General Information
The EU General Data Protection Regulation (GDPR), which came into force on 25 May 2018, is a regulation of the European Union that harmonises the rules for the processing of personal data by private companies and public bodies within the EU. It is intended to ensure the protection of personal data throughout the EU. At SECTOR Cert, we take the protection of your personal data very seriously. We process your personal data in accordance with the applicable legal requirements for the purposes set out below.
Purpose of Processing
Certification is the confirmation that a person meets the requirements of a certification programme. For the issuance of a certificate, for the documentation of certification requirements, as well as for quality assurance measures and customer communication, the certification body collects, processes and stores personal data.
Legal Basis
The legal bases for the processing of personal data arise from:
- Consent of the data subjects pursuant to Art. 6 (1) lit. a) GDPR
- Fulfilment of a contract pursuant to Art. 6 (1) lit. b) GDPR
The categories of personal data and the retention periods arise from the general requirements for bodies operating certification of persons (DIN EN ISO/IEC 17024) as well as from the respective certification standards DIN EN ISO 9712, DIN ISO 18436 and ISO 20807.
Data Controller
SECTOR Cert – Gesellschaft für Zertifizierung GmbH
Am Turm 24, 53721 Siegburg
Phone: +49 2241 26682-00
Fax: +49 2241 26682-99
Data Protection Officer: Andreas Schmidt
E-mail: Data Protection
Obligation of Employees
All internal and external employees of the certification body, such as examiners and specialist certifiers, are contractually obliged to comply with data protection regulations.
Personal Data
Personal data refers to all information relating to an identifiable person (e.g. name, age, marital status, etc.). Data without a direct personal reference can also be personal data if it can be used to refer to the associated persons (e.g. PC user ID).
We store and process personal data of certificate holders and our contractual partners (contact persons of our customers and suppliers, examiners, service providers and employees of our examination centres) to fulfil our corporate purpose.
Processing of Personal Data
Applicants
The processing of applicant data is based on the legal basis of Section 26 (1) BDSG (Federal Data Protection Act). Application documents are retained for a period of 6 months in accordance with Section 21 AGG (General Equal Treatment Act) and subsequently destroyed or deleted.
Authorisation of Examiners
For the authorisation of examiners, the following personal data is collected and stored:
- Surname, first name
- Date and place of birth for identification
- Qualification certificates (e.g. certificates)
- Language skills
- Relevant professional experience including details of the respective employers
- Current employer
- Proof of physical fitness (e.g. visual acuity according to DIN EN ISO 9712)
Authorisation documents are retained on a personal basis.
Authorisation of Specialist Certifiers
For the authorisation of specialist certifiers, we require the following personal data:
- Surname, first name
- Date and place of birth for identification
- Certificates
- Proof of physical fitness (e.g. visual acuity according to DIN EN ISO 9712)
Data and authorisation documents are stored and retained on a personal basis.
Qualification Examinations
When registering for participation in a qualification examination, the following personal data is collected, processed and stored:
- Surname, first name, maiden name if applicable, and date of birth for identification of the participant
- Employer confirmation of the participant's minimum industrial experience as per the respective certification programme
- Employer confirmation of physical fitness (e.g. visual acuity according to DIN EN ISO 9712 Section 7.4)
- Qualification certificates if applicable, to verify admission requirements
Examination documents including examination results and the documentation of admission requirements are archived on an event-related basis.
Certification
Certification Application
When applying for certification, the following personal data is collected, processed and stored:
- Surname, first name, date of birth, place of birth of the applicant
- Photograph for identification of the applicant as per DIN EN ISO 9712 Section 12
- Private address of the applicant for contact in the event of a restriction of the scope of certification, certificate suspension or certificate withdrawal
- Contact person of the employer (surname, first name)
- Employer confirmation of the experience period as per the respective certification programme
- Employer confirmation of physical fitness (e.g. visual acuity according to DIN EN ISO 9712 Section 7.4)
For self-employed applicants or applicants without an employer, the following additional personal data is collected:
- Proof of physical fitness
- Customer reference list with contact persons, or
- Qualified employment reference as proof of experience period for initial certification or continued activity for renewal and recertification (e.g. DIN ISO 18436)
- Surname, first name, e-mail address, telephone number and qualification certificates of the referee (DIN EN ISO 9712)
After issuance of a certificate, the application documents and evidence are archived on a personal basis. Proof of physical fitness is destroyed in a data-protection-compliant manner after verification.
Certificate
The certificate contains the following personal data for identification of the certificate holder:
- Surname, first name, date of birth and place of birth
- Signature of the certified person
The certificate is archived on a personal basis.
Complaints
Complaints are recorded on a personal basis where applicable, i.e. the name and first name of the complainant are processed and stored.
All complaints are reviewed internally and not disclosed to third parties. Upon completion of the complaint procedure, the records are anonymised and stored under a measure number.
Appeals
Appeals are recorded on a personal basis, i.e. the name and first name of the appellant are processed and stored.
When forwarding appeals to third parties for review, all personal data is anonymised. Appeals are retained under a measure number upon completion of the appeal procedure.
Employer Certification
As part of employer certification, we create personal gradings. These contain the name, first name, address, date of birth and examination results of the participant. The gradings are archived on a personal basis.
