Contents

• Privacy Notice (Policy)
• Statement
• Scope
• General Information:
• What is personal information?
• Collecting (Obtaining) Your Personal Information
• Using Your Personal Information
• Using Your Personal Information for Marketing
• Our Legal Grounds for Processing Your Personal Information
• Sharing Your Personal Information
• Transfers of Your Personal Information to Outside The UK
• Our Retention (Storage) Of Your Personal Information
• Your Rights in Respect of Our Processing Of Your Personal Information
• Marketing
• Security
• Automated Decision Making
• Children
• Cookies
• Contact Details
• Your Right to Lodge a Complaint With the ICO
• Updating

Privacy Notice (Policy)

Statement

This is the Privacy Notice of CHAS 2013 Limited.

CHAS 2013 Limited (‘CHAS, ‘we’, ‘us’, and ‘our’) is committed to respecting and protecting the privacy of individuals and to fully complying with all the requirements of the UK GDPR. We are the controller for the processing set out in this Privacy Notice.

CHAS is an affiliate of Veriforce LLC https://veriforce.com, (’Veriforce’) a US registered company with headquarters in Houston, Texas, USA.

We have appointed Data Protection Officer (DPO) who can be contacted via DPO@chas.co.uk.

Scope

• This Privacy Notice, which applies to all our data subjects, explains, amongst other things:
• Why we may process your personal Information
• What personal Information we may collect about you
• How we may collect your personal information
• Why our processing of your personal information is lawful
• How we may use your personal information
• Who we may share your personal information with
• How long we may keep your personal information
• Your rights regarding your personal information

General Information: What is personal information?

Personal information is anything that enables you to be identified or identifiable. Examples are:

• First and last names
• Postal, email and IP addresses
• Telephone numbers
• Identity documents (e.g., passports & driving licence)
• Identity numbers (e.g., National Insurance and bank accounts)
• Career & educational documents (e.g., CVs & qualifications)
• Contact information

Your personal information is sometimes called “personal data”. We collectively refer to handling, collecting, protecting, storing or otherwise using your personal information as ‘processing’.

You do not have to provide any of your personal information to us, but if you do not provide all the information we ask for, we may not be able to do or provide what you want.

Collecting (Obtaining) Your Personal Information

We may collect and process the following personal information about you:

Information you give us by:

• subscribing for our services;
• filling in forms on our website or hard-copy forms provided via post;
• corresponding with us by phone, e-mail or otherwise;
• entering into a business relationship with us;
• submitting a job application;
• providing information to us when you correspond with us or register to use our website.

Examples of the information you may give us are your name, address, e-mail address and phone number, financial and credit card information, personal description, photograph and training and qualification details.

Information we obtain from other sources:

• We operate as part of a Common Assessment Standard which involves sharing information with other Recognised Assessment Bodies (see Common Assessment Standard section below);
• If you are a contractor, we may be provided with information about you from one of our clients, or from another contractor, which has worked with you in the past;
• We may view information you put online through company websites or professional sites such as LinkedIn.

When you visit our website:

• Internet Protocol (IP) address used to connect your computer to the Internet
• your login information, browser type and geographical location.

We may also obtain some of the above personal information about you from third parties (other individuals or organisations) or from publicly available sources, for example social networks, company websites and public records.

We do not collect personally information for sale to third parties.

Using Your Personal Information

When we collect your personal information, we may use it for any of the purposes described below or as stated at the point we collect it from you (or as may be obvious to you from the context of collection), including:

• to carry out our obligations arising from any contracts entered into between you and us and to provide you with the information, products and services that you request from us;
• to create a database of accredited contractors which can be accessed by our clients;
• to contact you if we think you may be interested in our products and services;
• to notify you about changes to our service;
• to process and acknowledge any job application that you may make;
• to administer our website and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes; and
• to improve our products, our services and our website to ensure that content is presented in the most effective manner for you and for your computer.
• For any other purpose(s) for which your personal information has been provided to us, including any of the purposes given under ‘Collection of your personal information’ above

Using Your Personal Information for Marketing

Where we are legally required to do so, we will only provide you with marketing materials if you have given us your prior consent.

