1. About this policy
This document describes the privacy practices of AFE Certification Limited in plain English. It is written so that a client, a supplier or a visitor can understand what happens to personal data without needing a legal dictionary. Where the policy refers to personal data, it means any information that relates to an identified or identifiable living person. The policy does not cover information about companies or equipment, although such information often sits beside personal data in the same certification file.
The bureau publishes this policy because certification work depends on trust. A client who sends a design record to Charlotte House should know who sees it, how it is stored and how long it remains on file. The policy is reviewed at least once a year and whenever the bureau changes a process that affects personal data. The date shown at the top of the page tells you when the current version took effect.
2. Who we are and how to reach us
The data controller is AFE Certification Limited, a company operating a stamp bureau that issues conformity ring audits, register entries, stamp plate runs, site visit certificates, renewal mark checks and discrepancy hearings. The bureau works from Charlotte House, 500 Charlotte Road, Sheffield - S2 4ER, United Kingdom (GB). The developer name associated with the digital services of the bureau is AFE Certify.
For any question about this policy, a request about personal data, or a concern about how a record has been handled, write to certify@afecertify.hair or telephone +12233022423 during the published business hours. Letters may be addressed to the data protection contact at the Charlotte House address shown above. We aim to acknowledge every written privacy request within two working days and to give a substantive reply within one calendar month, unless the request is unusually complex.
3. Scope of this policy
This policy applies to personal data processed through the website at afecertify.hair, through correspondence with the contact desk, through certification files opened at Charlotte House, through site visits carried out by bureau officers, and through the maintenance of the certification register. It also applies to records created when a certificate is issued, renewed or corrected by a hearing.
The policy does not apply to third party services that you may reach from links on this website, and it does not apply to personal data that a client holds in their own systems. If you are an employee or contractor of the bureau, separate internal notices describe how your employment records are handled. If you are applying for a role and send a curriculum vitae, the recruitment notice provided at that time governs the handling of your application.
4. Personal data we collect
The bureau collects only the personal data it needs to perform certification work and to respond to enquiries. The categories are set out below, and not every category applies to every person.
Contact details
Name, job title, organisation, email address, telephone number and postal address. These details are needed to open a file, to arrange an appointment and to send certificates and renewal notices. Where a client provides a shared mailbox, the bureau records the name of the responsible officer so that correspondence can be directed correctly.
Correspondence
The content of emails, letters, telephone notes and meeting records. The contact desk keeps short written notes of conversations so that a file can be understood by a colleague without repeating the discussion with the client. Notes are factual and avoid commentary about individuals.
Certification records
The design record submitted for audit, the workbook page produced by the auditor, the register line assigned by the desk, plate proof cards, visit photographs and hearing findings. These records may contain the names and signatures of the officers who performed the work, and they may contain the name of the client representative who accepted the certificate.
Financial records
Invoices, purchase order references and payment confirmations. The bureau does not store full payment card numbers on its own systems. Where card payment is offered, it is handled by a regulated payment provider, and the bureau retains only the reference needed to reconcile the transaction.
Website technical data
Internet protocol address, browser type, operating system, referring page and the pages visited during a session. This data is recorded in standard server logs and is used to keep the website available and secure. The contact form on this website does not store your message on the server, because it prepares an email in your own application instead.
5. Where the data comes from
Most personal data comes directly from you, whether you type it into the contact form, send it by email, provide it during a telephone call or hand it over at an appointment. Some data comes from the organisation that employs you, when a colleague opens a file on behalf of a team and lists you as the responsible contact.
A small amount of data comes from public registers or from the documents that accompany a certification file, such as supplier lists and approved signatory records. Field officers record observations that may include the name of a person present during a site visit. Where a third party provides personal data about you, the bureau will tell you the source when you ask, unless the law prevents that disclosure.
6. Why we use personal data
The bureau uses personal data to open and manage certification files, to carry out ring audits and site visits, to assign register marks, to produce and proof stamp plates, to issue certificates, to run renewal checks and to conduct discrepancy hearings. It also uses the data to answer enquiries, to arrange appointments, to send invoices and to keep the register accurate over time.
Beyond the direct delivery of services, the bureau uses personal data for internal quality work. Files may be sampled to check that audits are consistent, that register entries are transcribed correctly and that hearing findings are recorded in the required form. Quality sampling is carried out by officers who are bound by confidentiality, and the results are used to improve the process rather than to judge the individuals named in a file.
The bureau also uses personal data to meet legal obligations, such as maintaining company records, responding to lawful requests from a regulator and retaining documents for the periods required by tax and corporate law. Where a certificate is used in a dispute, the register and the records behind it may be produced as evidence, and the names of the officers who issued the mark may be relied upon in that context.
7. Lawful bases for processing
The bureau relies on a small number of lawful bases, chosen to match the purpose of each activity. Where the bureau performs a certification service for a client, processing is necessary for the performance of a contract with that client or for steps taken at the request of the client before a contract is formed.
