Privacy Policy

1. Who We Are

PengCBA —Engineering CBA Assessment Services (https://pengcba.com/) provides Competency-Based Assessment (CBA) writing, review and coaching services to Professional Engineer (P.Eng.) applicants across Canada. We are the "organization" responsible for personal information under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws.

Privacy contact: info@pengcba.com · +16138835905 · Ottawa, ON, Canada

2. Information We Collect

2.1 Information you give us

• Intake / contact form: full name, email address, phone number, target engineering association, chosen package, your engineering background, career timeline and any documents you upload (drafts, CVs, transcripts, reference material).
• Payment form: name, email, package selection and order notes. Card and bank details are entered directly into Stripe or PayPal — they never touch our servers. For e-Transfer payments we receive only your name and the transfer notification from our bank.
• Reviews: your name, role, rating and review text. Your email address, if provided with a review, is used only for verification and is never published.
• Chatbot and correspondence: the content of messages you send us through the on-site chatbot, email or other channels.

2.2 Information collected automatically

• Standard web server logs (IP address, browser type, pages visited, timestamps) used for security and troubleshooting.
• Cookies and similar technologies required for the website to function (session, security and preference cookies). See Section 7.

3. How We Use Your Information

• To respond to your inquiry and recommend the right package (we reply within one business day).
• To deliver the purchased service: reviewing or writing your CBA, coaching sessions, revision rounds.
• To process payments, issue invoices/receipts and meet accounting and tax obligations.
• To publish testimonials you explicitly submit (name, role and text only).
• To secure the website, prevent fraud and spam, and comply with legal obligations.

We do not sell, rent or trade your personal information, and we do not use your documents or drafts to train AI models.

4. Who We Share It With

• Stripe (card payments) and PayPal (PayPal payments) — payment processors that receive only what is needed to process your transaction, under their own privacy policies.
• Our email and hosting providers, who process data on our behalf under confidentiality obligations.
• Regulators or law enforcement, only where required by law.

Your CBA drafts and documents are accessible only to you and your assigned reviewer — never shared with third parties.

5. How Long We Keep It

Inquiry and order records are kept for up to 7 years to satisfy Canadian tax and accounting requirements. Uploaded working documents are deleted once your engagement is complete and any revision window has closed, unless you ask us to keep them for follow-up work. Unsuccessful inquiries are deleted within 12 months.

6. How We Protect It

We use HTTPS encryption, access-controlled admin areas, nonce-protected management actions, and a deny-all protected directory for uploaded files (downloadable only by site administrators). Payment card data is handled exclusively by PCI-DSS-compliant processors (Stripe, PayPal).

7. Cookies

We use cookies required for website functionality and security (for example, admin login sessions and spam protection), plus a privacy-conscious analytics cookie (pcb_sid, expires after 30 minutes) that groups your page views into a single visit so we can understand which pages are useful — it does not identify you personally and is never used for advertising. We do not use advertising or cross-site tracking cookies. Visitor statistics (pages visited, time on page, approximate city/country, device type) are stored on our own server; IP addresses are stored only as salted hashes and never in raw form. You can disable cookies in your browser; the public pages will still work.

8. Your Rights

Under PIPEDA you may request access to your personal information, ask us to correct it, withdraw consent (subject to legal or contractual restrictions), or request deletion of data we are not required to retain. Email us at info@pengcba.com — we respond within 30 days. You may also complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).

9. International Processing

Our payment processors and hosting/email providers may process data outside Canada (primarily the United States). Where that happens, your information is protected by contractual safeguards and the providers' own compliance programs.

10. Children

Our services are intended for adults pursuing professional licensure. We do not knowingly collect information from anyone under 18.

11. Changes to This Policy

We may update this policy from time to time. The "last updated" date above reflects the current version; material changes are announced on this page.

12. Contact Us About Privacy

Questions, access or deletion requests: info@pengcba.com · +16138835905
Ottawa, ON, Canada

Contact Us