UK GDPR & Data Protection Statement

1. Scope and legal framework

This statement concerns general processing governed by the UK GDPR and Part 2 of the Data Protection Act 2018. Different rules apply to competent authorities carrying out law-enforcement processing, intelligence services processing and some sector-specific activities. Customers are responsible for identifying any additional regime that applies to them.

The principal UK instruments are the UK GDPR, the Data Protection Act 2018, the Data (Use and Access) Act 2025 and, for electronic communications and device storage, the Privacy and Electronic Communications Regulations 2003 (PECR). References to these laws include amendments and subordinate legislation in force from time to time.

The EU GDPR is a separate regime. A UK organisation may also be subject to it if, for example, it has an EU establishment, offers goods or services to people in the EEA, or monitors their behaviour there. This statement does not decide that territorial question for a Customer.

2. Key definitions

The ICO provides a practical data-protection glossary.

3. Controller and processor roles

3.1 CertFlow as controller

CertFlow is a controller where we decide why and how to process personal data for our own business purposes. This includes our website and enquiries, prospective and direct customer relationships, account administration, subscription and billing records, service communications, our own security and abuse prevention, legal compliance, supplier management, and the operation of features where we determine an independent purpose. Our Privacy Policy describes those activities, lawful bases, recipients and retention periods.

Being a controller does not mean we own personal data. It means we are responsible for the lawfulness, fairness, transparency, security and accountability of that processing.

3.2 CertFlow as processor

A Customer normally determines why operational workspace data is processed and who it concerns. Examples include employee and inspector records, client contacts, assets and sites, inspections, signatures, photographs, qualifications, HR or competency documents, jobs, certificates, messages, quotes and invoices. For that Customer Personal Data, the Customer is controller and CertFlow acts as processor under the DPA.

We process Customer Personal Data only on documented instructions, including the instructions inherent in authorised use of the Service, unless UK law requires otherwise. We assist the Customer with rights, security, impact assessments and breaches as described in the DPA. If a Customer asks us to do something that we reasonably believe infringes Data Protection Laws, we will inform it unless the law prohibits that notice.

3.3 The Customer remains accountable

A Customer cannot transfer its controller obligations to CertFlow merely by using the Service. The Customer decides what personal data to enter, the purpose, lawful basis, users, permissions, disclosures, retention period and whether an output will be used to affect a person. It must ensure its instructions are lawful and that CertFlow is suitable for the nature and risk of its processing.

Some providers or recipients may be independent controllers for their own purposes—for example a payment provider's fraud prevention or a public authority's statutory function. The correct role depends on the real decision-making arrangement, not the label used in a contract.

4. The seven data-protection principles

Article 5 of the UK GDPR sets seven principles. They apply throughout the lifecycle of processing and are not replaced by having a lawful basis, a contract or a security feature.

Read the ICO's guide to the data-protection principles.

5. The seven lawful bases

Every purpose involving personal data needs a valid Article 6 lawful basis before processing begins. There are now seven bases under the UK GDPR. None is automatically preferable, and a basis cannot be selected retrospectively merely because it is convenient. The controller should document the purpose, necessity and selected basis and reflect it in its privacy information.

The basis affects which rights apply. More than one basis may be relevant to different purposes involving the same record, but controllers should not list every basis indiscriminately.

CertFlow's own purposes and bases are described in section 6 of the Privacy Policy. Customers must make and document their own assessment for Customer Personal Data.

6. Recognised legitimate interests under the DUAA

Recognised legitimate interests are a distinct lawful basis, not a relaxed version of ordinary legitimate interests. Annex 1 contains five tightly defined conditions. The processing must still be necessary for the relevant condition, fair, transparent, proportionate, secure and otherwise compliant.

CertFlow does not use recognised legitimate interests as a shortcut for routine account administration, analytics, product development, commercial profiling or marketing. If we rely on it for a specific public-interest event, we will identify the applicable condition and document necessity. A Customer considering it must perform the same exercise.

