Privacy notice
Draft placeholder.
This page is a draft placeholder and will be replaced by legal documentation before launch.
Not a legal document
Nothing on this page should be relied upon as a privacy notice. It records the intended shape of the final document so the founder can see what must be prepared with proper legal advice.
Intended contents
- Who the data controller is, and how to contact them.
- What information is collected from an enquiry, an audit visit and an ongoing membership.
- Why each category is collected, and the lawful basis for holding it.
- How long each category is retained, and what is deleted at the end of a membership.
- Who information may be shared with, including any specialist partners, and on what basis.
- Whether information leaves the UK, and what protects it if it does.
- The rights of an individual to access, correct, restrict, port or erase their information.
- How to complain, including to the Information Commissioner's Office.
- How security incidents are handled and when clients are informed.
Outstanding items
- [ICO registration status to be confirmed]
- [Data retention periods to be set with legal advice]
- [Specialist monitoring partner details to be confirmed]
- [Sub-processor list to be prepared]
In the meantime, our working practice is described plainly on the About and Standards page.