Privacy Policy

1. General

The EAASS recognises and respects the importance of the privacy of our visitors and users of online systems. We treat your personal data confidentially and in accordance with data protection law. This Privacy Policy explains how we generally handle personal information and cookies when you use our online services.

We will update this policy on our website if we change the way we handle personal information.

2. Information We Collect and How We Collect It

We collect information that is reasonably necessary for us to perform our functions or activities and to deliver online services to you. The use of our website is generally possible without providing personal data. If you do not provide personal information, you may not be able to use certain functionalities of this website.

2.1. Visiting our website and using our online services

When you use our website or online services, certain information is collected automatically such as your browser type and IP address. We process your browser movements and behaviour on our online systems to monitor the functionality of our online service, compliance with our Terms, and to identify potential misuse.

2.2. Cookies

Cookies are small text files saved on your computer. Cookies make it possible to analyse your use of our website and online services. Information stored in cookies (including an IP address) is transmitted to our servers and used for analysing user behaviour and evaluating the functionality of our website. Your personal data is safeguarded by anonymization of the IP address. The data is erased once it is no longer required for our purpose. You have the right to opt out of us saving and analysing your data from cookies.

2.3. Information provided via membership accounts, forms and emails

We may receive personal data voluntarily from you such as your name, organisation name, certification information, email address, phone contact and other contact information. We process such personal information for the purpose of answering your requests, fulfilling our legal obligations, and contacting you to notify you of developments in our services.

2.4. Web analysis using Google Analytics

Our website uses Google Analytics, a service provided by Google Ireland Limited. We use information in order to analyse your use of our website and compile reports on your activities. Data connected to cookies and user recognition is erased automatically after 26 months. For more information visit policies.google.com. The legal basis for the use of Google Analytics is your declaration of consent.

3. Purposes for Collecting, Storing and Processing Personal Data

We collect and process personal data for the following purposes:

• To provide online services to you according to agreed terms.
• To analyse user behaviour and evaluate the functionality of our website and online services.
• To accommodate your requests and inquiries for services or information.
• To provide newsletters or notifications to you.
• To provide marketing communications to you.
• For the purpose of facilitating validation of accredited certification or accreditation.

4. How We Use Personal Data

• To communicate with you in relation to our online services.
• To enable you to verify an organisation's accreditation certification(s).
• To enable you to access our online services.
• To meet our legal compliance obligations.
• For direct marketing purposes to tell you about developments in services available from our carefully selected partners.

5. We Do Not Sell Personal Data

We do not sell personal data or authorise personal data to be sold to third parties. Our service providers/processors are bound by instructions to process your data exclusively in line with applicable data protection laws and are contractually bound to treat your data with strict confidentiality.

6. Disclosures of Your Personal Data

In order to deliver the service and support you have requested, we may transfer personal data to the following recipients:

• Internal divisions, subsidiaries, joint ventures and affiliated companies of the EAASS.
• Marketing, information technology, customer support and human resources service providers.
• Professional advisers including lawyers, finance service providers, auditors and insurers.

We may also be legally required to share information with external regulatory bodies in connection with law enforcement and compliance.

7. Disclosure of Information Across Borders

The global database and our website are stored on Amazon Web Services located in Frankfurt, Germany. When we disclose personal information, it may be accessed from, transferred to, and/or stored outside the country in which you are located. We will, in all circumstances, safeguard the personal information as set out in this Privacy Policy.

8. Security

We have implemented appropriate organisational and technical security measures to protect your personal data from loss, destruction, manipulation and unauthorised access. We store personal data on servers with limited access located in secured facilities, and our security measures are evaluated on an ongoing basis. We use SSL encryption to guarantee the encrypted and complete transmission of your data.

9. Your Rights

9.1. Right of access

On request, you have the right to obtain information from us about the personal data concerning you and processed by us. Contact: privacy@eaacr.org

9.2. Right to rectification

You may request that we rectify any inaccurate personal data about you. Contact: privacy@eaacr.org

9.3. Right to deletion and restriction

Depending upon your geographical location, you may have the right to immediate deletion ("right to be forgotten") of personal data concerning you, or the right to restrict processing. Legal reasons for requesting deletion include: the data is no longer necessary for the purposes for which it was processed, or you withdraw your consent. Contact: privacy@eaacr.org

9.4. Right to data portability

Depending upon your geographical location, you may have the right to receive your personal data in a structured, commonly used and machine-readable format. Contact: privacy@eaacr.org

9.5. Right to object to processing

You have the right to object at any time to processing of your personal data. We will desist from processing unless we can demonstrate legitimate grounds for processing.

9.6. Right to file a complaint

You have the right to make a complaint at any time about the way that we process personal data. We ask that you contact us in the first instance at privacy@eaacr.org.

9.7. Response times

We try to respond to all legitimate requests within one month. Occasionally it could take longer if your request is particularly complex. In this case we will notify you and keep you updated.

10. Retention

We keep records for as long as required to manage your membership or subscription accounts, to manage an entity's accreditation certification in the global database, and where we are required to by law. Subject to legislation, we will store any data we collect for as long as it is required for the purposes for which it was collected.

11. Your Rights Concerning Processing of Personal Data

In some countries you have the right to access, or correct, the personal information that we hold about you. While we adhere to the privacy regulations in your country, we must advise you that by requesting that we restrict, delete or stop processing your personal data, you may be prevented from enjoying the full functionality of our website and online services.

12. Amendments to This Privacy Policy

New legal requirements, business decisions or technical developments may require us to change our Privacy Policy. We reserve the right to amend our Privacy Policy. Any amendments will be posted on our website and shall take effect immediately following posting. If you do not agree to the modified Privacy Policy, you should discontinue use of the website and notify us at privacy@eaacr.org.

13. Consent

By choosing to provide us with your personal information you are declaring your consent to its use in accordance with the principles outlined in this Privacy Policy. You do not have to provide us with your personal information. If you choose not to provide certain personal information you will still be able to visit our website but you may be unable to access certain options or services.

All marketing communications we send to you will provide you with a way to withdraw your consent to future marketing. If you no longer wish to receive promotional materials you may opt-out by changing your account settings.

14. European Data Protection Laws

This section applies if you are based in the European Economic Area (EEA). Under European data protection laws, use of personal information must be based on one of a number of legal grounds. The table below sets out the relevant grounds that apply to each purpose of data processing.

15. Contact Details

If you have any questions about this Privacy Policy or other questions regarding protection of your personal data, please contact privacy@eaacr.org. We will respond to your query or complaint within a reasonable time.