Please read this Privacy Notice. It relates to how PCERT Limited (”PCERT"/”we”/“us”/“our”) holds and processes your information (data) and your rights.
About PCERT
PCERT is a private limited company owned by The PIPA Testing Scheme Limited (CRN: 11545157) (“PIPA”). Its main purpose is to undertake certification activities, assessing individual persons to perform a PIPA inspection using ISO17024. To help provide the correct governance structure to undertake certification activities in an impartial manner, PCERT has been set up as a separate company away from the PIPA testing scheme limited, and its governing board.
Our registered office is at 301 Tea Factory, Fleet Street, Liverpool, L1 4DQ.
PCERT is registered with the Information Commissioner’s Office (ICO) with reference ZB823942.
PCERT does not own a website. It uses its parent company’s website, www.pipa.org.uk (“website”), to provide information about the company and details about how to contact PCERT.
PCERT is a "data controller". This means that we are responsible for deciding how we hold and use data about you. We are required under data protection legislation to notify you of the information contained in this privacy notice. We have a duty to keep your data secure and maintain your confidentiality and we will do so.
PCERT’s company structure
Parts of the administration of PCERT is outsourced to its parent company, The PIPA Testing Scheme Limited. PCERT has set out to ensure the correct data protection policies are in place to ensure that your data is as equally protected if the administration was conducted in-house.
1) Applicants and Certified Persons
Information we collect:
The data we collect includes their name, personal address, company/business name, email address, contact telephone numbers, and postal address. It also includes any information provided to us as required by our scheme rules.
As part of the application, you may be required to undergo an ID check against government approved documents. We use Stripe’s verification software to complete these checks. This data is stored on Stripe’s system, and is not downloaded to PCERT’s system as part of the checks. More information can be found here: https://stripe.com/gb/privacy
We will also hold/process any other data that members provide to us voluntarily (whether via our website, by email, verbally, or in writing) or that we ask you.
How we will use your data:
In order to provide our services, we will use your data to:
- Administer your certification, including payments and future recertifications
- Deal with any queries raised by you
- Process any complaints or concerns raised against you
- Audit your work, or check compliance against the scheme rules
- Compile statistics and research
- Perform any necessary tasks as laid out within the scheme rules
- Assist the PIPA Testing Scheme Limited in their work, in line with a memorandum of understanding between the two legal entities (further details below).
- Conduct surveillance, quality assurance and competency monitoring activities.
- Analyse inspection reports using validated software systems, including artificial intelligence tools, to identify potential non-conformities, competency concerns and opportunities for improvement.
- Validate and verify surveillance audit outcomes to ensure consistency and integrity of the certification process.
- Make certification, recertification, suspension and withdrawal decisions in accordance with ISO/IEC 17024.
- Manage appeals relating to certification decisions.
- Maintain records relating to impartiality, complaints, appeals and certification governance.
- Review historical certification records where necessary to support accreditation, transition or certification transfer activities.
In order to meet ISO 17024, and to properly carry out our function in public safety, we publish a register of certified persons to allow people to collaborate and confirm your certification with PCERT. We do so as part of your contractual arrangements to undergo certification with PCERT. Publication of certification status forms part of the contractual arrangements associated with certification and supports public confidence in the certification scheme. You agree for us to use your information in such a way when undergoing certification or certifying.
How long we retain your data:
We retain all information and data relating to certification for a period of nine years. This enables PCERT to have sufficient information to handle a current certification period of three years, and a further two certification periods (resulting in a total of up to nine years). After nine years, the data will be deleted automatically by PCERT’s software. This does not effect your right ‘to be forgotten’ – which will be considered on a case by case basis. Where complaints, appeals, litigation, regulatory action, insurance matters or public protection concerns remain ongoing, retention periods may be extended where necessary.
2) Visitors to our website
The website is not owned by PCERT limited. Therefore when you visit or use the website you are agreeing to the PIPA Testing Scheme Limited’s privacy policy. This may be found here: https://www.pipa.org.uk/privacy-policy/
3) Complaints or Concerns
Part of the PCERT complaint process is handled by The PIPA Testing Scheme Limited when it relates to a certified person or applicant.
Information we collect:
If you submit a complaint to us, we will collect details about you in order for us to process the complaint. It will include your name, email address and phone number. It may also include details of your business, a correspondence address, and details of the concern raised. After submitting your complaint we will seek your consent to share this information with the member to whom the complaint is against, which will enable us to investigate the complaint in full.
