Privacy notice

Who we are and how to contact us

UKCert (“UKCert”, “we”, “us”, “our”) is the controller of the personal data described in this notice. That means we decide why and how your personal data is processed. We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

You can contact us about anything in this notice using the details below.

UKCert
89 Brown Lane
Cheadle
Manchester SK8 3SF
United Kingdom
Email: info@britishhalalauthority.org.uk
Telephone: +44 7884 528599

Please mark any data protection request or query for the attention of our data protection contact, so that it reaches the right person and we can respond within the statutory time limits.

What personal data we collect

We only collect personal data that we need in order to answer you, deliver an assessment, meet a legal duty or keep this website secure. The categories we handle are set out below.

Enquiry and quotation data

When you use an enquiry, quotation or contact form, or email, telephone or message us on WhatsApp, we collect your name, organisation, job title, email address, telephone number, the standards or schemes you are interested in, and whatever operational detail you choose to share about your sites, headcount, sector and timescales — including the free-text content of your message.

Resource requests

If you request a guide, checklist or other downloadable resource, we collect your name, work email address, organisation and a record of which resource you asked for.

Newsletter and marketing preferences

If you subscribe to updates, we collect your email address, any name you give us, and a record of your consent: the date and time, the form used and the technical details of the submission. We keep that record so we can evidence that consent was freely given, and so we can honour a withdrawal.

Client, assessment and certification records

Where your organisation becomes a client, we process the contact details of your nominated representatives and the personal data that unavoidably appears in assessment material — for example the names and job roles of people interviewed during an audit, training and competence records, signatures on documents, and notes recorded by an assessor as objective evidence. We also hold correspondence, meeting notes, certificate records, nonconformity records and billing contact details.

Website, server and security data

Our hosting provider records standard server logs each time a page is requested. These typically include the IP address, the date and time, the page requested, the referring page, the browser and operating system reported by your device, and any error generated. We use them to keep the site available and to investigate abuse or attempted attacks.

Special category data

We do not ask you to give us special category data (such as data about health, religious or philosophical beliefs, or trade union membership) and we ask clients to redact it from evidence wherever it is not necessary. Where such data is unavoidably present in material supplied for an assessment, we process it only so far as necessary for that assessment and only where a condition under Article 9 UK GDPR and Schedule 1 of the Data Protection Act 2018 applies.

Children

Our services are offered to organisations in a business context. We do not knowingly collect personal data relating to children through this website. If you believe a child has given us personal data, please contact us and we will delete it.

How we collect your personal data

• Directly from you — when you complete a form on this website, email or telephone us, message us on WhatsApp, meet us, subscribe to updates, or take part in an assessment.
• Automatically — through cookies and server logs when you use this website, as described in the cookies section below.
• From other people — a colleague or consultant may give us your details as the contact for an enquiry or an audit; and we may use publicly available sources such as the Companies House register or your own website to verify an organisation's identity, legal status and registered address before we quote.
• From scheme owners and other bodies — where a certification scheme we operate requires information to be exchanged, for example about a transferred certificate or a previous assessment.

Our lawful bases for processing

UK GDPR requires us to have a lawful basis for each processing purpose. Ours are set out below. Where we rely on legitimate interests, we have assessed those interests against your rights and freedoms, and you can ask us for a summary of that assessment.

How we use your personal data

• To answer your enquiry and to scope, quote for and schedule the work you have asked about.
• To carry out application review, assessment, certification decisions, surveillance and recertification, and to issue and maintain certificate records.
• To communicate with you about an assessment: arrangements, findings, nonconformities and corrective action.
• To administer our contract with your organisation, raise invoices and collect payment.
• To send you the resource or updates you asked for.
• To handle complaints and appeals, and to improve our services and assessor competence.
• To meet our legal, regulatory and record-keeping obligations, and to respond to lawful requests.
• To keep this website and our systems secure, available and free from misuse.

We do not make certification decisions, or any other decision producing legal or similarly significant effects, by solely automated means. Every decision is taken by competent people.

Who we share your personal data with

We do not sell personal data, and we do not share it for anyone else's marketing. We share it only where there is a reason to, and only with:

• Service providers acting as our processors — our website hosting provider, email and productivity provider, backup and IT support providers, and any customer relationship or enquiry management system we use. Each is bound by a written contract meeting Article 28 UK GDPR, may act only on our documented instructions, and must apply appropriate security measures.
• Assessors and technical experts we engage — including subcontracted specialists, each of whom signs a confidentiality and impartiality undertaking before any client information is released to them.
• Scheme owners and oversight bodies — where the rules of a certification scheme we operate give a scheme owner or an oversight body the right to review assessment records or to witness an audit, we must give them access. Where we are required to disclose information you have given us, we will tell you in advance unless the law prevents us from doing so.
• Professional advisers — lawyers, accountants, auditors and insurers, where they need the information to advise us.
• Public authorities — where disclosure is required by law, by a court order, or to protect someone's vital interests.
• A buyer or successor — if our business or part of it is transferred, personal data may be transferred with it under appropriate safeguards.

Certification status is not confidential. Where your organisation holds a certificate from us, we may confirm to an enquirer whether that certificate is valid, its scope and the standard it was issued against. This is a condition of certification and is set out in our terms of service.

