Privacy Policy

1. Who We Are

The data controller responsible for the processing of personal data described in this Privacy Policy is:

Eurocert Inspection Services Pvt. Ltd.
Registered/Head Office:
304, Mid Town Tower, Peer Muchalla,
Panchkula, Haryana – 134109, India
Telephone: +91 9316012883
Email: info@eurocert.in

Eurocert Asia is affiliated with Eurocert S.A., Athens, Greece, which forms part of the wider Eurocert network. Depending on the particular service or processing activity, another Eurocert group entity may have a role in processing personal data. Where this occurs, the applicable responsibilities will be determined in accordance with the relevant contractual and legal arrangements.

2. Scope of This Privacy Policy

This Privacy Policy applies to personal data collected or processed through:

• Our website;
• Directly from you when you use our website chatbot or other online chat tools to submit an enquiry, including your name, telephone number, email address and any other information you choose to provide;
• Contact and enquiry forms;
• Certification and inspection enquiries;
• Audit and assessment activities;
• Training registration and related activities;
• Client and prospective-client communications;
• Business communications;
• Complaints, appeals and grievance submissions;
• Recruitment or career enquiries, where applicable;
• Cookies and similar technologies; and
• Other interactions with Eurocert where this Privacy Policy is provided or referenced.

This Privacy Policy does not necessarily apply to processing performed by third parties independently of Eurocert. Such third parties may have their own privacy policies.

3. What Is Personal Data?

"Personal data" means information relating to an identified or identifiable individual.

Depending on how you interact with Eurocert, this may include:

• Full name;
• Business or personal email address;
• Telephone or mobile number;
• Company or organisation name;
• Job title or professional information;
• Information contained in enquiries or correspondence;
• Information provided in certification, audit or inspection-related communications;
• Information submitted through grievance or complaint forms;
• Information relating to training or registration;
• Browser and device information;
• Website usage information;
• Cookie identifiers and similar online identifiers;
• Information contained in documents provided to us; and
• Other information that you voluntarily provide to us.

We aim to collect only personal data that is relevant and reasonably necessary for the relevant purpose.

4. How We Collect Personal Data

We may collect personal data:

• Directly from you when you complete a form or contact us;
• When you request certification, inspection, audit, training or other services;
• When you communicate with our employees, auditors, assessors or representatives;
• When you submit documents or information required for a service;
• Automatically when you use our website, including through cookies and similar technologies;
• From your organisation or employer where you are participating in a business or certification relationship; and
• From third parties where permitted by applicable law and necessary for providing our services.

5. Purposes for Which We Process Personal Data

We may process personal data for the following purposes:

5.1 Providing Our Services

To:

• Respond to enquiries;
• Provide certification, inspection, audit and assessment services;
• Manage client relationships;
• Process applications and requests;
• Arrange audits, inspections, assessments and training;
• Communicate with clients and prospective clients;
• Issue and manage certificates and related records;
• Maintain service and certification records; and
• Provide technical or administrative support.

5.2 Business Communications

We may use contact information to communicate with you regarding:

• Your enquiry;
• Requested services;
• Existing business relationships;
• Service updates;
• Certification or audit activities;
• Administrative matters; and
• Other communications relevant to our relationship.

Where marketing communications require consent under applicable law, we will obtain the necessary consent.

5.3 Legal and Regulatory Compliance

We may process personal data where necessary to:

• Comply with applicable laws and regulations;
• Meet accreditation requirements;
• Respond to lawful requests from competent authorities;
• Maintain required records;
• Establish, exercise or defend legal claims; and
• Detect, prevent or investigate fraud, misuse or security incidents.

5.4 Website Operation and Security

We may process technical information to:

• Operate and maintain the website;
• Protect website security;
• Detect malicious or unauthorised activity;
• Troubleshoot technical problems;
• Monitor website performance; and
• Improve website functionality.

6. Legal Bases for Processing Under the GDPR

Where the GDPR applies, we process personal data only where an appropriate legal basis exists.

Depending on the circumstances, the legal basis may include:

6.1 Consent

We may process personal data where you have provided valid consent.

You may withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

6.2 Contract

Processing may be necessary to enter into or perform a contract with you or your organisation.

For example, this may apply when processing information necessary to provide certification, inspection, audit or training services.

6.3 Legal Obligation

We may process personal data where processing is necessary to comply with a legal or regulatory obligation applicable to Eurocert.

6.4 Legitimate Interests

We may process personal data where necessary for our legitimate interests, provided that those interests are not overridden by your fundamental rights and freedoms.

Examples may include:

• Managing business relationships;
• Maintaining information security;
• Preventing fraud or misuse;
• Protecting our systems and services;
• Improving our services; and
• Establishing or defending legal claims.

Where we rely on legitimate interests, we will consider the impact of the processing on individuals and apply appropriate safeguards.