How we will use your data:
We process complaints using consent, legitimate interests, contractual obligations and, where appropriate, vital interests or legal obligations depending upon the nature of the concern and the actions required.
You do not have to consent to PCERT or PIPA sharing your information in such a manner, but it would seriously restrict any complaint or action which we can take.
In the event the complaint or concern is of such a serious nature that we must inform an enforcing body (such as the Police or HSE), we will rely upon the lawful basis of a Vital Interest in order to process your data. When disclosing such information, we will only provide enough information as necessary to carry out the public protection task.
How long we retain your data:
Any details collected regarding a complaint or a concern may be retained for up to 10 years, unless there is an ongoing investigation which requires the information to be retained for longer. After this time period we may retain the complaint itself but remove any identifiable information.
Data sharing
The data collected by PCERT will be used in a manner which ensures it is kept secure and is not shared outside of the company without your express consent. When we refer to PCERT using your data, we mean: the office (which is a data processor and a separate contracted company), the managing director, PCERT’s contracted service providers (who may be data processors), and any software PCERT uses in order to store and process your information. All of the above have written agreements in place which regulates their processing activities.
We work with a number of third parties in order to carry out some of our services and functions. The third parties act as an agent of PCERT and so have written agreements in place to protect and limit how your data is used. The basis they may use the data we share with them is limited solely to the intended purpose, for example; providing certification activities, or investigating a complaint.
We may also share data with our insurance provider or legal advisers where we deem it necessary to do so. Your data will not otherwise be shared with any other third party without your consent.
PCERT may utilise validated software systems, including artificial intelligence technologies, acting under PCERT's control and for PCERT's purposes. Such systems are used in support of surveillance, auditing and quality assurance activities and do not independently make certification decisions.
Memorandum of Understanding (MoU)
PCERT holds an MoU with its parent company, the PIPA Testing Scheme Limited. The MoU is there to ensure the correct governance is in place around the use and storage of data, and to ensure PCERT can operate in an efficient manner. The MoU between PCERT and PIPA is a strict document, which ensures that no matter which company is handling your data, it is as secure as it was just PCERT.
Automated Processing and Artificial Intelligence
PCERT may utilise validated software systems, including artificial intelligence tools, to support surveillance, auditing and quality assurance activities.
Such systems are used to assist the review of inspection reports and identify potential concerns or inconsistencies. AI systems are subject to validation, verification and ongoing monitoring procedures.
Certification decisions, disciplinary outcomes, suspension, withdrawal and appeals decisions are not made solely through automated processing and remain subject to human oversight and governance.
Your rights
You have:
right to be informed
right of access
right to rectification
right to erasure/right to be forgotten
right to restrict processing
right to data portability
right to object
We are obliged to ensure that the data we hold about you is correct. You have the right to ask for the data to be rectified if it is not correct and we will then take appropriate action to do so.
You also have the right to restrict the processing of your data or to object to the processing of your data, as well as the right to ask that your data (or some of your data) be erased.
Further, you have the right to seek confirmation of the fact that we are processing your data, to ask what that data comprises, and also to ask for copies of your data we hold.
How to exercise your rights
If you would like to exercise any of the rights in paragraph 6, please email info@pipa.org.uk or write to us at the registered address: PCERT, 301 Tea Factory, Fleet Street, Liverpool, L1 4DQ. We will then consider your request and action as necessary although in some circumstances we may have a legitimate reason for not being able to action your request. If this should be the case, then we will notify you of the reason why.
If you have any cause for complaint
If you have any cause for complaint, or do not believe that we are processing your data fairly or in line with our obligations as a data controller, then we would ask that you contact us by emailing info@pipa.org.uk or by writing to our registered office: PCERT, 301 Tea Factory, Fleet Street, Liverpool, L1 4DQ.
Cookie Policy
The website uses cookies to accomplish its technical goals:
● Analytical cookies - We use Google Analytics to measure traffic to the site and to help plan future development. Your details are anonymised and cannot be linked back to your real identity. The cookies will be removed when you close your browser and are not used to build a profile of you.
● Functionality cookies - If you log into our system, we store a cookie to keep you logged into your account. This is required in order to provide the system's core functionality.
You can clear your browser's cookies at any time.