Where the bureau keeps the register accurate, protects the value of a mark or conducts quality sampling, it relies on its legitimate interests as a certification body. Those interests are weighed against the rights of the people named in a file, and the bureau limits the data it keeps to what is needed for the register to remain trustworthy. You may ask for an explanation of the balancing exercise, and the bureau will provide one in writing.
Where the bureau responds to a legal requirement, relies on the lawful basis of compliance with a legal obligation. Where a person has given clear consent for an optional communication, such as a periodic renewal reminder sent by email, the bureau relies on that consent and will stop the communication as soon as it is withdrawn. Consent is never bundled with a contract, and you will not be refused a certificate because you decline an optional message.
8. Certification and register data
The register is the long memory of the bureau, and it is deliberately durable. A register line records the mark, the date, the scope of the certificate, the officer who accepted the finding and any renewal or correction. Because the register exists to be read years after a project closes, the names of the officers and the responsible client contact may remain visible long after the certificate was first issued.
The bureau treats this longevity as a feature rather than an oversight. A mark that cannot be traced back to a named officer is of little use in a dispute, and a certificate that has lost its history cannot be relied upon by a procurement team. At the same time, the bureau limits the personal data in the register to what is needed for traceability, and it does not add contact details, salaries or performance notes to a register line.
Extracts of a register line are issued to the holder on request. Where an extract is shared with a third party, the bureau confirms that the holder has authorised the request. A hearing finding is treated as part of the register and is visible to anyone who reads the file, because the credibility of the register depends on corrections being as visible as approvals.
9. Site visits and field records
A site visit certificate records the conditions found on the day, and that record may include the name of the person who accompanied the officer, the time of arrival and notes about access. Photographs taken during a visit are intended to show the ring, the enclosure and the label, not the people present, and the officer is instructed to avoid capturing individuals where possible.
Where a photograph unavoidably includes a person, the image is used only for the certification record and is not published. If you are present during a visit and would prefer not to appear in a photograph, tell the officer at the time, and the officer will note the request and frame the image accordingly. Field notes are kept with the file for the life of the certificate and are subject to the same retention rules described later in this policy.
11. Website analytics and logs
The bureau keeps routine server logs so that the website remains available and secure. Logs record the internet protocol address, the browser and operating system, the page requested and the time of the request. They are used to diagnose faults, to detect abusive traffic and to understand which pages are visited, and they are not used to build profiles of individual visitors.
Where the bureau uses a privacy conscious analytics service, the service is configured to avoid tracking individuals across websites and to avoid collecting more detail than is needed to count visits. Log data is kept for a short period unless it is needed to investigate a security incident, in which case the relevant entries are retained until the matter is closed.
The bureau does not sell website data, does not share it with advertising networks and does not allow third party tracking pixels to run on this site. If you send an email to the contact desk, the content of that email is treated as correspondence rather than as website analytics.
13. Service providers and processors
The bureau uses a small number of service providers to run its operations, including email hosting, file storage, accounting software and website hosting. These providers act on the instructions of the bureau and are bound by written terms that require them to protect personal data and to use it only for the service they provide.
Before a provider is engaged, the bureau checks that the provider applies appropriate security measures and that it can support the rights of the people whose data it handles. Providers are reviewed periodically, and a provider that no longer meets the required standard is replaced. Where a provider is located outside the United Kingdom, the transfer is protected by an appropriate mechanism described in the next section.
14. International transfers
The bureau is based in Sheffield and normally stores certification records within the United Kingdom. Where a service provider stores data outside the United Kingdom, the bureau ensures that the transfer is covered by an adequacy decision or by standard contractual clauses approved for that purpose. The bureau also carries out a short transfer risk assessment before any new provider is engaged.
If you would like to know which mechanism applies to a particular provider, write to the data protection contact at certify@afecertify.hair. The bureau will explain the safeguard and, where appropriate, provide a copy of the relevant clauses. Transfers are never made simply because a provider offers a lower price, and the bureau will not move certification records to a jurisdiction where the safeguards cannot be maintained.
15. How long we keep records
Retention periods are set to reflect the purpose of each record. General enquiries that do not lead to a file are kept for twelve months so that the contact desk can follow up a conversation. Files that lead to a certificate are kept for the life of the certificate and for a further period that reflects the durability of the register, because a mark may need to be traced long after the project has closed.
Financial records are kept for the period required by tax and corporate law. Hearing findings are kept for as long as the register line to which they relate remains open. Server logs are kept for a short period unless they are needed to investigate a security incident. When a retention period ends, records are deleted or, where deletion is not practical, anonymised so that they can no longer be linked to a person.
If you ask the bureau to delete personal data, the bureau will do so where the law allows, but it may need to keep the minimum record required for the register to remain reliable. In that case the bureau will explain what is kept and why, and it will remove the rest.
16. How we protect personal data
The bureau applies technical and organisational measures that are appropriate to the sensitivity of certification records. Access to the register is restricted to named officers, protected by individual accounts and reviewed when a role changes. Files are stored on systems that are kept up to date with security patches, and backups are tested so that a record can be restored if a system fails.