A recognised legitimate interest is only the Article 6 basis. Special-category data still needs an Article 9 condition, and criminal-offence data still needs Article 10 authority and a Data Protection Act 2018 condition where required. Public authorities cannot rely on this basis to perform their own public tasks.

See the ICO's current recognised legitimate interest guidance and ordinary legitimate interests guidance.

7. Special-category and criminal-offence data

Special-category data needs both an Article 6 lawful basis and a separate Article 9 condition. Some conditions also require a condition in Schedule 1 to the Data Protection Act 2018, an appropriate policy document, retention/erasure policies and enhanced records. Explicit consent is not the only possible Article 9 condition, but it must not be used where consent is not genuinely free or can be withdrawn while the processing remains necessary for another reason.

Criminal-offence data requires an Article 6 basis and processing under official authority or an applicable condition in the Data Protection Act 2018, with the required safeguards. Allegations and pending proceedings are protected, not only convictions.

Customer records concerning health, absence, disability, ethnicity, trade-union membership, right-to-work evidence, competency, disciplinary matters, incident photographs or free-text notes may contain sensitive data. The Customer must decide whether collecting it is necessary, identify every applicable condition, restrict access, give appropriate information, set retention and complete a DPIA where the risk requires one. CertFlow processes that data only on documented instructions under the DPA.

See the ICO's guidance on special-category data and criminal-offence data.

8. Data protection by design and by default

Data protection by design means considering privacy at the design stage and throughout the life of a system, feature or process. By default, only personal data necessary for each specific purpose should be processed, made accessible and retained. The correct measures depend on the state of the art, cost, nature, scope, context, purpose and risks to people.

Our approach includes reviewing the purpose and data fields of new features; limiting collection where practical; applying role-based permissions, organisation scoping and database access controls; authentication and session controls; encrypted transport and managed provider encryption at rest; restricted administrative access; relevant audit and security events; backups and recovery measures; secure development and change review; incident handling; processor due diligence; and support for export, correction and deletion workflows. These are risk controls, not a guarantee that every Customer configuration or use is compliant or that no incident can occur.

We describe controls only at a level we can substantiate and do not rely on a marketing label as proof of compliance. Current contractual measures are set out in the DPA. Product and operational detail may change as controls are improved, threats evolve or providers change.

8.1 Customer configuration and human controls

Customers must use available controls appropriately: apply least privilege, review administrator access, remove leavers promptly, protect credentials and devices, separate public from private content, verify recipients and exports, review integrations, restrict sensitive files, and test their operational procedures. A technically available control has no protective effect if it is disabled, misconfigured or routinely bypassed.

If an online service is likely to be used by children, the DUAA expressly requires its provider to consider children's higher-protection matters when implementing data protection by design and default. CertFlow is a business service not directed to children. A Customer that gives children access or processes their data must assess age-appropriate design, transparency, best interests, profiling, default visibility and other heightened safeguards.

Read the ICO's updated data protection by design and default guidance.

9. Individual rights

Rights depend on the purpose, lawful basis, circumstances and any lawful exemption. They are not all absolute, but a controller must recognise, record and respond to a request even if the person does not cite the UK GDPR or use a particular form.

For processing where CertFlow is controller, send requests to info@certflow.co.uk. We may ask for information reasonably needed to locate the data and proportionate evidence of identity or authority. We do not normally charge. We may charge a reasonable fee or refuse only where the law permits, such as a manifestly unfounded or excessive request, and will explain the decision and complaint rights.

Where a Customer is controller, the individual should normally contact that Customer. If a request reaches us, we will route it appropriately and assist the Customer under the DPA. We will not independently decide a Customer's lawful exemptions unless required for our own controller processing.

The ICO's guide to individual rights explains each right in detail.

10. Subject access requests after the DUAA

The DUAA clarifies several SAR rules. A controller must carry out a reasonable and proportionate search for relevant personal data. This is not permission to ignore difficult systems or inconvenient records: the controller must make reasonable efforts and be able to justify why any further search would be disproportionate to the importance of providing access.

