For customers and stakeholders

Privacy Notice

  1. Who we are

    This Privacy Notice describes how the United Kingdom Accreditation Service Limited and the Clinical Pathology Accreditation (UK) Limited (in this Privacy Notice, “UKAS Group”) collects and uses personal data. It applies to (prospective) customers (including delegates attending public training courses) and (potential) stakeholders of UKAS Group.

    • References to “us”, “we”, “our” or “UKAS Group” are to: United Kingdom Accreditation Service Limited, a company registered in England and Wales (company number 03076190); and the Clinical Pathology Accreditation (UK) Limited (company number 02675095), both with registered address at 2 Pine Trees, Chertsey Lane,
      Staines-Upon-Thames, Middlesex, England, TW18 3HR, United Kingdom.
    • The UKAS Group acts as data controller in respect of your personal data that we process. Our Privacy and Data Compliance Officer is Georgia Alsop. If you have any questions about this Privacy Notice and how we use your personal data, please get in touch with us via the contact details below:
      Post: Georgia Alsop, Privacy and Data Compliance Officer at United Kingdom Accreditation Services Limited, 2 Pine Trees, Chertsey Lane, Staines-UponThames, TW18 3HRE-mail: DataProtection@ukas.comTelephone: +44 (0) 1784 429000
    • This Privacy Notice supersedes any previous Privacy Notice. We may update this Privacy Notice from time to time to ensure that it remains accurate. If we do so, we will provide you with an updated copy of this notice as soon as reasonably possible.
    • This Privacy Notice was last updated on: 23 May 2018.
  2. What data do we collect?

    The personal data that we collect will depend on your relationship with us. Please see below for detailed information regarding the types of information we collect and use about you.

    Customers / prospective customers:

    • Name, business address, job title, e-mail address, telephone number, and (if applicable) employer name;
    • Business CVs provided by customers which may contain personal details such as home address;
    • Details of qualifications & training records;
    • Details of education (dates & name of institution);
    • Names of personal referees as shown on CVs (position, home address and phone);
    • Qualifications certificates and number reference which may contain pictures and an individual’s date of birth;
    • Opinions on competence; and
    • Occasionally we receive Customer case files. Any personal data in these files is generally anonymised but sometimes does contain personal data.

    Delegates (customers) attending public training courses:

    • Name, address, phone numbers, employer name (if applicable);
    • Passport details for the purposes of arranging travel or issuing visitation letters where relevant;
    • Information about disability, medical conditions, allergies in order to facilitate course.

    Stakeholders /potential stakeholders:

    • Name, employer, address, email, job title.
  3. Who do we collect your data from?

    We collect your personal data:

    • Directly from yourself via the information you provide to us; From your company/employer; From third parties, such as:
      • Accreditation Scheme owners
      • Credit referencing agencies
      • Regulatory bodies
      • Lead generation companies and mailing houses
    • Publicly available sources, such as;
      • Social media sites such as LinkedIn, Twitter and Youtube
      • Web searches
  4. How do we collect your data?

    We collect your personal data:

    • Face to face when you meet us;
    • Via regular mail (in writing);
    • By telephone (including call recording);
    • By e-mail;
    • Via website registration;
    • Via customer on boarding or application;
    • Via the internet
  5. What are the purposes and legal grounds for using your data?

    We collect and use your personal data for a number of different purposes:

    • To prepare a proposal for you regarding the services we offer;
    • To provide you with the services as set out in our Standard Terms of Business and our contract with you or as otherwise agreed with you from time to time;
    • To undertake any conformity assessment services we provide to you;
    • To deal with any complaints or feedback you may have or are involved with;
    • To meet our compliance and regulatory obligations and as required by tax authorities or any competent court or legal authority;
    • For marketing to you. Please see the separate section on Marketing below;
    • Training and performance monitoring of our staff;
    • For the administration and management of our business, including but not limited to organising public training courses, recovering debts and archiving or statistical analysis;
    • Seeking advice on our rights and obligations, such as where we require our own legal advice.

    For each purpose we must have a legal ground for such processing. In respect of your personal data, the legal grounds we rely on are:

    • Our performance of a contract with you;
    • Us having an appropriate business need to use your data, and such need does not overly prejudice you;
    • You having given your explicit consent for us to use your personal data;
    • Us having a legal or regulatory obligation to use your data; and
    • The necessity to use your data to establish, exercise or defend our legal rights.
  6. Who do we share your data with?

    We may share your personal data with our internal teams/departments via internal reports and via access to central IT systems.

