|
Revisions: |
||
|
Date: |
Author: |
Description: |
|
March 2020 |
Emma Philpott |
First Version Published |
|
September 2022 |
Emma Philpott |
Revision of clause 5 Retention Periods to align with current operating practice. Replacement of Her Majesty’s Revenue and Customs (HMRC) with His Majesty’s Revenue and Customs (HMRC). |
|
February 2025 |
Wendy Reeves |
Replaced IASME Governance with IASME Cyber Assurance. |
1 Categories of Data Subject
(i) Business contacts who are:
a. Assessors for Cyber Essentials and the IASME Cyber Assurance.
b. Businesses undertaking assessment for certification of Cyber Essentials and IASME Cyber Assurance.
2 Purpose of the Processing
The processing is for the following purposes (specified by Us only):
(i) All data is held based on the performance of a contract.
3 Means of Processing
The processing will involve the following practical, technical, administrative steps/activities/methodologies etc
(i) Management of the Cyber Essentials and /or IASME Cyber Assurance certification process.
(ii) Management of invoices and payments.
(iii) Management of the Certification Body licences
4 Categories of Personal Data
The following categories of personal data will be processed {NB take particular care to identify any personal data that might fall within the scope of the processing and which falls within the definition of ‘special categories’ of personal data and data relating to criminal convictions etc referred to in article of the GPDR as this will need additional protections and additional justification for processing} –
(i) Name
(ii) Business Contact Details
a. Address
b. Telephone Number
c. Email
(iii) IP Address details
5 Retention Periods
The following retention periods will apply to the respective categories of personal data (at the end of which they will be deleted):-
(i) Before submission assessment answers, comments and attachments are retained online in Pervade for up to 6 months from date of application (sometimes longer when applicant or CB requests).
(ii) After submission assessment answers and comments are retained in Pervade for 18 months from date of last report run.
(iii) Certificate data (including applicant contact email) is stored in BlockMark and CRM indefinitely.
(iv) Invoice and payment data will be retained for 6 years plus the current financial year, in line with the requirements of His Majesty’s Revenue and Customs (HMRC).
(v) Certification Body licence data will be retained for 2 years after the end of Certification Body Contract.
6 Contact Details
The Parties will use the following contacts for discussions or questions about processing under this agreement:-
IASME : Chris Pinder [email protected]