Privacy notice

---

1. Purpose and use

This Notice tells a data subject what personal information EdelCert International (Pty) Ltd ("the CB") collects, why, on what legal basis, who it is shared with, and what rights the data subject has. It implements POL-DAT-01 §7.1 and Annex A.

The Notice has three variants, published separately at the points where each audience first provides personal information:

• Part A, for client personnel whose data is processed during an audit, published in the Certification Agreement (MOD-CTR-01) and provided before the first audit;
• Part B, for auditors and contracted personnel, provided at application per PRO-COM-04 §6.2;
• Part C, for website visitors and complainants, published on the CB's website and referenced in PRO-PLA-01 §6.

Each variant is complete in itself. A data subject who falls under more than one variant (for example, a client employee who also submits a complaint) is covered by each variant that applies to the relevant processing.

2. Part A - Notice to client personnel

2.1 Who is responsible for your information

EdelCert International (Pty) Ltd, registration 2026/554829/07, registered office 1805 Cartwrights, cnr Adderley and Darling Street, Cape Town 8000, South Africa, is the responsible party (POPIA) / controller (GDPR, where it applies) for the personal information described in this Notice.

2.2 Information Officer

Contact the Information Officer for any question about this Notice or about how your information is handled:

• Email: informationofficer@edelcert.com
• Post: Information Officer, EdelCert International (Pty) Ltd, 1805 Cartwrights, cnr Adderley and Darling Street, Cape Town 8000, South Africa

The appointment of the Information Officer is recorded in MOD-IO-01.

2.3 What we collect

• Your name, job title, and business contact details, where you are named as a contact for the certification engagement;
• Statements you make and documents you produce in interviews and records reviewed during an audit;
• Your name and role where it appears in audit evidence, findings, non-conformity reports, or corrective action records;
• Where relevant to a complaint or appeal, the substance of the complaint or appeal and correspondence about it;
• An audio recording of your interview, but only where you give your explicit prior consent. You may refuse consent, or withdraw it before the interview starts, without any consequence to you or to the conduct of the audit. Where made, the recording is used only as supporting evidence for the audit and the audit report, and is kept for 90 days in hot storage, then a further 2 years in cold storage, then deleted (POL-ENR-01 §4, REG-RET-01 §4, MOD-MAN-01 §8.4).

We do not collect more than an audit requires. Auditors do not record personal information beyond what is needed as audit evidence (POL-DAT-01 §7.3).

2.4 Why we collect it, and the lawful basis

2.5 Who we share it with

• Subcontracted certification bodies and contracted individual auditors who perform the audit on our behalf under ISO/IEC 17021-1 §7.5. The certification decision itself is never taken by a subcontractor. The subcontractor performing your audit is named to your employer at the time of the engagement;
• The Certification Decision-Maker, who is always CB personnel;
• International Accreditation Service (IAS), where the CB's accreditation status requires reporting to it. EdelCert International is an applicant to IAS. No accreditation is held at the date of this Notice. Once accreditation is granted, information may be shared with IAS as an accreditation body exercising its oversight of the CB, on the terms then in force;
• Professional advisers and the CB's hosting provider, each bound by a data processing agreement;
• A regulator, court, or law enforcement body, where the CB is legally required to disclose.

We do not sell your information and do not share it with your employer's competitors, suppliers, or customers.

2.6 Cross-border transfer

The CB's audit and record management platform is hosted in an EU/Swiss data centre, and, once a subcontracting agreement is executed, audits will be performed on the CB's behalf from Switzerland. Your information is therefore processed outside South Africa. This transfer is made on the basis of POPIA s.72: the CB has satisfied itself that the receiving jurisdiction and processor afford a level of protection substantially similar to POPIA, and a data processing agreement is in place with each processor and subcontractor before any transfer. Where the GDPR applies to you as a data subject in the European Union, the transfer to Switzerland is additionally supported by the European Commission's adequacy decision for Switzerland. Where FADP applies because processing occurs in Switzerland, the Swiss-established processor complies with its own FADP obligations on any onward transfer.

2.7 How long we keep it

Audit files, non-conformity records, and certification decision records are retained for 10 years from the end of the certification (POL-ENR-01 §4). Complaint and appeal records are retained for 10 years from resolution. Records subject to a legal hold are retained until the hold is released (POL-ENR-01 §8).