The ordinary response period is without undue delay and within one month. Under the amended timing rules, the period begins when the controller has the request, any information reasonably requested to confirm identity, and any fee lawfully required for a manifestly unfounded or excessive request. Complex or numerous requests may be extended by up to two further months, with notice and reasons within the first month.

A controller may ask for clarification and pause the SAR clock only where clarification is reasonably required to respond. It must be able to demonstrate that need; clarification cannot be used routinely to force a person to narrow a clear request or to delay work that can reasonably proceed. The clock resumes when the clarification is received.

A SAR provides the person's personal data and supplementary information, not necessarily every original document. Third-party rights, legal professional privilege, confidential references, management information and other exemptions must be assessed carefully and documented rather than applied as blanket exclusions.

See the ICO's updated guidance on the right of access, including reasonable and proportionate searches.

11. Automated decision-making and profiling

The DUAA permits a significant decision based solely on automated processing in a wider range of circumstances. A decision is solely automated where there is no meaningful human involvement. It is significant where it produces a legal or similarly significant effect on the person. Profiling is relevant when assessing whether human involvement is meaningful.

For non-special-category data, a controller may potentially use any appropriate Article 6 lawful basis except recognised legitimate interests, but must apply the Article 22C safeguards. These include giving the person information about the decision and enabling them to make representations, obtain meaningful human intervention and contest the decision. Fairness, transparency, accuracy, security, non-discrimination, individual rights and DPIA duties continue to apply.

The stricter rule for special-category data remains: a significant solely automated decision using such data requires explicit consent or substantial public interest based in UK law with suitable safeguards, in addition to the other applicable conditions.

11.1 How this relates to CertFlow features

CertFlow includes rules-based status indicators, reminders, qualification checks, partner matching, lead scores and business dashboards. They are decision-support outputs for human users. CertFlow does not use them, on its own behalf, to make a solely automated decision about a person that has a legal or similarly significant effect.

A Customer controls how it acts on an output. It must not treat a score, match, status, reminder, generated document or suggested classification as the sole basis for a significant employment, disciplinary, safety, access, credit, insurance or similar decision unless it has established a lawful basis, completed any required DPIA, provided the required information and implemented genuine human review and challenge safeguards. A rubber stamp is not meaningful human involvement.

The ICO's DUAA data-protection summary explains the amended automated-decision rules.

12. Retention, deletion and anonymisation

The UK GDPR does not impose one universal retention period. A controller must set and justify periods by purpose, legal obligation, risk, limitation periods and the continuing need for identifiable data. A retention schedule should identify the record, owner, trigger, period, disposal method, exceptions and review process.

CertFlow's usual controller retention periods are in section 10 of our Privacy Policy. Customer Personal Data is retained and returned or deleted under the Customer's instructions, the subscription exit process and the DPA. Protected backup copies may persist until overwritten through the normal backup cycle, remain isolated from ordinary use and be restored only for legitimate recovery or security purposes.

Customers must set retention for their own inspection, employment, client, billing, health-and-safety and professional records. Statutory or evidential retention of a certificate does not automatically justify keeping every supporting photograph, identity document, location event or free-text note for the same period.

Deletion should cover live records, derived copies, exports and downstream recipients where required. If information is retained for a legal hold, complaint, claim or statutory duty, access and use should be restricted to that purpose. Truly anonymised aggregate information may be retained because it is no longer personal data; pseudonymised data remains protected.

See the ICO's storage-limitation guidance.

13. International transfers

CertFlow does not claim that all personal data remains in the United Kingdom. Although core services may use a configured UK region, website delivery, email, billing, support, analytics, scheduling, provider administration and subprocessor operations may involve access or processing in other countries. Current provider and location information is in the Privacy Policy and the DPA subprocessor schedule.

A restricted transfer occurs when personal data subject to the UK GDPR is sent or made accessible to a separate organisation outside the UK. The exporter must identify a permitted route. This may be UK adequacy regulations (also described following the DUAA as a transfer approved by regulations), appropriate safeguards such as the UK International Data Transfer Agreement or UK Addendum, or a narrow Article 49 exception for an occasional qualifying transfer.

