ISTO (International Standardized Testing Organization) is a data controller. This means that we are responsible for deciding how we hold and use and store personal information about you. We are required under the DPA 2018 / UK GDPR to notify you of the information contained in this privacy notice.
The controller is International Standardized Testing Organization Ltd., Cranfield Innovation Centre, University Way, Cranfield, Milton Keynes MK43 0BT, United Kingdom. Questions about your data, or requests to exercise the rights set out below, can be sent to privacy@isto.ch or info@isto.ch — both reach us.
We may update this notice at any time. If relevant (and feasible), we will notify you.
It is important that you read this notice, together with any other privacy notices we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using your personal information.
You may download a copy of this privacy notice.
Data Protection Principles
We will comply with all relevant data protection law (including the DPA 2018 / UK GDPR). This requires that the personal information we hold about you must be:
- Used lawfully, fairly and in a transparent way.
- Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.
- Relevant to the purposes we have told you about and limited only to those purposes.
- Accurate and kept up to date.
- Kept only as long as necessary for the purposes we have told you about.
- Kept securely.
We are accountable as a Controller for the principles and individual rights with respect to the processing we undertake.
The Kind of Information We Collect and Hold About You
For those who have signed up to our newsletter, we collect your email address.
For Candidates, we collect:
- Contact data including your full name, postal address, email address and telephone number.
- Data to verify you by including your day and month of birth, the last 4 digits of your Government-issued identification (ie, driving licence / passport, etc) and your unique candidate ID.
- The results of your test.
We will not collect or store any “special category”, or sensitive personal information on you.
This personal data is collected when you register for our test on our website – through your employer or an agent. We need to collect this data to fulfil our function as a test service provider.
This personal data is shared with external organisations who support our business operation, such as
- Employees and associates of ISTO for the purposes of administering the test.
- Payment providers. When you pay for a test, PayPal receives the information needed to take that payment. PayPal also uses it for its own purposes — fraud prevention and its own legal obligations — so it acts as a data controller in its own right, not only on our behalf.
- Other third parties that process data on our behalf and only on our instructions, to help us provide the test to you.
Test results of candidates will be used in calculation of the STAR diagram ranking, however the identity of each candidate will not be identifiable in handling the data.
Access to personal data is permission-based and is stored in the UK and EU, therefore is covered by the existing adequacy agreement.
Some partners, such as freelance contractors are not based in the EEA. In these cases, additional safeguards will be in place to permit this transfer, however Transfer Risk Assessments are conducted where appropriate.
We have put measures in place to protect the personal data we process – further details on these measures can be requested from us at info@isto.ch
We rely on the following lawful bases for processing your personal data such as performance of a contract by handling candidate registration and exam results to fulfill certification obligations, legal obligation by retaining records for auditing and accreditation standards compliance, legitimate interests in using contact details to manage strategic relationships and utilising statistical analysis for quality improvement and candidate serving, and consent for non-essential uses including optional mailing lists where statements would outline purposes, retention, and withdrawal rights.
In the event of a data breach that may result in a high risk to your rights and freedoms, we have implemented procedures to promptly assess and notify affected individuals and the ICO, as required by the UK GDPR. We take data breaches seriously and strive to minimise any potential negative impact. Our services are intended for individuals who are 18 years of age or older. We do not knowingly collect personal data from individuals under the age of 18. If you become aware that a child under 18 has provided us with personal data, please contact us immediately.
How We Will Use Information About You
As a Data Controller:
We need all the categories of personal data detailed above to allow us to conduct our business operation. Some of the grounds for processing will overlap and there may be several grounds which justify our use of your personal information.
If you are a candidate, then we will need to process your data in line with our legal obligations. In some cases, we may use your personal information to pursue legitimate interests of our own or those of third parties, provided your interests and fundamental rights do not override those interests.
The situations in which we will process your personal information are listed below.
- Administration of a contract we have entered with you and providing our products and services to you.
- Business management and planning, including accounting and auditing. In these instances, we will share your personal data with our accountants and associated reporting platforms.
- Planning for the on-boarding or termination of our contracting relationship.
- Dealing with legal disputes involving you, or any disputes that may arise under the contract that we have with you or the way in which we provide our products and services to you.
When You Download a Document
Some ISTO documents ask for your details before you download them. When you complete that form we collect your first and last name, email address, organisation, and country or economy, along with which document you requested, the language of the page you requested it from, and the date.
Why we collect it
We use these details to keep a record of who requested the document and to answer questions you may have about it. Our lawful basis is your consent, which you give by ticking the box on the form. You can withdraw it at any time, and withdrawing does not affect anything we did before you withdrew.
Optional updates
The form has a second, separate tick box for occasional ISTO updates. It is optional, it is never ticked for you, and leaving it blank has no effect on your download. If you tick it, you can tell us to stop at any time by writing to privacy@isto.ch, and you can unsubscribe from any email we send.
Who else handles it
One service provider processes this data on our behalf: Google, which stores the record of your request in Google Sheets and delivers our internal notification to a Google mailbox. Google may process data outside the United Kingdom and the EEA; where it does, those transfers are covered by the data protection terms of our agreement with Google, which include the safeguards required for international transfers.
We do not sell your details, and we do not share them with anyone else for their own marketing.
Data Retention
We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for. Different kinds of data are kept for different periods, as summarised below.
- Candidate and test data: we will retain your data for up to 15 years. If you ask us to remove your data from this, we will do so immediately, as long as we are permitted to legally.
- If the test is related to International Organization for Standardization (ISO) standards, we will retain your data for up to 5 years from the date an updated version is officially published.
- Our test service provider(s) will retain your data for 90 days to allow any queries or appeals to be handled.
- Document download details: where you gave us your details to download a document, we keep them for 24 months from your last interaction with us, and then delete them. If you withdraw your consent or ask us to delete them, we delete them promptly and do not wait for that period to end.
- Newsletter subscribers: we keep your email address until you unsubscribe.
Rights of Access, Correction, Erasure & Restriction
It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your working relationship with us.
Your Rights:
Subject Access Request – this enables you to receive a copy of the personal information we hold about you. To action this request, please email the data protection contact: info@isto.ch
We require a suitable form of identification and under normal circumstances, we will supply this to you within one calendar month of your request and of identification being received.
No fee is usually payable; however, we may apply an appropriate fee if the request is deemed to be excessive, or repetitive.
- Request Correction – this enables you to have any incomplete or inaccurate information we hold about you corrected.
- Request Erasure – this enables you to delete or remove personal information when there is no good reason for us to continue processing it.
- Object to Processing – in certain circumstances, you have the right to request we suspend the processing of your data. Please contact us if you require more information on this.
- Request the Transfer – you have the right to request the transfer of your personal data to a third party. Please contact us if you require more information on this.
- Right to Withdraw Consent – where we rely on consent to process your data, you have the right to withdraw this at any time, without giving reason. To withdraw your consent, please contact the data protection officer. Once received, we will not process your data for the reasons you have agreed to, unless we have another legal basis for doing so.
- Right to complain – you have the right to complain at any time to the Information Commissioners’ Office (ICO) regarding data protection issues - https://ico.org.uk
We reserve the right to update this privacy notice at any time. If you have any questions about it, please contact us at info@isto.ch.