Privacy Policy
Last updated: July 15, 2026
OCI Exams is an independently run publisher of Oracle Cloud Infrastructure certification practice tests, sold through Udemy. I'm the only person behind this site - there is no company or team involved - and everyone visiting deserves to know exactly what happens to their data. This policy explains that in full: what I collect, why, on what legal basis, for how long, and what rights you have over it.
1. General information
I pay close attention to the protection of any personal data this site processes, and I process it in line with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), regardless of where you're visiting from.
Two definitions from the GDPR are worth stating up front:
- "Personal data" means any information relating to an identified or identifiable natural person - someone who can be identified, directly or indirectly, by reference to an identifier such as a name, an online identifier, or location data.
- "Processing" means any operation performed on personal data, whether or not by automated means - collecting, storing, using, disclosing, or deleting it, among others.
I never process special categories of data (health, religion, ethnicity, sexual orientation, and similar) through this site, and I don't ask you for any.
2. Rights of the data subject
As a visitor whose data I process, you have the following rights:
Right to information
You have the right to transparent information about how your data is processed and how to exercise your rights. I meet this by publishing this policy.
Access right
You have the right to ask whether I'm processing your personal data, and if so, to get a copy of it along with details of how it's processed.
Right to rectification
If any data I hold about you is inaccurate or outdated, you have the right to have it corrected without undue delay.
Right to erasure
In the cases set out in Article 17 GDPR - for example, once the data is no longer necessary for the purpose it was collected for, or you withdraw consent - you can request that I delete your data. Unsubscribing from emails does this automatically.
Right to restrict processing
In the cases set out in Article 18 GDPR, you can request that I restrict how your data is processed rather than deleting it outright - for example, while a dispute about its accuracy is resolved.
Right to object
Where I process data based on legitimate interest, you can object to that processing at any time. Since analytics on this site only run after your explicit consent, you can achieve the same result simply by declining or withdrawing that consent.
Right to portability
Where processing is based on your consent, you can ask for the data you provided in a structured, commonly used, machine-readable format, so you can transfer it elsewhere.
Right to complain
If you believe my processing of your personal data breaches the GDPR, you have the right to lodge a complaint with your national data protection supervisory authority.
3. Types of processing
Free sample sign-up
If you request a free sample of practice questions, I collect the email address and certification you submitted through the sign-up form, so I can send you the sample and, if you don't unsubscribe, occasional updates about that certification.
| Processed data | Purpose | Legal basis | Duration |
|---|---|---|---|
| Email address, certification requested | Sending the requested sample and related course updates | Consent (Art. 6(1)(a) GDPR), given by submitting the form | Until you unsubscribe |
Cookies
Like most websites, this site uses cookies - small files stored on your device by your browser - and similar tracking technologies. A cookie consent banner (provided by CookieChimp) is shown on your first visit and lets you accept or decline each category below individually. Only the essential category runs before you make a choice, and declining the rest doesn't restrict access to any part of the site. The specific services currently in use are:
- CookieChimp (essential) - stores your cookie consent choices so the site can respect and apply them.
- Google Tag Manager(essential) - a tag management system that loads the other scripts on this page; it doesn't track you by itself.
- Google Analytics (analytics) - measures how visitors use the site, to help me improve it.
- Microsoft Clarity (analytics) - anonymized session recordings and heatmaps, to understand how visitors navigate the site.
- PostHog(analytics) - product analytics on page views and referral link clicks (which certification and track you clicked "Enroll on Udemy" for).
- Google Ads / AdSense (marketing) - supports advertising and remarketing; may process your IP address, browsing activity, and device information to show more relevant ads.
| Processed data | Purpose | Legal basis | Duration |
|---|---|---|---|
| Consent state (e.g. which categories you accepted) | Remembering and applying your cookie preferences | Necessary for the site to function (Art. 6(1)(f) GDPR) | Up to 12 months |
| IP address, browser/device type, pages visited, referral link clicks, session recordings | Understanding how the site is used, in order to improve it | Consent (Art. 6(1)(a) GDPR), given via the cookie banner | Up to 24 months, depending on the provider |
| IP address, browsing activity, device information | Advertising and remarketing | Consent (Art. 6(1)(a) GDPR), given via the cookie banner | Up to 24 months, depending on the provider |
4. Data transfer
I don't sell your personal data, and I only share it with the service providers strictly needed to run this site, each acting as a data processor on my behalf:
- Brevo (EU-based email delivery) - sends the free sample and any follow-up emails.
- CookieChimp - stores your cookie consent choices.
- Google (Google LLC - Tag Manager, Analytics, and Ads/AdSense) - loads and runs the analytics and advertising tooling described above.
- Microsoft (Clarity) - session recordings and heatmaps, only after consent.
- PostHog (EU-hosted product analytics) - processes the analytics data above, only after consent.
- Udemy- clicking "Enroll on Udemy" takes you to Udemy entirely. Any purchase, account, or payment data from that point on is handled solely by Udemy, under Udemy's own privacy policy.
Google and Microsoft are US-based companies, so using their services can involve transferring data outside the EU/EEA. Both self-certify compliance with EU-approved safeguards (such as the EU-U.S. Data Privacy Framework) for these transfers.
I don't transfer sensitive data to any third party, and I don't give any third party access to it beyond what's listed above.
5. Data security
I rely on the service providers above precisely because they maintain their own GDPR-compliant technical and organizational security measures. I don't operate a separate database of visitor data outside of these providers, and I only ever request the minimum data needed for the purpose stated in this policy.
6. Enforcement
You can assert your right to the protection of your personal data before a civil court, or by lodging a complaint with your national data protection supervisory authority (in the EU/EEA, generally the authority in your country of residence). I'd appreciate the chance to resolve any concern directly first - see the contact details below.
7. Incident management
A "personal data breach" is a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of, or access to, personal data. If one occurs, I will report it to the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, and notify affected users where required by law.
8. Children's privacy
This site is intended for working professionals studying for cloud certifications and is not directed at children under 16. I do not knowingly collect data from children.
9. Changes to this policy
If I materially change how I collect or use data, I'll update this page and revise the "Last updated" date above.
10. Contact
For any question, request, or complaint about this policy or your data, email me at ociexams@arnoldgalovics.com. I'll respond as quickly as I can.