6.5 Vital Interests

Where applicable, personal data may be processed where necessary to protect someone's vital interests.

6.6 Public Task

Where applicable, processing may be carried out where necessary for the performance of a task carried out in the public interest or in the exercise of official authority.

7. Data Minimisation

We follow the principle of data minimisation.

This means that we seek to collect and process personal data that is:

• Adequate;
• Relevant; and
• Limited to what is necessary for the purposes for which it is processed.

We do not intentionally collect unnecessary personal information through our website.

8. Accuracy of Personal Data

We take reasonable steps to ensure that personal data we process is accurate and, where necessary, kept up to date.

You may contact us if you believe that information we hold about you is inaccurate or incomplete.

9. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including where necessary to:

• Provide requested services;
• Maintain certification, audit or inspection records;
• Comply with legal, regulatory or accreditation requirements;
• Resolve disputes;
• Establish or defend legal claims;
• Maintain business records; or
• Enforce our agreements.

Different categories of information may be retained for different periods.

When personal data is no longer required, we will delete, securely destroy, or anonymise it, subject to applicable legal, regulatory and accreditation requirements.

Specific retention periods should be documented in Eurocert's internal data-retention schedule.

10. Sharing of Personal Data

We do not sell or rent personal data.

We may disclose personal data where necessary and lawful to:

• Eurocert group companies or affiliated entities;
• Auditors, inspectors, assessors and technical experts;
• Accreditation bodies;
• Certification scheme owners;
• Regulatory authorities and government bodies;
• Professional advisers;
• IT, hosting, security and technical service providers;
• Communication and email service providers;
• Other service providers acting on our behalf; and
• Courts, law-enforcement authorities or other competent authorities where legally required.

Where third parties process personal data on our behalf, we seek to ensure that appropriate contractual and organisational safeguards are in place as required by applicable law.

We will not disclose personal data to third parties for unrelated purposes unless permitted or required by law.

11. International Transfers

Eurocert operates in an international business environment and may work with clients, auditors, certification bodies, accreditation organisations and service providers located in different countries.

Where personal data subject to the GDPR is transferred outside the European Economic Area ("EEA"), we will take appropriate steps to ensure that the transfer is carried out in accordance with applicable data-protection law.

Depending on the circumstances, this may include:

• An adequacy decision adopted by the European Commission;
• Standard Contractual Clauses approved by the European Commission;
• Binding Corporate Rules, where applicable;
• Another lawful transfer mechanism recognised under applicable law; or
• A permitted derogation for specific circumstances.

Information concerning the specific transfer mechanism may be provided upon request where required by applicable law.

12. Data Security

Eurocert takes reasonable and appropriate technical and organisational measures to protect personal data against:

• Unauthorised access;
• Unauthorised disclosure;
• Accidental loss;
• Destruction;
• Alteration;
• Unauthorised processing; and
• Other unlawful or accidental forms of processing.

Depending on the nature and risk of the processing, security measures may include:

• Access controls;
• Authentication controls;
• Role-based access;
• Security monitoring;
• Data backup;
• Network and system security;
• Encryption or pseudonymisation where appropriate;
• Secure transmission mechanisms;
• Staff confidentiality obligations;
• Security policies and procedures;
• Vulnerability and security management; and
• Incident response procedures.

No method of transmission or storage can be guaranteed to be completely secure. However, we continuously seek to maintain appropriate safeguards based on the risks associated with our processing activities.

13. Privacy by Design and by Default

Where appropriate, Eurocert seeks to consider data-protection and privacy requirements when designing or implementing systems, processes and services.

This may include:

• Data minimisation;
• Access restrictions;
• Appropriate security controls;
• Limited retention;
• Privacy-conscious configuration; and
• Appropriate technical and organisational safeguards.

14. Cookies and Similar Technologies

Our website may use cookies and similar technologies.

Cookies may be used for purposes such as:

• Website functionality;
• Security;
• Remembering preferences;
• Analytics;
• Performance monitoring; and
• Other website-related purposes.

Where required by applicable law, non-essential cookies and similar technologies will be used only after obtaining the appropriate consent.

You may manage cookie preferences through the cookie-consent mechanism provided on the website and, where applicable, through your browser settings.

Please note that disabling certain cookies may affect website functionality.

Eurocert should maintain a separate Cookie Policy/Cookie Notice identifying the actual cookies, providers, purposes, duration and legal basis used on the website.

15. Your Data Protection Rights

Where the GDPR applies, you may have the following rights, subject to applicable legal conditions and exceptions:

Right of Access

You may request confirmation as to whether we process your personal data and, where applicable, request access to that data.

Right to Rectification

You may request correction of inaccurate or incomplete personal data.

Right to Erasure

You may request deletion of personal data in circumstances where the GDPR provides a right to erasure.

