Privacy policy
Digital Trust Audit is the controller of the personal data described on this page.
What is collected at intake
the requester's name, business email, signature block and role
the domain and company details of the business being assessed
The lawful basis
The lawful basis is legitimate interests. The balancing assessment is recorded and is available on request.
Information about the business assessed
An assessment processes information about the business assessed and the people named in its public records. That information is drawn from public sources.
A Supplier Check processes information about a business the requester is considering, which the subject business may not know about. Where that is the case, the subject business’s rights under this policy are unaffected: it may exercise any of them at any time, and doing so does not require it to know that an assessment was requested.
The report link
The private report link is issued when the assessment is completed and does not expire on its own. It can be rotated on request, which invalidates the previous link immediately.
Where a partner introduced the assessment
Where an assessment is requested through an introducing partner, a copy of the report goes to that partner. The requester’s agreement to this is recorded when the request is made.
Retention
Intake correspondence and assessment records are retained for the period the certification or the report remains capable of being verified, and for as long afterwards as is necessary to answer a dispute or meet a legal obligation. Records are then deleted.
Where data is hosted
Data is hosted in the United Kingdom and the European Economic Area. Where a sub-processor operates outside those territories, transfers rely on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
Sub-processors
Sub-processors are named in the assessment terms and are limited to hosting, email delivery and the storage of assessment records. A current list is available on request from [email protected].
Your rights
Access a copy of the personal data held about you.
Rectification correction of anything inaccurate.
Erasure deletion where there is no overriding reason to keep it.
Restriction a limit on how it is used while a question is resolved.
Portability a copy in a structured, machine-readable form.
Objection an objection to processing carried out on the basis of legitimate interests.
To exercise any of them, write to [email protected].
Complaining to the Information Commissioner
You have the right to complain to the Information Commissioner’s Office. You may do so at any time, and you do not have to raise the matter with us first.
How this site uses cookies is set out in the cookie policy, and the terms on which assessments are carried out are in the terms of engagement.