Where appropriate safeguards are used, the exporter must complete a transfer risk assessment—described in the amended law as applying the data protection test—and, acting reasonably and proportionately, decide that the protection after transfer is not materially lower than under UK law. It must implement any extra contractual, technical or organisational protections the assessment identifies and review them when circumstances change.

Customers remain responsible for transfers they initiate, including exports, integrations, public sharing, invitations to overseas users and remote access by their own teams or suppliers. CertFlow's transfer mechanism for its subprocessors does not automatically cover a Customer's separate recipient.

Read the ICO's international-transfer guidance and current explanation of appropriate safeguards and the data protection test.

14. Security and personal data breaches

14.1 Risk-based security

Controllers and processors must use measures appropriate to the likelihood and severity of risks to people. Relevant measures may include access control, encryption, resilience, restoration, logging, testing, supplier controls, staff confidentiality, training and an incident plan. The right combination depends on the data and processing; no single feature, hosting region or contractual statement proves compliance.

Our current security approach is summarised in section 8 above, the Privacy Policy and the DPA. Customers must also secure their endpoints, accounts, permissions, exports, local files, integrations and human processes.

14.2 Breach assessment and notification

A controller must record every personal data breach and assess likely risk to people's rights and freedoms. If a risk is likely, it must notify the ICO without undue delay and, where feasible, within 72 hours after becoming aware. If the risk is high, it must also tell affected people without undue delay in clear language, unless a statutory exception applies. A late notification must explain the delay.

Where CertFlow is processor, we will notify the affected Customer without undue delay after becoming aware of a Customer Personal Data breach and provide available information and reasonable cooperation as described in the DPA. The Customer, as controller, decides whether notification to the ICO or individuals is required. Where we are controller, we make and document that assessment ourselves.

Report a suspected data incident promptly to info@certflow.co.uk. Include enough information to locate and contain it, but do not send unnecessary passwords, identity documents, health data or other sensitive content by ordinary email. Preserve relevant evidence and do not conceal, alter or continue unauthorised access.

The ICO's personal data breach guidance and reporting service explains the risk and notification tests.

15. Accountability, governance and DPIAs

Accountability requires proportionate measures and evidence. Depending on the organisation and processing, a defensible programme commonly includes:

• an owned data-protection policy, senior responsibility and appropriate staff training;
• records of processing activities, information-asset and data-flow inventories;
• documented purposes, lawful bases, legitimate-interest assessments and Article 9/10 conditions;
• clear privacy notices and just-in-time information;
• Article 28 processor contracts, subprocessor due diligence and data-sharing arrangements;
• retention, secure disposal and legal-hold procedures;
• rights-request, complaint and breach workflows with tested deadlines and escalation;
• risk-appropriate access, security, continuity and recovery controls;
• international-transfer mapping, mechanisms and transfer risk assessments;
• DPIAs and prior consultation where required;
• a data protection officer where Article 37 requires one, with independence and resources; and
• periodic audits, metrics, issue remediation and evidence that controls operate in practice.

15.1 Data protection impact assessments

A controller must complete a DPIA before processing likely to result in a high risk to people. Examples can include systematic and extensive evaluation with significant effects, large-scale special-category or criminal-offence data, systematic monitoring of publicly accessible areas, novel technology, vulnerable people, combining datasets, large-scale tracking or processing that could prevent people exercising a right or using a service.

A DPIA should describe the processing and purposes, assess necessity and proportionality, identify risks to people, specify mitigations, assign owners and record consultation. It must be started early enough to influence design and reviewed when the nature, scope, context, purpose or risk changes. If high residual risk cannot be reduced, the controller must consult the ICO before processing.

CertFlow will provide reasonable processor information needed for a Customer DPIA under the DPA, but cannot perform the Customer's controller analysis or approve the Customer's lawful basis. Product procurement due diligence is not, by itself, a DPIA.

See the ICO's accountability and governance guide and DPIA guidance.

16. Data-protection complaints

The DUAA introduced a direct duty for controllers to facilitate data-protection complaints. An organisation must give people an accessible way to complain, acknowledge receipt within 30 days, take appropriate steps without undue delay—including appropriate enquiries and keeping the complainant informed—and communicate the outcome without undue delay.

