This notice explains what personal data isoassured Ltd collects through this website and in the course of our consultancy work, why we hold it, and what rights you have over it.
Who we are
isoassured Ltd is the data controller for the personal data described here. We are registered in Scotland, company number SC383220, at 5 South Charlotte Street, Edinburgh, EH2 4AN, and registered with the Information Commissioner's Office under registration number ZA769184. We also work from Tileman House, 131 Upper Richmond Road, London, SW15 2TL.
For anything to do with your personal data, contact us at enquiries@isoassuredconsultancy.co.uk or on 0333 355 0860.
Cookies and analytics
We use Google Analytics to count visits and see which pages people find useful. Analytics cookies are only set if you accept them. If you decline, or ignore the banner, the analytics tag still loads but stores nothing on your device and cannot recognise you between visits.
| Cookie | What it does | Expires |
|---|---|---|
| iac_consent | Set by us. Remembers whether you accepted or declined analytics cookies so we do not ask again. Needed for the site to respect your choice, so it is set either way. | 6 months |
| _ga | Google Analytics. Tells one visitor apart from another. Only set if you accept. | 2 years |
| _ga_9YR05CQ856 | Google Analytics. Keeps track of a single visit. Only set if you accept. | 2 years |
You can change your cookie choice at any time. Any analytics cookies already set will be removed.
What we collect
- Contact details. Name, business name, email address, telephone number and address, when you enquire or become a client.
- Correspondence. Emails, enquiry form submissions, and notes of calls and meetings.
- Client project information. The material we need to build and support your management system. Where your own records contain personal data about your staff, we see it in the course of the work but do not collect or keep it separately.
- Supplier and applicant details. Contact and payment details for suppliers, and CVs and references from people applying to work with us.
- Website information. IP address, browser and device type, and the pages you visited. Collected through analytics only if you accept cookies.
Why we hold it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Answering enquiries and quoting for work | Steps taken at your request before entering a contract |
| Delivering consultancy and supporting your management system | Performance of a contract |
| Invoicing, accounts and tax records | Legal obligation |
| Our ISO and legal update service | Performance of a contract for clients, consent for anyone else |
| Analytics on this website | Consent |
| Recruitment | Steps taken before a contract of employment |
Where we rely on consent you can withdraw it at any time, and we will stop.
Who we share it with
We do not sell personal data, and we do not share it for anyone else's marketing. We do share it with the suppliers we need to run the business:
- Website hosting, email and cloud file storage
- Google Analytics, for website statistics, and only where you have accepted cookies
- Our accountants, and our accounting and invoicing software
- Email software used to send the update service
- Any consultant working with us on your project, under the same obligations we hold
We will also disclose personal data where the law requires it.
Your project material stays confidential. We do not pass it to certification bodies or to anyone else without your instruction.
Where your data is held
Our own records are held in the UK and the EEA. Some of the suppliers listed above, Google Analytics among them, process data outside the UK. Where that happens, the transfer relies on the safeguards data protection law provides for, such as a UK adequacy decision or standard contractual clauses.
How long we keep it
| Record | Kept for |
|---|---|
| Enquiries that do not become work | 2 years from the last contact |
| Client project files | Anything containing personal data is deleted once the work is finished. The rest of the project record is kept indefinitely, so we can support you at surveillance and recertification audits |
| Invoices and accounting records | 6 years after the end of the tax year they relate to |
| Update service subscriptions | Until you unsubscribe |
| Unsuccessful job applications | 12 months |
| Website analytics | 14 months in Google Analytics |
We review what we hold and delete anything we no longer need.
How we protect it
Personal data is held on our own systems and with the cloud providers named above, and access is limited to the people who need it. We use encrypted transfer when sending or receiving documents containing personal or confidential information. Paper records, where we hold any, are stored securely and destroyed when no longer needed.
Your rights
You have the right to:
- be told what we do with your personal data, which is what this notice is for
- ask for a copy of the personal data we hold about you
- have inaccurate data corrected
- ask us to delete data
- ask us to restrict how we use it
- receive your data in a portable form
- object to processing we carry out under legitimate interests
- withdraw consent, where consent is the basis we rely on
Not every right applies to every piece of data, and which apply depends on why we hold it. To exercise any of them, email enquiries@isoassuredconsultancy.co.uk. We will reply within one month. There is no charge, unless a request is clearly unfounded or excessive, in which case we will tell you what a reasonable fee would be before we do the work.
Complaints
If you are unhappy with how we have handled your personal data, tell us first and we will try to put it right. You also have the right to complain to the Information Commissioner's Office, the UK data protection regulator, at ico.org.uk or on 0303 123 1113.
Changes to this notice
We update this notice when what we do changes. The version published on this page is always the current one.