Privacy Policy – CERTIFICATO IWZ

1.1 CERTIFICATO IWZ – FZCO (main certification body)

Data Controller for international certification activities and the main website

Name: CERTIFICATO IWZ – FZCO
Address: DSO–IFZA Properties, Dubai Silicon Oasis, Dubai, UAE
Email: info@certificatoiwz.ae
Phone: +971 50 247 5030

1.2 IWZ CERT SRL – Italian branch

Data Controller / Joint Controller for activities targeting EU users and Italian clients

Name: IWZ CERT SRL – Italian branch
Address: Corso Del Popolo 133, 30172 Venezia (VE), Italy
Email (EU enquiries): info@certificatoiwz.org

For privacy-related questions you may contact either address. Requests from EU data subjects are normally handled by IWZ CERT SRL, in coordination with CERTIFICATO IWZ – FZCO where necessary.

2.1 Data you provide directly

• Identification and contact details (e.g. name, surname, email address, phone number, organisation, role) when you submit contact, offer or training request forms, register for a course, or write to us by email.
• Professional information (e.g. company name, VAT/Tax ID, sector, certification scheme of interest, experience as auditor/consultant) for certification, hiring and professional development activities.
• Content of communications (messages, attachments, CVs, company profiles) sent through forms or directly via email.
• Portal data (login credentials and activity logs) when you use reserved areas, where available.

2.2 Data collected automatically or from third parties

• Technical data (IP address, browser type, device, pages visited, access times) collected via security tools and analytics services to protect the site and understand its use.
• Cookie-related information (preferences, analytics, marketing cookies) in line with our Cookie Policy (EU).
• Data from certification activities (e.g. contact details of client representatives, audit team, witnesses) gathered during audits, assessments and related communications.
• Information from public or third-party sources (e.g. regulators, accreditation bodies, complainants) strictly limited to what is needed to manage certifications, complaints and appeals.

3.1 Service delivery & contract management

Legal basis: performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR)

• Managing certification, audit and inspection activities.
• Handling requests for offers, information and technical support.
• Administering participation in training and professional development courses.
• Managing client accounts, invoices and contractual relationships.

3.2 Legal obligations & accreditation compliance

Legal basis: compliance with legal obligations (Art. 6(1)(c) GDPR)

• Fulfilling tax, accounting and regulatory obligations.
• Respecting requirements from accreditation bodies and authorities.
• Managing complaints, appeals and disputes.

3.3 Legitimate interests

Legal basis: legitimate interest (Art. 6(1)(f) GDPR)

• Protecting the security and integrity of our websites and systems.
• Preventing fraud and misuse of services.
• Improving our services and user experience through aggregated, anonymised analysis.
• Managing business relationships and professional networks in the certification and training sector.

3.4 Consent-based processing

Legal basis: consent (Art. 6(1)(a) GDPR)

• Optional marketing communications or newsletters, where offered.
• Storage of non-essential cookies (analytics, marketing, preferences).
• Participation in specific initiatives where explicit consent is requested.

You can withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

5.1 Service providers & partners

• Technical and hosting providers that manage our websites, email services, document management and security tools.
• Professional consultants (e.g. legal, IT, compliance) supporting us in operating as an accredited certification body.
• Partner companies that work with us on certification or training projects, bound by confidentiality and data protection agreements.

5.2 Authorities & accreditation bodies

• Public authorities when required by law or by a legitimate request.
• Accreditation bodies and impartiality committees that oversee our activities and may access documentation as part of their supervisory role.
• Complaint and appeal management, where sharing information is needed to properly assess and respond to the case.

Whenever possible, we inform clients in advance about disclosures required by accreditation rules or law, unless we are legally prevented from doing so.

8.1 How we protect your data

• Access controls and authentication for staff and collaborators.
• Technical measures such as encryption and secure connections.
• Regular backups and monitoring of systems for security purposes.
• Confidentiality agreements and training for people who handle data.

While no system can guarantee absolute security, we continuously work to maintain a level of protection appropriate to the risks associated with our activities.

8.2 International data transfers

As an organisation active in multiple countries, some data may be processed or accessed from outside the European Economic Area (EEA), for example in the United Arab Emirates. In such cases, we adopt appropriate safeguards, such as contractual clauses and organisational measures, to ensure a level of protection consistent with applicable data protection laws.

10.1 Contact for privacy requests

To exercise your rights or ask any question about this Privacy Policy, you can write to:

For EU and Italian data subjects:
IWZ CERT SRL – Italian branch
Corso Del Popolo 133, 30172 Venezia (VE), Italy
Email: info@certificatoiwz.org

For international enquiries:
CERTIFICATO IWZ – FZCO
DSO–IFZA Properties, Dubai Silicon Oasis, Dubai, UAE
Email: info@certificatoiwz.ae
Phone: +971 50 247 5030