Who we are
Hexa Certifications Limited is the controller of personal data collected through this website and in the course of providing certification services. You can contact us about data protection at info@hexacertifications.co.uk.
What we collect
- Enquiry data: your name, organisation, job title, email address, phone number and the details you give us when requesting a quote, contacting us or asking us to verify a certificate.
- Client data: contact details of people at client organisations, and information we see during audits, which is treated as confidential.
- Website data: technical information such as browser type and pages visited, collected only with your consent where non-essential cookies are involved.
How and why we use it
- To respond to enquiries and prepare quotations (legitimate interests, or steps prior to a contract).
- To deliver certification services and meet our contractual obligations (contract).
- To keep records required for certification, accreditation and legal purposes (legal obligation and legitimate interests).
- To improve our website, where you have consented to analytics cookies (consent).
Sharing
We do not sell personal data. We share it only with people who need it to deliver our services, such as auditors bound by confidentiality, IT and email providers acting on our instructions, professional advisers, and regulators or accreditation bodies where required.
Retention
Enquiry data is kept for up to two years if no contract follows. Certification records are kept for at least the current certification cycle plus one full cycle, or longer where the law or accreditation rules require it.
Your rights
You have the right to access, correct, erase, restrict or object to the processing of your personal data, the right to data portability, and the right to withdraw consent at any time. To exercise any right, email us. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.
Security
We use appropriate technical and organisational measures to protect personal data, including access controls, encryption in transit and confidentiality agreements for everyone who handles client information.
Changes
We may update this policy from time to time. The date at the top of this page shows when it was last revised.