Privacy Policy

Two different roles, and why it matters

There are two kinds of personal data around Certiqa and they are governed differently.

The first is personal data about the people who run and buy Certiqa accounts: the person who signs up, the people who use it, the person we invoice. For that, iS3 Ltd is the controller and this policy applies.

The second is personal data your organisation puts inside Certiqa as part of its management system: employees named in incident reports, crew in a certificate register, suppliers' contacts, people named in an audit finding. For that, your organisation is the controller and we are the processor acting on your instructions. The Data Processing Addendum governs it, not this policy.

Who we are

iS3 Ltd, a company registered in England and Wales, is the controller for the personal data described in this policy. Contact us at hello@is3.co.uk.

What we hold, and why

We hold the following about the people who use and administer Certiqa accounts:

• your name, work email address and the organisation you belong to, so that you can have an account and we know who did what in it
• your role and permissions, so the platform can enforce them
• records of your activity in the platform, held in an append-only audit log, so that a governance record can be evidenced and so we can investigate a security incident
• billing contact details and subscription records, held by us and by our payment processor. We do not hold your card details; our payment processor does
• support correspondence, so we can help you and refer back to it
• technical records such as sign-in times and the network address used, for security

Our lawful bases

We rely on:

• performance of a contract, for everything needed to provide Certiqa to your organisation and to bill for it
• legitimate interests, for platform security, fraud prevention, keeping our own records and improving the product. We have considered your interests and rights against ours in each case
• legal obligation, for accounting and tax records
• consent, only where we ask for it specifically, which you may withdraw at any time

The audit log, and why we cannot simply delete from it

Certiqa keeps an append-only audit log. That is not an inconvenience we have failed to fix: it is the control that makes a governance record trustworthy, and a log that can be quietly edited evidences nothing.

So when we erase personal data, we pseudonymise or remove the personal content while preserving the fact that an event occurred and its sequence. Where a record must be kept because we are legally required to keep it, or because it is needed to establish or defend a legal claim, we keep it and we will tell you that we have.

Where your data is

The Certiqa database is hosted in the United Kingdom (London). Some of our sub-processors operate outside the United Kingdom; where they do, the transfer is covered by appropriate safeguards. The Data Processing Addendum lists them and the safeguards that apply.

How long we keep it

We keep account and activity data for as long as your organisation has a subscription, and afterwards for as long as we need it to meet a legal obligation or to establish or defend a legal claim.

Billing records are kept for the period required by United Kingdom accounting and tax law.

Records of your agreement to our terms are kept for as long as the agreement could matter, because they are the evidence of what was agreed and when.

Ai assistance

Certiqa uses an Ai model to help draft and analyse content inside the platform. The content sent to it is the content of your management system, sent to carry out the task you asked for. It is not used to train the model.

We record operational information about each request, such as which feature made it and how large it was, so that we can understand and manage our own running costs. That is a record of the platform's operation rather than a record about you, it is never shown to anyone outside iS3 Ltd, and there is no usage figure, quota or allowance applied to you.

Your rights

You have the right to ask us for a copy of the personal data we hold about you, to have it corrected, to have it erased, to restrict or object to how we use it, and to have it provided in a portable form. Where we rely on consent, you may withdraw it.

Ask at hello@is3.co.uk. We will respond within one month.

If you are unhappy with how we have handled your personal data, you may complain to the Information Commissioner's Office at ico.org.uk. We would rather you told us first, but you do not have to.

Cookies

Certiqa uses only the cookies it needs to keep you signed in and to remember which organisation you are working in. We do not use advertising or tracking cookies in the platform.

Changes

A new version of this policy carries its own version number and effective date, and the version in force when you agreed is recorded against your account.