Quality Assurance Measures and Customer Service
We process the contact data of the contact persons named on the certification applications to improve communication; to conduct customer surveys following the certification process; and to send reminders about follow-up certification. The legal basis for processing is the consent of the data subject (Art. 6 (1) lit. a GDPR; Section 7 (2) No. 2 UWG) as well as our legitimate interest in efficient contact and communication with you and in improving our services (Art. 6 (1) lit. f GDPR). The processing of data for this purpose generally continues until revocation (see Section 11.2 of this privacy policy).
Newsletter
If you subscribe to our newsletter, we process your personal data to send you information by e-mail, in particular about our services and our company, as well as about developments in the field of accredited certification. For the newsletter dispatch, we process your name for personal address and your e-mail address in addition to your consent. For registration to our newsletter, we use the so-called "double opt-in procedure". Therefore, after your registration, we will send you an e-mail to the specified e-mail address asking you to confirm that you are the authorised owner of the specified e-mail address and that you wish to receive the newsletter. After your confirmation, we store your e-mail address for the purpose of sending the newsletter. The processing of personal data when subscribing to our newsletter is based on the legal basis of consent (Art. 6 (1) lit. a GDPR; Section 7 (2) No. 2 UWG). The processing of data for this purpose continues until revocation (see Section 11.2 of this privacy policy), which you can declare e.g. by e-mail or by clicking on the unsubscribe link at the end of each newsletter.
Retention Periods
Complaints and appeals are retained for 6 years. Application documents from which no certificate results are archived for up to 5 years after rejection of the application.
All authorisation documents, training, examination and certificate files are archived for 30 years for the purpose of record-keeping in the interest of the customer.
Disclosure and Publication of Personal Data
In the area of qualification examinations, personal data is disclosed to the authorised examiner for the purpose of conducting and assessing the examination.
Within the certification process, personal data is transmitted to a specialist certifier for the purpose of verifying the certification requirements.
The certificate data (name of the certificate holder, method, level and validity) can be queried via a certificate validity check (CertCheck) on our website. The employer additionally receives information on whether a certificate needs to be renewed or recertified.
Personal data is not transmitted to third parties without the consent of the data subject, unless a legal provision provides otherwise.
Website
Collection and Processing of Personal Data
When you visit our website, our web servers temporarily store by default the connection data of the requesting computer, the web pages you visit on our site, the date and duration of the visit, the identification data of the browser and operating system type used, and the website from which you visit us.
Beyond this, personal information such as your name, address, telephone number or e-mail address is not collected unless you voluntarily provide this information, e.g. as part of a registration (cf. GDPR Art. 6 (1) lit. a) and b)).
We use the personal data you provide exclusively for the purpose of technical administration of the websites and to fulfil your wishes and requirements, i.e. usually for the execution of the contract concluded with you or for answering your enquiry.
Use of Cookies
On our websites, we generally do not use cookies. Only in exceptional cases are so-called session cookies used, which store data for technical session management in the memory of your browser. This data is not personal.
Should we exceptionally need to store personal data in a cookie, we will obtain your express consent pursuant to Art. 6 (1) lit. a) GDPR in advance. Furthermore, we would like to point out that browsers generally have functions for managing cookies.
Your Rights
Right to Information
You may request information pursuant to Art. 15 GDPR about your personal data that we process.
Right to Object
You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data which is carried out on the basis of Article 6 (1) lit. f GDPR. The controller shall then no longer process the personal data unless it can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or the processing serves the assertion, exercise or defence of legal claims. The collection of data for the provision of the website and the storage of log files are essential for the operation of the website.
Right to Rectification
Should the information concerning you be no longer accurate, you may request rectification pursuant to Art. 16 GDPR. Should your data be incomplete, you may request completion.
Right to Erasure
You may request the erasure of your personal data pursuant to Art. 17 GDPR.
Right to Restriction of Processing
You have the right pursuant to Art. 18 GDPR to request restriction of processing of your personal data.
Right to Lodge a Complaint
If you believe that the processing of your personal data violates data protection law, you have the right pursuant to Art. 77 (1) GDPR to lodge a complaint with a data protection supervisory authority of your choice. This includes the data protection supervisory authority responsible for the controller:
State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia
Postfach 200444, 40102 Düsseldorf
Phone: +49 211 38424-0
Fax: +49 221 38424-10
E-mail: poststelle@ldi.nrw.de https://www.ldi.nrw.de/kontakt/ihre-beschwerde
Right to Data Portability
In the event that the conditions of Art. 20 (1) GDPR are met, you have the right to have data that we process automatically on the basis of your consent or in fulfilment of a contract handed over to you or to third parties. The collection of data for the provision of the website and the storage of log files are essential for the operation of the website. They are therefore not based on consent pursuant to Art. 6 (1) lit. a GDPR or on a contract pursuant to Art. 6 (1) lit. b GDPR, but are justified pursuant to Art. 6 (1) lit. f GDPR. The conditions of Art. 20 (1) GDPR are therefore not met in this respect.
Revocation
You also have the right to revoke your consent to the processing of your personal data at any time, e.g. by e-mail. The revocation of consent does not affect the lawfulness of processing carried out on the basis of consent before its revocation.