International transfers

We aim to keep personal data within the United Kingdom or the European Economic Area. Some of the providers we rely on, and some assessments we carry out for clients with overseas sites, may involve a transfer of personal data outside the UK.

Where that happens, we transfer personal data only if:

• the destination country is covered by UK adequacy regulations; or
• the transfer is governed by the ICO's International Data Transfer Agreement, or the UK Addendum to the European Commission's standard contractual clauses, supported by a transfer risk assessment; or
• another safeguard or exception permitted by Chapter V of the UK GDPR applies.

You can ask us for details of the safeguards applied to a particular transfer using the contact details above.

How long we keep your personal data

We keep personal data only for as long as we need it. The periods below are our retention policy; where a longer period is required by law, by a scheme rule or by an ongoing dispute, we apply the longer period.

At the end of a retention period we securely delete the data or irreversibly anonymise it so that it can no longer identify anyone.

Your rights under UK GDPR

Under UK GDPR you have the following rights. Some of them apply only in particular circumstances, and we will explain if an exemption means we cannot meet a request in full.

• Access — to be told whether we hold personal data about you and to receive a copy of it, together with information about how it is used.
• Rectification — to have inaccurate personal data corrected and incomplete data completed.
• Erasure — to have personal data deleted where we no longer need it, where you withdraw the consent it relied on, or where it has been processed unlawfully. This right does not extend to assessment and certification records we must retain to evidence a decision.
• Restriction — to have processing paused, for example while you contest the accuracy of the data or our reliance on legitimate interests.
• Portability — to receive personal data you gave us, in a structured, commonly used and machine-readable format, where processing is based on consent or a contract and is carried out automatically.
• Objection — to object to processing based on legitimate interests. Where you object to direct marketing, we will stop without exception.
• Withdrawing consent — to withdraw consent at any time where processing is based on it. Withdrawal does not affect processing carried out before you withdrew.
• Automated decisions — not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. We do not make such decisions.

How to exercise your rights

Write to us using the contact details above, saying which right you wish to exercise and what data your request concerns. We may ask you for information to confirm your identity so that we do not disclose personal data to the wrong person.

We will respond within one month of receiving a valid request. If the request is complex, or if you have made several requests, we may extend that by up to two further months and will tell you why within the first month. There is no charge, unless a request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to act, and will explain our reasons.

You can unsubscribe from our emails at any time using the link in any message we send, or by contacting us directly.

Cookies and analytics

Cookies are small files placed on your device when you visit a website. We keep our use of them to a minimum.

Strictly necessary cookies

This website sets a session cookie when you use a form. It holds an anonymous session identifier that lets us protect the form against cross-site request forgery and keep your submission together. It carries no marketing data, expires when you close your browser, and cannot be switched off without breaking the forms. Under regulation 6 of the Privacy and Electronic Communications Regulations 2003, strictly necessary cookies do not require consent.

Analytics

No analytics or tag management is currently active on this website. Our page template loads Google Tag Manager only when a container ID has been configured; none is configured at present, so no analytics script, tag or cookie is served to you. If that changes, this notice will be updated before any measurement tag goes live, and non-essential cookies will be set only with your consent.

Advertising

We do not use advertising cookies, retargeting pixels or cross-site tracking technologies on this website.

Managing cookies

You can block or delete cookies through your browser settings, and set your browser to warn you before a cookie is stored. Blocking strictly necessary cookies will prevent our forms from working. Guidance for each major browser is published by its maker, and the Information Commissioner's Office publishes general guidance at ico.org.uk.

How we keep your personal data secure

We take appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access, including:

• encrypted connections (HTTPS/TLS) for this website and for the systems we use;
• access to client and assessment records limited to the people who need it for their role;
• individual accounts, strong credential requirements and hashed password storage for any administrative system;
• cross-site request forgery protection on our forms and restrictive security headers on this website;
• regular backups, with restoration tested periodically;
• written confidentiality undertakings from employees, assessors, technical experts and subcontractors;
• a documented process for identifying and responding to personal data breaches.

No transmission over the internet can be guaranteed to be completely secure. If a personal data breach occurs that is likely to result in a risk to people's rights and freedoms, we will report it to the Information Commissioner's Office within 72 hours of becoming aware of it, and will tell affected individuals directly where the risk is high. Please do not send us sensitive information by email or through a web form unless we have agreed a secure method with you.

Complaints and the Information Commissioner

If you are unhappy with how we have handled your personal data or a request you have made, please tell us first using the contact details above. We would like the chance to put it right, and we will investigate and respond to you.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent supervisory authority for data protection. You can complain to the ICO at any time, and doing so does not affect any other legal remedy available to you.

Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
United Kingdom
Helpline: 0303 123 1113
Website: ico.org.uk

Changes to this notice

We review this notice regularly and will update it when our processing changes, when a new supplier is introduced, or when the law changes. The effective date and the date of the last update are shown at the top of this page.

Where a change materially affects how we use your personal data, we will bring it to your attention — by email where we hold your address for that purpose, or by a notice on this website. Earlier versions of this notice are available on request.

This notice should be read alongside our terms of service.