turn on a second authentication factor in your account, and we recommend that you do. No system is infallible: if an incident affects your data, we will notify you and the competent authorities as the applicable law requires.

The platform is intended for professionals aged 18 or over. We do not knowingly collect data from minors. If we learn that an account was created by someone under 18, it will be removed.

PMCert Global Institute assesses product management knowledge through its own certification exams and issues credentials to those who pass. A credential attests to the result of an exam, not to employment, prior experience or membership of any organisation. No course is required to sit an exam, and no course guarantees a pass.

The account is personal and non-transferable, and some obligations come with it:

• Use your real name. It is the name that appears on the certificate and in the public register, and correcting it after issue depends on support.
• One person, one account. Multiple accounts for the same person may be removed.
• Your password is your responsibility. If you suspect improper access, change the password, which ends all other sessions, and tell support.

Each purchase generates a voucher, and each voucher is worth one exam attempt:

• A purchased voucher has no expiry date. You sit the certification exam whenever you want.
• The voucher is not tied to an account: whoever enters the code uses the attempt. Treat the code the way you would treat a ticket, and do not publish it.
• The attempt is consumed when the exam is opened, not when it is submitted. Abandoning an open exam consumes the voucher.
• If you do not pass, a new attempt requires a new voucher.

The certification exam is individual and closed book. The rules below exist so that each person’s pass keeps meaning something, and they apply to every PMCert exam:

• Sit your own exam. Do not use help from another person, and do not sit an exam in anyone else’s place.
• Do not consult material, websites, apps or artificial intelligence assistants during the exam.
• Do not copy, photograph, transcribe, reproduce or publish the questions, the options or any part of the item bank, during or after the exam.
• Do not use automation, scripts or any means of circumventing the normal operation of the exam.
• Do not attempt to reach administrative areas, other candidates’ data, or parts of the system that are not yours.
• Do not state, display or imply a credential you have not earned, and do not alter an issued certificate.

Revoking is the gravest act on the platform, which is why the grounds are explicit. A credential may be revoked when:

• There was fraud in the exam, including help from third parties, an exam sat by someone else, prohibited consultation or the use of automation.
• The exam questions were published, in whole or in part, by the holder.
• The credential was obtained with a false identity or false data.
• The credential is being presented in a misleading way, or the certificate has been tampered with.
• It was issued through an administrative or technical error by PMCert itself.

A revoked credential does not disappear: the code stays checkable and starts answering that the credential is revoked, because vanishing would make the code look forged to anyone who verified it in good faith in the past. The public profile stops listing it. The reason is recorded internally, and the holder may request a review by writing to [email protected]. An administrative error is reversible, and restoring returns the credential to its previous state. Revocation for fraud does not entitle you to a refund.

The questions, options, syllabuses, texts and the PMCert name belong to PMCert Global Institute. Your certificate and your credential are yours, and you may display, share and add them to your professional profile freely. What may not be reproduced is the content of the exams.

We work to keep the platform available, but maintenance and failures happen. If a problem on our side interrupts an exam in progress, write to [email protected] and we will release a new attempt at no cost. We may change prices, the exam catalogue, syllabus content and this text; changes apply to later purchases, never retroactively to a voucher already bought.

You have 14 days from the date of purchase to request a full refund, as long as the voucher has not been used. Just send an email to [email protected] saying you want the refund, from the same address used in the purchase.

The process is simple, and it has one effect worth knowing in advance:

• We return the amount through the same payment method used in the purchase. How long until the money appears depends on your bank or card issuer.
• The voucher is cancelled in the same act, and the code stops working. This is necessary: without the cancellation, the code would still open an exam after the money had gone back.
• A voucher already used is not refundable, even within the 14 days. The attempt is consumed when the exam is opened, and from then on the service has been delivered.
• After the 14 days, the voucher remains yours and never expires, but it is no longer refundable.
• A bundle of more than one certification in a single payment is refunded as a whole, and only while none of its vouchers has been used and within the 14 days. If one of them has been used, none is refundable.

If you do not pass the certification exam, you receive a 50% discount coupon to buy a new attempt at the same certification. The coupon is valid for 90 days, can be used once and appears on your result and in the result email. It does not combine with bundles or batch purchases.

If you score 70% or more on a certification's open assessment, you receive a 10% discount coupon to buy that certification exam. The coupon is valid for 7 days, can be used once and appears on the assessment result. It does not combine with bundles, batch purchases, another coupon or a referral.