Privacy Notice

Who we are

Skyeblanc Certification is the controller of the personal information described here. Our legal entity name, registered office and data-protection contact will be confirmed on this page and can be requested via our contact page.

What we collect

We collect only what we need to provide certification and meet our obligations as a certification body:

• Application & quotation data — organisation details, scope, employee numbers, sites, existing certifications, and the name of any consultancy used (for impartiality screening).
• Contact data — the names, roles, emails and phone numbers of the people we deal with.
• Audit & certification records — information gathered during audits and decisions, retained as evidence.
• Complaint & appeal data — information you provide when you raise a matter with us.
• Website data — limited technical and cookie data (see our Cookie Policy).

Why we use it, and our legal bases

We use personal information to assess applications, deliver and maintain certification, verify certificates, handle complaints and appeals, and meet legal and accreditation obligations. Depending on the activity and your region, our legal bases include:

• Contract — to provide the certification you or your organisation requested.
• Legal & accreditation obligation — to meet the requirements of ISO/IEC 17021-1 and our accreditation body.
• Legitimate interests — to run and protect our certification activities, including impartiality screening.
• Consent — where required, for example certain communications; you may withdraw consent at any time.

Who we share it with

We do not sell personal information. We share it only as needed to operate as a certification body:

• Our accreditation body (UAF) and, where applicable, other oversight bodies, who may review our records as part of assessing us.
• IAF CertSearch — for accredited certificates, the certificate’s public details and status are published to the global database.
• Auditors and sub-contractors engaged by us, bound by confidentiality.
• Authorities, where we are legally required to disclose.

International transfers

We operate globally, so information may be processed in countries other than your own. Where it is, we apply appropriate safeguards for cross-border transfers consistent with GDPR and POPIA requirements.

How long we keep it

Certification and audit records are retained for the periods required by our accreditation and certification obligations — typically across the certification cycle and beyond, as evidence of decisions. Other information is kept only as long as needed for the purpose it was collected.

Your rights

Subject to your region and applicable law, you may have the right to:

• Access the personal information we hold about you.
• Correct information that is inaccurate or incomplete.
• Erase or restrict processing in certain circumstances.
• Object to processing based on legitimate interests, and to data portability where it applies (GDPR).
• Complain to a supervisory authority — in the EU/UK your data protection authority, and in South Africa the Information Regulator (POPIA).

Note that some records must be retained to meet our obligations as a certification body and cannot be erased on request.

Security

We apply appropriate technical and organisational measures to protect personal information against loss, misuse and unauthorised access, and we require our auditors and sub-contractors to do the same.

Contact & complaints

To exercise any right, or to raise a privacy concern, use our contact page. You can also raise a formal complaint with us at any time.