Privacy notice

This service is provided by The ASCP Group Limited, trading as the Association of Safety and Compliance Professionals (ASCP), registered at Belvedere House, Basing View, Basingstoke, RG21 4HG. We are registered with the Information Commissioner's Office under number ZA642936.

This notice explains how we handle personal data in connection with the service. It applies to users of the service and, where we act as a processor, to the personal data our customers record in it.

It does not form part of any contract and does not vary the terms of any agreement between us and a customer. Where this notice and a written agreement differ, the agreement prevails.

Enquiries about this notice should be addressed to members@theascp.co.uk.

We are the controller of personal data relating to users of the service, including account details, role and permissions, and records of activity within the service.

Where a customer records information in the service about its properties and their occupants, the customer is the controller of that information and we act as its processor. We process that information only on the customer's documented instructions and in accordance with our written agreement with it, and not for our own purposes.

The customer remains responsible for determining the lawful basis for its processing, for the accuracy and relevance of what it records, for the content of any images or documents it uploads, and for responding to requests from its own tenants and occupants. We will provide reasonable assistance with such requests as our agreement provides.

An occupant who wishes to know what information is held about their home should contact their landlord.

Where we act as controller, we process:

name, email address, employer or organisation, job role and permissions;

records of activity within the service, including assessments created or amended, statutory positions recorded, remedial actions assigned and evidence uploaded, together with the date and time and the account responsible;

authentication and technical data necessary to operate the service securely, including sign-in events and session information.

Activity records form the audit trail of the service and are retained as described below.

Where we act as processor, the service may hold:

property addresses and, where supplied, the customer's own property reference and the Unique Property Reference Number;

the findings of an assessment, including the condition of the property, hazards identified, scores, judgements and supporting reasoning;

photographs and documents uploaded as evidence;

where a statutory regime applies, information about the circumstances of the household relevant to the duty, which may include information about health. Such information may constitute special category data within the meaning of Article 9 of the UK GDPR.

The service is not designed to hold the names, contact details or tenancy records of occupants, and we do not require them. Evidence is intended to record the condition of a property. The customer is responsible for ensuring that it records only what is necessary for its purposes and that any image or document it uploads is appropriate for that purpose.

Where we act as controller in respect of users, we rely on:

the performance of a contract with the user or with the user's organisation, or the taking of steps at their request prior to entering into a contract;

our legitimate interests in operating, securing, supporting and improving the service and in maintaining a reliable audit trail, where we have assessed that those interests are not overridden by the interests or fundamental rights of the individual;

compliance with our legal obligations, where applicable.

Where we act as processor, the lawful basis is determined by the customer as controller.

Where we send marketing communications, we do so with consent and a recipient may withdraw that consent at any time.

Access within a customer's organisation is controlled by that customer through the permissions it assigns.

We engage sub-processors in the following categories, each under a written contract imposing obligations equivalent to those described in this notice:

application and database hosting;

authentication and account management;

transactional email delivery;

address and property reference lookup, where that feature is used.

Each sub-processor is identified by name to our customers under their written agreement with us. A current list is provided on request to a customer or its auditors, and is not published.

We may also disclose personal data to our professional advisers where necessary, and to a third party in connection with a merger, acquisition or reorganisation of our business.

We may disclose personal data where required to do so by law or by a competent authority. Where we are permitted to notify the affected party, we will do so.

Changes to our sub-processors are notified to customers in accordance with our written agreement with them.

The application, the database and uploaded evidence are hosted within the European Economic Area.

Where a sub-processor processes personal data outside the United Kingdom, we rely on the safeguards required by applicable data protection law, which may include an adequacy decision, the International Data Transfer Agreement, or the UK Addendum to the European Commission's standard contractual clauses.

Where we act as processor, assessment records and associated evidence are retained for the duration of the customer's subscription and for a period of seven years following its termination, unless a different period is agreed in writing or the customer instructs deletion in accordance with our agreement. That period reflects the periods within which a landlord may be required to evidence its compliance and within which a claim may be brought.

Where we act as controller, user account data is retained while the account remains active. Records of activity are retained with the assessment records to which they relate, as their evidential value depends on their completeness.

We will give the customer a reasonable opportunity to export its data before the end of an applicable retention period.

We may retain personal data for longer where required by law or where necessary for the establishment, exercise or defence of legal claims.

We implement appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage, having regard to the state of the art, the costs of implementation and the nature, scope, context and purposes of processing.

Those measures include access control by account and by organisation, encryption of data in transit, restriction of access to evidence to users entitled to it, and the maintenance of audit records.

No method of transmission or storage is entirely secure, and we do not warrant absolute security. Where we are required to notify a personal data breach to the Information Commissioner's Office or to an affected individual, we will do so within the period required. Where we act as processor, we will notify the customer without undue delay on becoming aware of a personal data breach affecting its data.

Subject to the conditions and exemptions in applicable data protection law, an individual has the right to request access to their personal data, its rectification or erasure, the restriction of its processing, its portability, and to object to processing carried out on the basis of legitimate interests. Where processing is based on consent, that consent may be withdrawn.

Requests concerning personal data for which we are the controller should be sent to members@theascp.co.uk. We will respond within one month of receipt, and may extend that period by up to two further months where a request is complex or where a number of requests have been received, in which case we will inform the requester within one month.

We may request information reasonably necessary to verify identity before responding.

Where the personal data is processed by us as a customer's processor, the request should be directed to that customer as controller.

The service uses only those cookies which are strictly necessary for its operation, being cookies that maintain an authenticated session and protect the security of that session. It does not use advertising cookies and does not track users across other websites.

A complaint about our handling of personal data may be made to members@theascp.co.uk, and we will investigate it.

An individual also has the right to lodge a complaint with the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, at ico.org.uk, or by telephone on 0303 123 1113.

We may amend this notice from time to time. The version number and the date from which the current version applies are shown at the head of this page, and the notice as published here is the current version.

Where an amendment is material and we act as controller, we will take reasonable steps to notify affected users.