Last updated 11 August 2026
isoassured Ltd
Registered in Scotland, company number SC383220
5 South Charlotte Street, Edinburgh, EH2 4AN
Data protection enquiries:
isoassured Ltd is the data controller for the personal data described in this notice. We comply with the UK General Data Protection Regulation and the Data Protection Act 2018.
What this notice covers
This notice covers this web site and the personal data we handle in providing our consultancy and certification services to clients. It is written to be read on its own.
It does not cover our own staff, contractors or job applicants. Personal data about people who work with us is dealt with in a separate internal privacy notice, which is issued directly to the people it applies to.
What we see during audits, and what we keep
This is worth stating early, because it is the question clients ask most often.
Carrying out an audit means looking at your records. Training matrices, competence records, accident books, contracts and supplier files routinely contain the names of your staff and sometimes their qualifications or health information. We view that material in order to assess your management system. We do not collect it and we do not keep it.
Our audit reports do not contain personal data. A report records the evidence examined and the conclusion drawn from it, not a copy of the underlying documents. Where we sample personnel records, such as training or competence files, the report refers to them by initials only. That is enough for you to trace the sample back to the right record, without a document leaving your premises with anyone named in it.
Where you do send us documents as part of a consultancy job, anything containing personal data is deleted once the job is finished. See "How long we keep it" below.
Information we collect
Everyone who visits this web site
IP address, web browser, operating system, internet service provider, approximate location, and cookie and tracking information. What we can see, and what you can switch off, is set out under Cookies below.
If you request a quote or make an enquiry
Your name, company name, email address, telephone number, the standards you are interested in and anything else you choose to tell us in your message.
If you become a client
Contact details for the people we deal with, correspondence, records of the work carried out, audit reports, and the information needed to invoice you and be paid.
Audit evidence
As described above. Viewed, not collected.
How we use it and why
We use the information described above to:
- answer enquiries and prepare quotations
- deliver the consultancy and certification work you have engaged us for
- prepare audit reports and maintain certification records
- contact clients about renewals, surveillance visits and changes to standards that affect them
- invoice, take payment and keep proper accounting and tax records
- send our email updates to people who have asked for them
- run and improve this web site
We rely on the following lawful bases. Contract, where the information is needed to deliver the work you have engaged us for. Legal obligation, for accounting and tax records. Consent, for our marketing emails and for the optional cookies described below, either of which you can withdraw at any time. Legitimate interests, for answering enquiries, for keeping our own business records, and for contacting existing clients about renewals and standards changes that affect the service we provide them.
Who else sees your information
We use a small number of established suppliers to run the business. Each of them sees only what they need:
- ServiceM8 - job management. Client contact details and job records.
- Xero - accounting. Client billing details, invoices and payment records.
- Mailchimp - sending our email updates to subscribers - mailchimp.com/legal/privacy
- Stripe and GoCardless - where a client pays by card or direct debit rather than by invoice and bank transfer. Card and bank details are entered on their systems, not ours, and we never see or store them - stripe.com/gb/privacy and gocardless.com/privacy
- Google - web site analytics, only where you have accepted the optional cookies below
- our web hosting and IT providers, and our accountants and professional advisers where they need it
We may also disclose information where we are required to by law or by a regulator.
We will never sell your data, and we will never share it with a third party who would use it for anything unconnected with providing our services.
Some of these suppliers process information outside the UK. Where they do, they are required to protect it to UK standards through the safeguards that data protection law provides for.
How we store and protect it
The personal information we collect is stored securely on our company computer systems and in secure cloud services provided by approved providers. When collecting or sharing files or documents with clients we use secure and encrypted file transfer where any personal or confidential data is involved. We do not ask clients to email documents containing personal data.
We may also hold paper records containing personal information. These are controlled and protected at all times and disposed of securely when no longer required.
Protecting the confidentiality, integrity and availability of personal data, from threats internal or external, deliberate or accidental, is a priority, and we maintain technical and organisational controls to that end.
How long we keep it
We keep client records, audit reports and certification records indefinitely. Clients return years later for surveillance visits, recertification and further work, and being able to pick up the history is part of the service.
Invoicing and payment records are kept for at least six years, as company and tax law requires.
If you subscribe to our email updates we keep your details until you unsubscribe.
Documents a client sends us that contain personal data are deleted once the job is finished. Company documents and templates that contain no personal data are kept.
If you would like us to delete information we hold about you, ask us and we will, unless we are required to keep it.
Your rights
You have the right to be informed about what we do with your personal data, and the rights to access it, have it corrected, have it erased, restrict how we use it, receive a copy of it in a portable form, object to our using it, and not be subject to decisions made purely by automated means. We do not make automated decisions about anyone.
Not all of these rights apply to all personal data. Which apply depends on the data and on our lawful basis for holding it. Where our basis is consent, you can withdraw it at any time.
To exercise any of these, email
If you are not happy with how we have handled your information you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, or on 0303 123 1113. We would rather you came to us first so we can put it right.
Cookies
Cookies are small data files stored on your device when you visit a website.
We set only the cookies needed to run the site unless you tell us otherwise. When you first arrive you are asked whether you are willing to accept analytics cookies. Until you say yes, none are set. If you say no, none are set. You can change your answer at any time using the Cookie Settings link, here or at the foot of any page.
Strictly necessary cookies
These keep the site working and record the cookie choice you made. The site cannot work properly without them, so they are always set and we do not ask permission for them.
| Name | Set by | Purpose | Expires |
|---|---|---|---|
| Joomla session cookie (a random string of letters and numbers) | This site | Keeps your session while you move between pages and use the quote form | End of session |
| cpnb_cookiesSettings | This site | Records which cookie categories you agreed to, so we do not ask again | Up to 12 months |
| cookiesDirective | This site | Records that you have answered the cookie banner | Up to 12 months |
Analytics cookies, only with your permission
We use Google Analytics to count visits and see which pages people use, so we know what to improve. If you decline, Google Analytics still runs but sets no cookies and cannot recognise you between visits.
| Name | Set by | Purpose | Expires |
|---|---|---|---|
| _ga | Distinguishes one visitor from another | 2 years | |
| _ga_RJTMP9006C | Keeps track of the visit for this particular site | 2 years |
Where you have given permission, Google acts as a separate data controller for the information its cookies collect and may transfer it outside the UK. Its notice explains what it does with it: Google privacy policy.
Advertising cookies
We do not currently use advertising cookies on this web site. If that changes, we will add an advertising category to the cookie banner and update this notice before any advertising cookie is set.
Turning cookies off in your browser
You can also block or delete cookies in your browser settings. Doing so for the strictly necessary cookies above will stop parts of the site working.
Changes to this notice
We review this notice at least once a year and update it whenever what we do changes. The date at the top tells you when it last changed.
If you have a question about any of this, email