This right is not absolute. We may be required to retain certain information to comply with legal, regulatory, contractual or accreditation obligations.

Right to Restriction of Processing

You may request restriction of processing in circumstances provided by applicable law.

Right to Data Portability

Where applicable, you may request certain personal data in a structured, commonly used and machine-readable format and request its transmission to another controller where the legal requirements are satisfied.

Right to Object

You may object to certain processing based on your particular circumstances, including processing based on legitimate interests.

You have an absolute right to object to processing of your personal data for direct marketing purposes.

Right to Withdraw Consent

Where processing is based on consent, you may withdraw your consent at any time.

Withdrawal does not affect processing carried out lawfully before the withdrawal.

Rights Relating to Automated Decision-Making

Where applicable, you may have rights concerning decisions based solely on automated processing, including profiling, where such decisions produce legal or similarly significant effects.

Eurocert will provide applicable safeguards where such processing falls within the relevant GDPR provisions.

16. How to Exercise Your Rights

To exercise your privacy rights, contact:

Data Protection / Privacy Contact
Eurocert Inspection Services Pvt. Ltd.
304, Mid Town Tower, Peer Muchalla,
Panchkula, Haryana – 134109, India
Email: info@eurocert.in

Please provide sufficient information to allow us to identify you and understand your request.

We may need to request additional information to verify your identity before processing certain requests.

We will respond to valid requests within the timeframe required by applicable data-protection law.

17. Complaints

If you have concerns regarding how Eurocert processes your personal data, we encourage you to contact us first so that we can investigate and address your concern.

You may also have the right to lodge a complaint with the competent data-protection supervisory authority in accordance with applicable law.

Where the GDPR applies, you may generally lodge a complaint with a supervisory authority, particularly in the EU Member State of your habitual residence, place of work, or where you believe an infringement occurred.

18. Personal Data Breaches

Eurocert maintains procedures for identifying, assessing, responding to and documenting personal-data incidents.

Where a personal-data breach occurs, we will assess the incident and take appropriate corrective and mitigation measures.

Where required by the GDPR, Eurocert will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of the breach, unless the breach is unlikely to result in a risk to the rights and freedoms of individuals.

Where a breach is likely to result in a high risk to individuals' rights and freedoms, we will communicate the breach to affected individuals where required by applicable law.

19. Special Categories of Personal Data

Certain categories of personal data receive additional protection under the GDPR, including health data, genetic data, biometric data used for identification, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and information concerning sex life or sexual orientation.

Eurocert does not intentionally request special-category personal data through its general website contact forms unless it is necessary for a specific legitimate business, certification, audit, inspection, legal or regulatory purpose.

Where special-category personal data is processed, we will apply the additional legal requirements and safeguards applicable to such processing.

20. Children's Privacy

Our website and professional services are primarily intended for businesses, professionals and organisations.

We do not knowingly collect personal data from children for purposes that are inappropriate or unlawful.

If you believe that a child has provided personal data to us without appropriate authorisation, please contact us so that we can investigate and take appropriate action.

21. Third-Party Websites

Our website may contain links to external websites, platforms or services.

Eurocert is not responsible for the privacy practices, security, content or policies of third-party websites.

We recommend reviewing the privacy policy of any external website before providing personal information.

22. Third-Party Service Providers

We may use third-party service providers to support the operation of our website and business activities.

Depending on the services used, these providers may provide:

• Website hosting;
• Cloud infrastructure;
• Email services;
• Security services;
• Analytics;
• Communication services;
• Website maintenance;
• Document management; or
• Other technical or professional services.

Where a third party processes personal data on our behalf, we will take appropriate steps to ensure that the processing is governed by appropriate contractual and security safeguards where required by applicable law.

The website owner should maintain an internal register of processors and service providers and update this section where public disclosure is appropriate.

23. Data Protection Officer / Privacy Contact

Where Eurocert is legally required to appoint a Data Protection Officer ("DPO"), the DPO or designated privacy contact can be contacted at:

Email: info@eurocert.in

Any DPO designation, representative details, or additional contact details required by applicable law should be added here once formally confirmed.

24. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• Changes in our services;
• Changes to our processing activities;
• Changes in applicable laws or regulations;
• Changes in technology; or
• Changes to our privacy and security practices.

The updated version will be published on this page with a revised "Last Updated" date.

Where required by applicable law, we will provide additional notice or obtain consent for material changes.

25. Contact Us

If you have questions about this Privacy Policy, our data-processing practices, or your privacy rights, please contact us.

Eurocert Inspection Services Pvt. Ltd.
304, Mid Town Tower, Peer Muchalla,
Panchkula, Haryana – 134109, India
Phone: +91 9316012883
Email: info@eurocert.in
Website: https://www.eurocert.asia/