Confidentiality & Data Protection
QA Assessor is committed to protecting the confidentiality of all information obtained during certification activities. Personal data is handled in accordance with the Digital Personal Data Protection Act, 2023 of India, the rights of UK and EU residents described in our Privacy Policy, and good practice. All applicants and certified persons can trust that their information is processed securely, responsibly, and only for legitimate certification purposes. Reference: QA-CB-POL-002 | ISO/IEC 17024:2026 clauses 7.3 and 7.4 | Version: 3.0 | Last reviewed: September 2026
1. Confidential information
Confidential information includes: applicant and certified person information (records, evidence files, identity checks, applications, eligibility checks, assessment notes, decisions, certificates); course materials, assessments and results held by the training function; certification, renewal and recertification records; and complaints and appeals information. QA Assessor ensures that confidential information is accessible only to authorised personnel and is used solely for its intended purpose. Every member of staff, assessor, reviewer and committee member signs a confidentiality and impartiality declaration.
2. Separation of training and certification records
QA Assessor maintains a strict separation between training and certification. Course participation or performance records are never used in certification decisions beyond the fact, recorded in Training and Qualifications, that a course was passed; the person who trained an applicant takes no part in verifying, assessing or deciding that applicant’s application. Records are retained only as long as necessary for certification, recertification, administration and legal obligations (see the retention table in the Privacy Policy).
3. Third-party access
External service providers (hosting, security, email delivery, payment processing, the learning platform, backup storage) handle data only for the purposes authorised and under written terms. No assessment or certification decision is outsourced. The verifiers, training providers and employers named on a record are contacted only to confirm that record, and only the details needed to confirm it are shared with them.
4. Public Auditor Register
QA Assessor maintains a publicly accessible Auditor Register. For every listed person it shows: full name, Register ID, scheme (standard), grade, unique certificate number, certified-since date, registration valid-until date, and status (Certified and listed, Lapsed, Suspended or Withdrawn). A person may choose, under Register Entry in the dashboard, to add: country, industry sectors, a short professional summary, and a contact route through the community’s messaging. A person may also hide their entry from the register list; a certificate number can still be verified by anyone who has it, and the verification page shows the same fields. No contact details, employer information, date of birth, identity documents or other personal identifiers are published. Applicants consent to this limited disclosure when they apply, and lapsed, suspended or withdrawn entries remain visible so that certificates already issued can be checked.
5. Data protection principles
QA Assessor processes personal data according to these principles: lawfulness, fairness and transparency; purpose limitation (only for certification or administration); data minimisation (collect only what is necessary); accuracy and the ability to update data; storage limitation (retain only as required); and security and confidentiality.
6. International data transfers
For applicants and certified persons outside India, QA Assessor ensures that personal data is transferred and stored securely with safeguards compliant with applicable law, as described in section 7 of the Privacy Policy.
7. Security and data breach response
Access is controlled by role; staff use two-factor login; data is encrypted in transit; backups are taken daily and restore-tested. In the event of a data breach, QA Assessor takes immediate steps to contain, assess and mitigate the risk, records it, and notifies affected individuals and the authorities where required by law.
8. Your rights
Individuals have the right to: access, correct or request deletion of their personal data; restrict or object to processing; receive their data in a portable format; withdraw consent where applicable; and lodge a complaint with the relevant data protection authority. To exercise your rights, contact: certification@qaassessor.com. QA Assessor responds to all requests within 30 calendar days.