1. Controller and processor
- For your account and billing — your name, e-mail, login, subscription, invoices and payments — we are the controller.
- For audit content — checklists, evidence, findings, reports and the client personal data in them — the certification body or auditor who records it is the controller and we are its processor (section 9).
2. What we collect and why
| Data | Purpose | Lawful basis |
|---|---|---|
| Account: name, e-mail, role, organisation, password (hashed), authenticator secret (encrypted) | give you secure access | contract (Art. 6(1)(b)) |
| Billing: billing name, address, VAT number, invoices, payment references | invoice you, keep accounting and VAT records | contract; legal obligation (Art. 6(1)(c)) |
| Payment: handled by our payment provider (Stripe); we receive only a reference and status, never your full card details | confirm payment | contract |
| Security: sign-ins, IP address, browser, activity log | protect the Portal, prevent misuse, keep an audit trail | legitimate interests (Art. 6(1)(f)) |
| Messages sent to us | answer you | legitimate interests; contract where it concerns your account |
We do not use advertising cookies, we do not sell personal data, and we make no decisions about you based solely on automated processing. We do not use analytics cookies.
3. Who we share it with
Service providers acting on our instructions: hosting and backup storage, e-mail delivery, payment processing (Stripe) and our professional advisers. We disclose data to authorities only where the law requires it.
4. International transfers
Data is stored on servers located in Mumbai, India. Where a provider processes data outside the UK, we rely on UK adequacy regulations or the International Data Transfer Agreement / UK Addendum to the EU Standard Contractual Clauses, with additional safeguards where needed.
5. How long we keep it
- Account data: while the account is active and for 3 years after it is closed.
- Invoices and accounting records: 6 years from the end of the financial year (Companies Act 2006 and HMRC requirements).
- Activity log: 7 years, as part of the audit trail.
- Audit content: as set by the controller (by default 7 years after a report is issued for evidence files).
- Messages: 2 years.
6. Security
Encryption in transit (HTTPS), encryption of secrets at rest, hashed passwords, two-factor authentication (mandatory for administrators and lead auditors), role-based access, virus scanning of uploads, an append-only activity log and encrypted nightly backups. We report personal-data breaches to the ICO within 72 hours where required, and to you without undue delay when the risk is high.
7. Your rights
You have the right to access your data, to have it rectified or erased, to restrict or object to its processing, to data portability, and to withdraw consent where we rely on consent. Many of these you can exercise yourself: My account and My subscription to correct details, Backups to download your data. Otherwise write to privacy@theauditor.net. We reply within one month.
You also have the right to complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113). We would appreciate the chance to deal with your concern first.
8. Cookies
Without your consent we set only strictly necessary cookies, which PECR allows: a session cookie that keeps you signed in and a security token that protects forms (XSRF-TOKEN). If we ever add other cookies we will ask for your consent first.
9. When we act as processor
For audit content we process personal data only on the documented instructions of the certification body or auditor (the controller), as set out in the Portal's functions and settings; we ensure our staff are bound by confidentiality; we apply the security measures in section 6; we use only the sub-processors listed in section 3 and inform controllers of changes; we help controllers answer data-subject requests and meet their security, breach-notification and impact-assessment duties; at the end of the service we delete or return the data (the Backups screen gives a full copy); and we make available the information needed to show compliance, including allowing audits. These terms form the processing agreement required by Article 28 UK GDPR.
10. Contact
Data protection contact: privacy@theauditor.net · EUROBRITAIN CERTIFICATIONS LIMITED, [registered office — set in Administration]
11. Changes
We will post any change on this page with a new date, and notify registered users by e-mail of material changes.