Privacy policy.
Your data is used only to process your request.
Updated:
Data controller
Gardiant Certification, company in the process of registration, represented by Jaylan Nikolovski, founder, acting on behalf of the company in formation. Contact: contact@gardiant.eu.
Data collected
- Quote request: company name, SIRET, name, position, email, phone (optional), headcount, number of sites, certification scope, preferred date, current certification body, message.
- Contact form: name, email, organisation, subject, message.
Purposes
Processing your quote, contact, complaint or application request. Quote information is used to calculate the audit duration, nothing else. Information gathered during an audit is used for the audit only.
Legal basis
Each processing operation rests on one of the legal bases set out in Article 6 of the General Data Protection Regulation (GDPR):
- Contact form: Gardiant Certification's legitimate interest in answering the requests it receives.
- Quote request: steps taken at your request before entering into a contract (review of the request, calculation of the audit duration, preparation of the quote).
- Performance of the certification agreement: performance of the contract (scheduling and conducting audits, reports, decision, issue of the certificate, handling of complaints and appeals). Data on people met during the audit (employees, trainers, learners) is processed on the basis of legitimate interest, limited to what the audit requires.
- Legal obligations: invoicing, accounting and the regulatory obligations attached to certification, including publication of certificate status.
Retention periods
Data is kept for the following periods, then deleted or anonymised:
- Contact request: three years from the last exchange.
- Quote request not followed by an agreement: three years from the request.
- Certification file (agreement, audit plans and reports, decisions, certificates): for the whole term of the agreement, then for one full three-year certification cycle after it ends.
- Complaints and appeals: five years from closure.
- Invoices and accounting records: ten years from the end of the financial year.
- Unsuccessful job applications: two years from the last contact, unless you object.
Recipients
Your data is never sold or rented, and never passed on to any consulting firm. Access is limited, to the extent their role requires, to:
- authorised persons at Gardiant Certification responsible for handling requests, scheduling, certification decisions and invoicing;
- the auditors, whether employees or subcontractors, assigned to your audit and bound by confidentiality;
- once accreditation has been obtained, assessors from the national accreditation body, who are also bound by confidentiality, and public authorities where the law requires it;
- Gardiant Certification's technical processors: Vercel Inc. (website hosting), Supabase (database, hosted in the European Union) and, where used, Brevo (email delivery).
As Vercel Inc. is established in the United States, some data may be transferred outside the European Union. These transfers are covered by the standard contractual clauses adopted by the European Commission.
Your rights
You have the right to access, rectify, erase, restrict, object to and port your data. You may also lodge a complaint with the CNIL, the French data protection authority (cnil.fr).