Who is responsible

Assess Audit Assure Limited, trading as AAA Certification, is the controller for the personal information described here. Our company number is 13256969 and our registered office is 3b Westfield Road, Cardiff, Wales, CF14 1QQ. Contact our privacy contact at info@aaa-cert.co.uk. This notice covers the AAA website, enquiries and certification portal; it is not an employment privacy notice.

Information we receive

We receive names, business contact details and correspondence; organisation and certification-scope information; readiness answers and quotation or application details; and the audit evidence, findings, reports, decisions and certificates needed for a certification programme. Evidence can contain information about your staff, customers or suppliers. Please redact unnecessary personal information and do not upload passwords, payment-card details or sensitive personal records unless a specific need and appropriate arrangements have first been agreed with AAA. We also receive account, access and delivery records, payment references and statuses, and technical information such as IP addresses, browser details and security events.

Where information comes from

Information comes from you, your organisation, authorised portal users and the people assigned to an audit or review. Payment and email providers supply transaction and delivery information. Website and portal systems generate access and security records. If your organisation supplies information about another person, it should tell them about that use and share this notice where appropriate.

Why we use information and our legal bases

• Enquiries, readiness checks and quotations: to respond and explain the proposed service. We rely on legitimate interests in responding to business requests, or steps requested before a contract where the individual is a party to it.
• Certification and client administration: to plan audits, assess evidence, handle findings, make independent decisions and administer the programme. We rely on performance of a contract where the individual is a party, and legitimate interests in delivering an organisation’s agreed certification service and maintaining reliable certification records.
• Accounts, security and service messages: to authenticate users, control access, investigate misuse and communicate about requested work. We rely on legitimate interests in protecting people, records and systems and operating the service.
• Payments, accounts and disputes: to collect agreed fees, record refunds, keep accounting records and address complaints or claims. The bases are the relevant contract, legitimate interests in administering business payments and claims, and legal obligations where record-keeping law applies.
• Optional marketing: where we use consent, you can withdraw it. A service enquiry does not itself give consent to unrelated marketing. Necessary messages about your enquiry, account, audit or payment are service communications.

Our legitimate interests include responding to business contacts, providing independent certification, protecting the portal and maintaining evidence of our decisions. These interests must be balanced against your rights and expectations.

Who can receive information

Access is limited according to the work involved. This can include authorised AAA administrators, assigned auditors, technical reviewers and certification decision-makers; professional advisers; and certification or accreditation assessors where relevant to oversight. Information may also be disclosed where required by law or necessary for a legal claim. Technology suppliers process information needed to operate the service:

• Hostinger: WordPress hosting and associated delivery and infrastructure services.
• Vercel: portal application hosting and operational delivery.
• Supabase: portal database, sign-in and protected file storage.
• Resend and Google Workspace: transactional email delivery and AAA’s business mailbox.
• Stripe: hosted payment processing, transaction records and fraud-related checks.
• Zapier: the configured purchase-confirmation workflow.

These suppliers receive the information needed for their functions. Stripe also acts as a controller for some of its payment, fraud-prevention and regulatory activities; see Stripe’s privacy notice. The payment page collects card information through Stripe; the AAA portal records transaction references and payment or refund status rather than storing full card numbers.

International processing

Some suppliers and their support or infrastructure providers operate outside the UK. Choosing a UK hosting region does not mean every support, email or payment operation stays in the UK. Transfers must be covered by an applicable adequacy arrangement or another appropriate safeguard, such as standard contractual clauses with the UK transfer addendum where required. You can contact our privacy contact for information about the suppliers and transfer safeguards relevant to your records, and how to obtain a copy of applicable safeguards.

How long information is kept

We decide retention by the purpose and the records actually needed, rather than applying one period to everything.

• Enquiries and unsuccessful quotations: review for deletion or anonymisation 12 months after the last meaningful contact, unless a documented complaint, claim or continuing need justifies keeping them longer.
• Certification and audit records: necessary records are kept while the programme is active and normally for six years after programme closure. Longer periods apply where certification or accreditation rules, complaints, claims or legal holds require them. AAA verifies those requirements before deleting a certification file; unnecessary personal evidence is reviewed separately.
• Payment and accounting records: the applicable statutory accounting period. Company accounting records normally need to be kept for six years from the end of the financial year they relate to, and sometimes longer.
• Access, security and delivery logs: the period needed to operate the service, investigate incidents and demonstrate relevant actions, taking account of the provider’s retention and any continuing investigation.
• Backups: restricted recovery copies retained under the relevant backup cycle. A record removed from an active system may remain in a protected backup until that copy expires; recovery must take account of applicable deletion decisions.

Open disputes, legal duties or a documented preservation need may require longer retention. Darren Price, through info@aaa-cert.co.uk, is responsible for quarterly retention reviews. We delete or anonymise information when it is no longer needed and no applicable exception requires preservation. The portal does not currently apply an automatic deletion period to all certification files. You can ask AAA about the criteria and retention decision for a particular record.

Cookies and external resources

The portal uses cookies needed for sign-in and access control, and to remember the selected workspace. The workspace preference can last up to 30 days. Authentication-cookie duration depends on the sign-in session and provider settings. WordPress uses staff login cookies when an administrator signs in. Essential cookies support a requested service; blocking them can prevent sign-in or workspace selection. Public pages may load fonts from Google Fonts, which receives the technical information needed to serve them, including an IP address and browser request details. Other websites linked from ours have their own privacy arrangements. Any optional tracking or marketing storage requires the applicable notice and choice before it is used; this notice is not a substitute for a consent control.

Your choices and rights

Depending on the circumstances, you can request access, correction, erasure, restriction or portability of your information. These rights have conditions and exceptions; a request to erase a record does not necessarily override a legal duty or justified need to retain it. Where processing relies on consent, you can withdraw it without affecting the lawfulness of earlier processing. Contact info@aaa-cert.co.uk with enough detail to identify the request. We may need to verify your identity and will respond within the applicable legal time limits.

Your right to object

You can object to processing based on legitimate interests, including for reasons relating to your particular situation. You can object to direct marketing at any time. Contact our privacy contact to exercise this right.

Automated results and certification decisions

The website can calculate an indicative price and the systems can route records or flag security concerns. These functions do not award certification. Readiness responses are preliminary, and certification decisions are made through the authorised human audit, review and decision process. If you need help understanding a result, contact AAA.

Keeping information appropriate and raising a concern

Only provide information needed for the agreed enquiry or certification work and tell AAA if it is inaccurate or has been shared in error. Role-based access and file-security checks help protect records, but do not make unnecessary sensitive uploads appropriate. If you are unhappy with our handling of your information, contact us first if you wish. You also have the right to complain to the Information Commissioner’s Office. We will update this notice when the service or its data use changes.