2.8 Your rights

You may:

• Access the personal information the CB holds about you (POPIA s.23);
• Request correction of information that is inaccurate or incomplete (POPIA s.24);
• Object to processing in certain circumstances (POPIA s.11(3));
• Request deletion, subject to the CB's legal retention obligations described at §2.7 (POPIA s.14);
• Where the GDPR applies to you, additionally request erasure, restriction, or portability of your data (GDPR Art. 17, 18, 20), subject to the same retention obligations;
• Complain to the Information Regulator of South Africa (or, where the GDPR applies, the competent EU supervisory authority) if you are dissatisfied with how the CB has handled your information or your request.

To exercise any of these rights, contact the Information Officer at §2.2. Requests are handled per MOD-DSR-01. Some requests concerning audit evidence may be limited by the confidentiality the CB owes to your employer as a certified or applicant client under ISO/IEC 17021-1 §8.4; where that applies, MOD-DSR-01 §5 explains how the CB reconciles the two obligations and what reasoning it gives you.

3. Part B - Notice to auditors and contracted personnel

3.1 Who is responsible for your information

As at §2.1.

3.2 Information Officer

As at §2.2.

3.3 What we collect

• CV, qualifications, certifications, and professional history;
• References and background check results, where obtained;
• Contact details, photograph, and signature;
• Training records, CPD logs, witness audit reports, and evaluation outcomes (PRO-COM-03, PRO-COM-04);
• Declarations of conflict of interest, confidentiality, and independence;
• Records of any complaint, disciplinary matter, suspension, or withdrawal of authorisation concerning you.

3.4 Why we collect it, and the lawful basis

3.5 Who we share it with

• The Managing Director and Quality Manager, for authorisation and monitoring decisions;
• The Impartiality Committee, once constituted, where an authorisation or a complaint has impartiality implications; until then, the independent external person appointed under ORG-DIS-01 §5.2;
• Where you are proposed by a subcontractor, the subcontractor, for the limited purpose of confirming your engagement and administrative status;
• IAS, where a witness assessment, complaint, or authorisation record falls within its oversight of the CB. No accreditation is held at the date of this Notice; this sharing applies once accreditation is granted, and in the interim only in connection with the CB's application for accreditation.

3.6 Cross-border transfer

As at §2.6. Your competence file may be accessed by CB personnel and, for records processing, by the CB's hosting provider in the EU/Swiss data centre, on the same POPIA s.72 basis.

3.7 How long we keep it

Your competence file is retained for 10 years from the end of your authorisation (POL-ENR-01 §4, PRO-COM-04 §14).

3.8 Your rights

As at §2.8, adjusted for your role: access, correction, objection, deletion subject to retention, and complaint to the Information Regulator (or, where the GDPR applies, the competent EU supervisory authority). Contact the Information Officer at §3.2. Requests are handled per MOD-DSR-01.

4. Part C - Notice to website visitors and complainants

4.1 Who is responsible for your information

As at §2.1.

4.2 Information Officer

As at §2.2.

4.3 What we collect

• Information you submit through the website contact form, an enquiry, or a complaint or appeal channel (PRO-PLA-01 §6): name, contact details, and the content of your message;
• Standard website technical logs (IP address, browser type, pages visited), where the website uses them;
• Where you submit a complaint or appeal, the substance of your complaint, any supporting documents, and correspondence during its handling.

4.4 Why we collect it, and the lawful basis

4.5 Who we share it with

• The Quality Manager and, where the complaint concerns a certified client, that client, who is notified that a complaint has been made and kept informed of progress and outcome (PRO-PLA-01 §11);
• An independent investigator, where PRO-PLA-01 §12.4 requires one;
• IAS, only once accreditation is granted and only where a complaint or appeal falls within its oversight of the CB;
• We protect your identity as complainant unless disclosure is required for the investigation and you consent (PRO-PLA-01 §13.1).

4.6 Cross-border transfer

As at §2.6, where your submission is stored on the CB's hosting platform.

4.7 How long we keep it

Complaint and appeal records are retained for 10 years from resolution (POL-ENR-01 §4). A general enquiry that does not proceed to a contract or a complaint is retained only as long as needed to respond to it.

4.8 Your rights

As at §2.8: access, correction, objection, deletion subject to retention, and complaint to the Information Regulator (or, where the GDPR applies, the competent EU supervisory authority). Contact the Information Officer at §4.2. Requests are handled per MOD-DSR-01. Submitting a complaint or appeal is free of charge and results in no penalty to you (PRO-PLA-01 §5.2 and §5.3).

5. How to exercise your rights

Send your request to the Information Officer using the contact details at §2.2. The CB verifies your identity, logs the request, and responds within the statutory period, all as set out in MOD-DSR-01. If you are not satisfied with the response, you may complain to the Information Regulator of South Africa, and, where the GDPR applies to you, to the competent EU supervisory authority.

---

Approval

Revision history

---