Legal
Privacy policy
Information on the processing of personal data in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on the protection of personal data and the guarantee of digital rights.
Data controller
CERTICAR, S.L. (hereinafter, Certicar), owner of the CerteIDAS brand. Address: C/ José Abascal, 44, 4th floor, 28003 Madrid, Spain. Tax ID [NIF]. Contact for data protection matters: [privacy email], or by post to the address above.
Data we process and purposes
We process the data you provide through the site’s forms and the data generated during your relationship with Certicar:
- Contact form: name, organisation, email, telephone and the content of your message, in order to answer your enquiry and, where applicable, inform you about the assessment process;
- Requests and complaints form: in addition to the above, the subject of the request, the certificate or file reference and any documents you attach, in order to handle requests for fees or quotations, enquiries about the procedure, certificate verifications, complaints and appeals in accordance with our accredited procedures;
- Contractual relationship: contact details of the representatives and staff of entities applying for or holding a certification, for managing the file, carrying out audits, issuing certificates and reports and meeting the obligations arising from accreditation and from Regulation (EU) 910/2014;
- Browsing: technical connection data needed to provide the service and ensure its security (see the cookie policy).
We do not make automated decisions with legal effects or build profiles from these data.
Legal basis
The processing of contact and request data is based on your consent, given when you submit each form and which you may withdraw at any time, and on Certicar’s legitimate interest in answering the communications it receives. The processing of data of certified entities or entities in the certification process is based on the performance of the certification contract and on compliance with the legal obligations imposed on Certicar as an accredited conformity assessment body (ISO/IEC 17065, ETSI EN 319 403-1, Regulation (EU) 910/2014 and its implementing acts).
Retention
Contact enquiry data are kept for as long as needed to answer them and then blocked for the limitation periods of any liabilities that may arise. Data linked to requests, complaints, appeals and certification files are kept for the term of the certification and the record retention periods required by the accreditation standards and the legislation applicable to trust services.
Recipients
Certicar does not disclose your data to third parties except where legally required. In the course of its accredited activity, certain information from certification files is communicated to the accreditation body (ENAC) in the context of its evaluations and to the supervisory body for trust services where the rules so require. The providers giving us technical support (web hosting, email) access the data as processors, under contract and without international transfers outside the European Economic Area other than with the safeguards provided for in the GDPR.
Your rights
You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw the consent given, by writing to [privacy email] or to the controller’s postal address, enclosing a means of proving your identity. If you consider that the processing does not comply with the rules, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
Updates
This policy may be updated to reflect regulatory changes or changes in processing. The version in force is the one published on this page, with its date of last revision: [date].