Privacy and Personal Information Policy
GSQA-DAT-001
Necessary purposes
Account information establishes and protects accounts, confirms representation and handles account requests. Application material supports scope determination, evidence review, decisions, notices and maintenance. Feedback data serves the relevant matter. Purposes are distinguished; submitting one form does not authorise unrelated use. Optional updates do not affect accounts, applications or awards.
Access and recipients
Account users access their matters within permission, and organisational members act under their actual authority. Intake, review, decision, reconsideration and publication personnel access material according to responsibilities. Infrastructure providers for website operation, databases and file storage process data necessary for their functions. Verification may contact actual issuers using necessary information, not distribute complete files for unrelated purposes.
Retention and deletion
Accounts, drafts, formal submissions, decision evidence, public files and feedback serve different purposes. Continued retention considers completion, record maintenance, applicable duties, evidence and disputes. Unnecessary data is deleted or de-identified. Account closure, withdrawal and personal-data deletion are separate; required records and backups do not all disappear through a single button.
Rights and contact
Use the privacy-request route for access, correction, deletion, restriction, applicable objection or portability requests, and other privacy questions. Identify the request, relevant account or record and reply channel. Unrelated identity documents, medical information or complete commercial reports are not needed in an initial request. Representatives identify their authority.
Data and sources
Data may include names, work contact details, organisation and role, credential-verification data, authority, personal details in product reports, communications and request records. Sources include individuals, authorised representatives, applicants, issuers and lawful public sources. Third-party material remains limited to necessary information; public availability is not unrestricted permission for reuse.
Purpose and public disclosure
Product name, brand, model, market, basis, results and award status are disclosed under record rules. Reports, images and charts follow file-specific rights and confirmed scope. Signatures, personal contacts and unnecessary details do not automatically become public with a report. Complete review files, internal opinions and public copies remain separate; an application is not consent to publish everything.
Transfers and overseas processing
The service is worldwide, and processing may occur where infrastructure, verifying bodies or authorised personnel operate. Public award material can also be read abroad. Receipt of non-public data, remote access and other transfers require the corresponding purpose, authority and applicable legal basis or safeguards. Language choice or an overseas market application is not blanket consent to all transfers. Relevant recipient and safeguard information may be requested through the privacy route.
Retention and security
Originals, translations, authentication, authority and internal opinions are access-controlled by responsibility; public files are separately confirmed. Necessary access, material-action and status records support examination and abuse prevention. Security reduces risk but is not a promise that incidents cannot occur. Suspected disclosure, account compromise or leakage should identify the matter and discovery time without reposting sensitive files in general messages.
Examining and answering requests
Requests are registered and identity, authority and relevant records checked proportionately where necessary. A person does not need another party’s complete report to exercise their own rights. Responses follow applicable requirements. If the request cannot be met in full, explain reasons, limits, measures taken and available further routes. Any extension or identity request specifies the issue; an automatic receipt is not completion.
Optional updates and withdrawal
Updates are a separate choice, not combined with account or application acceptance. Refusal or withdrawal does not stop necessary case notices or normal applications. A stop request can be made through available update settings or the privacy route. Changes are recorded; non-selection or earlier withdrawal must not be converted into consent.
Notices, changes and related procedures
Account, application and feedback collection points provide purpose-specific notices and link this policy. Changes to purposes or material arrangements are explained as applicable; where separate consent is required, general terms acceptance does not replace it. Confidentiality follows GSQA-DAT-002, storage technologies GSQA-WEB-001 and public-report rights GSQA-EVD-005.
Network access and abuse prevention
Website access processes network request information. Hashed identifiers derived from network information, operations and time windows limit abuse. The project database does not store full IP addresses for language suggestions. Hashing is not automatically irreversible anonymisation, and infrastructure records differ from project records. Cookies and session storage follow the storage inventory.
Third-party individuals and necessary disclosures
Applicants or representatives providing another person’s signature or work details need a basis and appropriate notice. Official verification, legal requirements and rights protection involve checking the request and necessary scope. Public disclosure is distinct from provision to an entitled authority. Responses may redact or limit material affecting others’ rights, trade secrets or required retention, explaining the reasons.