To complain about CertFlow's controller processing, email info@certflow.co.uk with “Data protection complaint” in the subject line, call 0114 392 2407, or write to CertFlow LTD, 20 Wenlock Road, London, N1 7GU. Explain what happened, the data or account involved, relevant dates and the outcome you seek. If acting for another person, provide evidence of authority when requested. Do not send unnecessary identity documents until we provide an appropriate route.

We will record the complaint, acknowledge it within 30 days, investigate appropriately, keep you informed if work continues and explain the outcome without undue delay. This complaint timetable does not replace the separate one-month timetable that may apply to an individual-rights request. We will identify and run both processes where a communication contains both.

If the complaint concerns processing controlled by a Customer, the Customer is responsible for the outcome. We will route the complaint and assist it as processor under the DPA.

You may complain to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, telephone 0303 123 1113. You do not have to complete our process first, although allowing the relevant controller to investigate may resolve the issue sooner.

Organisations should use the ICO's current data-protection complaints guidance.

17. Customer GDPR checklist

Before and during use of CertFlow, a Customer should be able to evidence that it has:

• Mapped roles and data flows. Identify each controller, joint controller, processor, recipient, integration, export and international access path.
• Defined purposes and necessity. Record why each category and field is needed; remove speculative or duplicative collection.
• Selected lawful bases. Document an Article 6 basis for every purpose and any Article 9, Article 10 or DPA 2018 Schedule 1 condition. Do not use recognised legitimate interests outside its five conditions.
• Provided privacy information. Tell staff, contractors, clients, portal users and other people what is collected, why, who receives it, how long it is kept, transfer safeguards and how to exercise rights.
• Put contracts in place. Accept the CertFlow DPA, approve subprocessors through the agreed mechanism, and use appropriate contracts for its own processors, sharing and joint-controller arrangements.
• Configured least privilege. Assign the minimum roles and client-portal visibility, review administrators, remove leavers and test that sensitive or public data is separated.
• Set retention and deletion rules. Apply schedules to CertFlow records, files, exports, devices and connected systems; preserve only justified legal holds.
• Prepared for rights and complaints. Train staff to recognise requests, search all relevant systems, meet amended SAR rules, restrict data where needed and run the DUAA complaint process.
• Prepared for incidents. Define reporting lines, containment, evidence, risk assessment, 72-hour escalation and communication; ensure users know how to contact CertFlow.
• Assessed high-risk processing. Complete and maintain DPIAs before large-scale sensitive processing, monitoring, significant automated decisions, novel technology or other likely high-risk use.
• Kept human responsibility. Verify reports, scores, matches, compliance statuses and generated outputs; do not let software make an unreviewed significant decision.
• Trained and audited. Provide role-appropriate training, confidentiality obligations, periodic access/record reviews and evidence that written controls are followed.
• Reviewed children's and vulnerable-person risks. Apply higher protection, safeguarding, transparency and access measures wherever those groups' data is processed.
• Reviewed transfers and providers. Check current subprocessor locations, adequacy or safeguards, transfer risk assessments and any Customer-initiated overseas access.

18. Official sources and further guidance

Official guidance explains the law but does not decide every Customer's facts. Industry rules, employment law, health-and-safety duties, professional standards and contractual record requirements may affect a Customer's purpose and retention analysis without overriding data-protection law.

If there is a conflict between this explanatory statement and mandatory law, the law prevails. Binding obligations between CertFlow and a Customer are set out in the Terms & Conditions, applicable Order and DPA.

19. Changes and contact

We review this statement as our Service, providers, controls, law and ICO guidance change. We will publish revisions with a new “Last updated” date. A material change to our controller processing will also be reflected in the Privacy Policy and notified through an appropriate additional channel where required.

Questions about this statement, rights requests, complaints and data-incident reports may be sent to info@certflow.co.uk, telephoned to 0114 392 2407, or posted to CertFlow LTD, 20 Wenlock Road, London, N1 7GU.