Privacy notice
How ISAO uses personal data, and your rights under UK data protection law.
This notice explains how International Standards Accreditation Organization (ISAO) uses personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Who we are
ISAO is the controller of the personal data described in this notice.
Registered office: 22 Wenlock Road, London N1 7GU, United Kingdom.
Contacting us about your data
Email info@isao.org.uk, or write to our registered office, marked "Data protection". We reply to requests within one month.
What we collect and why
| Data | Why we use it | Lawful basis |
|---|---|---|
| Enquiries: name, email, organisation, telephone and message | To answer your enquiry | Legitimate interests |
| Applications for accreditation or registration: contact details and information about the applicant organisation or auditor | To assess the application and manage accreditation or registration | Contract, or steps taken before entering into a contract |
| Complaints and appeals: contact details and the details of the complaint | To investigate and respond | Legitimate interests, and legal obligation where it applies |
| Register entries: names of certified organisations and registered auditors, with grades, standards, dates and status | To publish a register that the public can rely on | Legitimate interests; consent for registered auditors who agree to be listed |
| Verification lookups: a keyed one-way hash of your IP address, with a count of your recent lookups. The search itself is not kept | To run the verification service and prevent abuse | Legitimate interests |
| Staff and assessor accounts: name, email, role and sign-in records | To give access to the admin console and to keep it secure | Legitimate interests; contract |
How long we keep it
- Lookup counts for the verification rate limit: deleted within two days of your last lookup
- Enquiries: three years
- Complaints and appeals: six years
- Accreditation and registration records: while the accreditation or registration lasts, and six years after it ends
Who we share it with
We share personal data only with service providers that help us run ISAO's systems, under contracts that protect it: hosting, email delivery and file storage. We share the details of a complaint with the certification body concerned only as far as the investigation needs. We do not sell personal data.
The service providers that process personal data for us are:
- Vercel, which hosts this website and stores our files, such as documents sent with a complaint and certificate files, in London
- Supabase, which runs our database, in London
The map on our contact page is loaded from Google Maps. Google receives your IP address when the map loads and may set cookies of its own: see our cookies notice and Google's privacy policy.
International transfers
Some service providers may process data outside the UK. Where they do, we use the safeguards that UK law requires, such as adequacy regulations or the International Data Transfer Agreement.
Your rights
You have the right to ask for a copy of your personal data, to have it corrected or erased, to restrict or object to how we use it, and to data portability where it applies. Where we rely on consent, you can withdraw it at any time. To make a request, use the contact details above.
Complaints to the regulator
If you are unhappy with how we have used your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk. We would welcome the chance to deal with your concern first.
Cookies
We use only cookies that are strictly necessary. See our cookies notice.