    We also disclose your personal data to the third parties listed below:

    • Group companies;
    • Contractors (to carry out conformity assessments);
    • Third parties whom we engage to assist in delivering the services to you, such as IT providers, data storage providers, payroll suppliers and public relations advisers.
    • Agents, advisers, intermediaries you advise us to share your data with;
    • Our professional advisers where it is necessary for us to obtain advice and assistance, such as lawyers, accountants, auditors;
    • Our Peer Evaluators where it is necessary for us to meet our obligations as the UK National Accreditation Body;
    • Debt collection agencies and credit referencing agencies; and
    • Relevant accreditation scheme owners, regulatory authorities or law enforcement agencies, subject to your agreement via a waiver of confidentiality.
  7. Your rights

    Under the GDPR you have certain rights in relation to the personal data that we hold about you. You may exercise these rights at any time by contacting us using the contact details set out further below in this section.

    Please note that in some cases we may not be able to comply with your request because of our own obligations to comply with other legal or regulatory requirements. However, we will always respond to any request you make and if we cannot comply with your request, we will tell you why.

    Your rights are:

    • The right to access your data

      You are entitled to a copy of the personal data we hold about you and certain details of how we use it. Your information will usually be provided to you in writing, unless otherwise requested, or where you have made the request by electronic means, in which case the information will be provided to you by electronic means where possible. Subject to certain circumstances, there will not be a charge for dealing with these requests. We have created a Subject Access Request form to assist you making your request, which is available on request.

    • The right to rectification

      We take reasonable steps to ensure that the information we hold about you is accurate and complete. However, if you do not believe this is the case, you can ask us to update or amend it.

    • The right to erasure

      In certain circumstances, you have the right to ask us to erase your personal data.

    • The right to restriction of processing

      In certain circumstances, you are entitled to ask us to stop using your personal data.

    • The right to data portability

      In certain circumstances, you have the right to ask that we transfer any personal data that you have provided to us to another third party of your choice.

    • The right to object to marketing

      You can ask us to stop sending you marketing communications at any time.

    • The right to withdraw consent

      For certain uses of your personal data, we will ask for your consent. Where we do this, you have the right to withdraw your consent to further use of your personal data.

    • The right to lodge a complaint with the ICO

      You have a right to complain to the Information Commissioner’s Office (ICO) if you believe that any use of your personal data by us is in breach of applicable data protection laws and regulations. Making a complaint will not affect any other legal rights or remedies that you have.

  8. Marketing

    We may also use your personal data to provide you with information about services we provide which may be of interest to you where you have provided your consent for us to do so. This information may include alerts, newsletters and invitations to events or functions. We will communicate this to you in a number of ways including by post, telephone, email or other digital channels.

    We are committed to only sending you marketing communications that you have clearly expressed an interest in receiving. If you wish to unsubscribe from marketing communications sent by us, you may do so at any time by contacting us in one of the following ways:

    • By registered post – Georgia Alsop, Privacy and Data Compliance Officer at United Kingdom Accreditation Services Limited, 2 Pine Trees, Chertsey Lane, StainesUpon-Thames, TW18 3HR
    • By e-mail – DataProtection@ukas.com
    • By unsubscribing on our website
  9. What is our approach to international data transfers?

    In principal, we do not store or process personal data that we collect about you in countries outside the European Economic Area (EEA). However, some of the third parties we share personal data with (as set out in this Privacy Notice), may be located outside the EEA. In those circumstances, please note that your personal data will only be transferred outside the EEA on one of the following bases:

    • the country that we send the personal data to is approved by the European Commission as providing an adequate level of protection for personal data;
    • the transfer is to a recipient in the United States of America who has registered under the EU/US Privacy Shield;
    • the recipient has entered into European Commission standard contractual clauses with us; or
    • you have explicitly consented to such transfer by emailing UKAS (DataProtection@ukas.com)

    Please contact us if you require further information about this.

  10. How long do we keep your data?

    We will only retain your personal data for as long as reasonably necessary to fulfil the relevant purposes set out in this Privacy Notice and in order to comply with our legal and regulatory obligations. Please contact us if you would like further information regarding the periods for which your personal data will be stored.

  11. What we do to safeguard your data

    UKAS is committed to protecting your privacy. Our staff use mobile devices, such as laptops and mobiles that are encrypted. Where we outsource our Information Technology and Communications infrastructure and business systems, we use providers that are ISO/IEC 27001 compliant. We also regularly commission an independent penetration testing provider to confirm the security of our systems, policies and procedures. Our staff receive periodic training on data protection and all our contracts with third parties include relevant confidentiality and data protection provisions.