Physical records at Charlotte House are kept in locked storage, and the plate room is separated from the public areas of the building. Staff receive training on data protection and on the handling of client material, and they are bound by confidentiality terms that continue after they leave the bureau. If a personal data breach occurs, the bureau will assess the risk, notify the regulator where required and inform affected people where the risk is high.
17. Your rights
You have the right to be informed about how your personal data is used, which is the purpose of this policy. You have the right of access, which means you can ask for a copy of the personal data the bureau holds about you. You have the right to rectification, so that inaccurate data can be corrected, and the right to erasure in circumstances where the bureau no longer needs the data and is not required by law to keep it.
You also have the right to restrict processing, the right to object to processing based on legitimate interests, and the right to data portability where the processing is based on consent or on a contract and is carried out by automated means. Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of the processing that took place before the withdrawal.
To exercise a right, write to certify@afecertify.hair with enough detail for the bureau to identify you and the record concerned. The bureau may ask for proof of identity before releasing data, because the register contains information that must not be disclosed to the wrong person. There is normally no charge, although a reasonable fee may apply where a request is manifestly unfounded or repetitive.
18. Marketing and communications
The bureau does not send marketing campaigns. The messages it sends are operational: an acknowledgement of an enquiry, an appointment confirmation, a certificate issue notice, a renewal reminder or a hearing notification. These messages are part of the service and are sent to the contact details recorded in the file.
If the bureau ever introduces an optional newsletter, it will be offered with a clear opt in and an easy way to opt out in every message. Declining the newsletter will never affect a certification file, an appointment or a renewal check. You can ask the bureau to stop sending any non essential message at any time by replying to the email or by writing to the contact desk.
19. Privacy for children
The services of the bureau are intended for businesses and professional organisations, and this website is not directed at children. The bureau does not knowingly collect personal data from a child in the course of normal operations. If a site visit record happens to include a young person who is present at an installation, the officer records only what is needed for the certification and avoids using the image for any other purpose.
If you believe that a child has sent personal data to the bureau, contact the desk at certify@afecertify.hair and the bureau will remove the data promptly unless it is required for a certification record. In that exceptional case, the bureau will explain what must be kept and will limit the record to the minimum necessary.
20. Automated decisions and profiling
The bureau does not make automated decisions that produce legal effects for an individual, and it does not build profiles for marketing or scoring purposes. Ring audits, register entries and renewal checks are performed or reviewed by a named officer, and a discrepancy hearing always includes a human chair who issues the written finding.
Software is used to support the work, for example to format a register entry or to prepare a plate file, but the decision to issue, renew or withdraw a mark rests with an officer. If the bureau adopts a tool that assists an officer in a way that could affect an individual, the tool will be described in this policy and a human review will remain available on request.
21. Links to other websites
This website may contain links to websites operated by other organisations, for example a supplier portal or a regulator page. The bureau does not control those websites and is not responsible for their privacy practices. When you follow a link, read the privacy notice of the site you reach before providing personal data.
The bureau does not endorse a third party by linking to it, and a link does not mean that the third party is certified or approved by the bureau. If you are unsure whether a site belongs to the bureau, check that the address ends with afecertify.hair and that the page carries the wax seal of the bureau.
22. Changes to this policy
The bureau reviews this policy at least once a year and whenever a process changes. When a change is material, the bureau will update the date at the top of the page and, where the change affects an active file, will notify the contact recorded in that file. Minor clarifications will be made without a separate notice, but the current version will always be available on this page.
The bureau keeps previous versions of this policy for a reasonable period so that a client can see what applied at the time a certificate was issued. If you need a copy of an earlier version, write to the contact desk and the bureau will provide the version that was in force on the date you specify.
23. Complaints and regulatory contact
If you are unhappy with how the bureau has handled your personal data, please contact the data protection contact at certify@afecertify.hair before making a formal complaint, because most concerns can be resolved quickly once the file is reviewed. The bureau will explain what it has found and, where a correction is needed, will make it in the register as well as in the internal record.
You also have the right to complain to the Information Commissioner Office, the supervisory authority for data protection in the United Kingdom. The bureau will cooperate fully with any inquiry and will provide the records that the regulator requires. A complaint to the regulator does not prevent you from also raising the matter with the bureau, and the bureau will continue to answer your questions during the process.
24. Contacting the bureau
For any privacy question, write to AFE Certification Limited at Charlotte House, 500 Charlotte Road, Sheffield - S2 4ER, United Kingdom (GB), send an email to certify@afecertify.hair or telephone +12233022423. The contact desk is staffed Monday to Thursday from 09:00 to 17:00 and Friday from 09:00 to 16:00.
This policy is issued by AFE Certification Limited and is published for the digital services developed under the name AFE Certify. It is written in England and is governed by the laws of England and Wales. Thank you for taking the time to read it, and for the care you take with the records that pass through the bureau.
Controller: AFE Certification Limited
Charlotte House, 500 Charlotte Road, Sheffield - S2 4ER, United Kingdom (GB)
Email: certify@afecertify.hair Telephone: +12233022423