If you opt into any subscriptions, but later want to unsubscribe, you should look for and follow the instructions we will provided in our relevant communications to you.

If you choose to unsubscribe, we may retain some of your personal information to identify you, so that we can continue to honour your request and ensure that we do not continue to provide you with marketing materials.

Our Legal Grounds for Processing Your Personal Information

We rely on one or more of the following:

• Consent: We may process your personal information after you have consented (agreed) to us doing so. Your consent may have been obtained by us, or by third parties on our behalf. You have the right to withdraw your consent at any time.
• Contract: We may process your personal information when we need to deliver a contractual service to you or because you have asked us to do something before entering into a contract (e.g., provide a quote).
• Legal obligation: We may process your personal information when we need to comply with a legal obligation.
  Legitimate interest: We may process your personal information when we need to for our or another’s legitimate interests, where these interests are not overridden by your rights.

Sharing Your Personal Information

We will share (disclose) your personal information with Veriforce (see above) and its other affiliates. Veriforce has offices in the USA, Canada and South Africa.

We will share (disclose) your personal information if we report any suspected breaches of the IOSH Code of Conduct or the IIRSM Code of Ethics by their members. (Personal information you provide to us may be disclosed to the IOSH or IIRSM in evidence).

In the event that our business is sold by Veriforce, your personal information will be transferred to the new owner of the business along with the other business assets.

We may share (disclose) your personal information with our employees.

The third parties we may routinely or regularly share your personal information with, in addition to Veriforce and its Affiliates, are:

• our consultants (e.g. assessors), insurers or professional advisers as reasonably necessary for the purposes set out in this privacy notice.
• our clients by uploading it to a database of certified contractors.
• third party service providers who process personal information on our behalf, including providers of information technology, identity management, website hosting and management, data analysis, data back-up, security and storage services.
• our pre-employment screening, payroll, HRIS and employee benefit external providers.
• law enforcement, regulatory, or other government agencies or to other third parties as required by, and in accordance with, applicable law or regulation.

Transfers of Your Personal Information to Outside The UK

Your personal information may be transferred outside the UK. Any such transfer will be only:

• To you; or
• To Veriforce and/or its affiliates (see ‘Sharing Your Personal Information’ above); or
• To a recipient located in a country which provides an adequate level of protection for your personal information, for example a country in the European Union (EU), or European Economic Area (EEA); or
• To a recipient under a contractual agreement which satisfies UK legal requirements for the transfer of personal information, to ensure that appropriate safeguards are in place to protect your personal information in accordance with UK levels of data protection; or
• When your personal information has first been anonymised

Our Retention (Storage) Of Your Personal Information

We will retain your personal information only for as long as we need it for the purpose(s) for which it was collected, or as required to do so by law.

To determine the appropriate retention period for your personal information, we consider the amount, nature, and sensitivity of it, the potential risk of harm from unauthorised use or disclosure of it, the purposes for which we process it and whether we can achieve those purposes through other means, as well as applicable legal requirements.
Normally, this means we will retain your personal information for at least 6 years. For more information, please contact us.

Your Rights in Respect of Our Processing Of Your Personal Information

You may have certain rights in relation to the personal information we hold about you. In particular, you may have a right to ask us:

• not to use your personal data for marketing purposes;
• not to process your personal data where it is processed on the basis of legitimate interests provided that there are no compelling reasons for that processing;
• not to process your personal data for scientific or historical research purposes, where relevant, unless the processing is necessary in the public interest;
  for access to personal information held about you;
• for the information we hold about you to be rectified if it is inaccurate or incomplete;
• for data to be erased provided that the personal data is no longer necessary for the purposes for which it was collected, you withdraw consent (if the legal basis for processing is consent), you exercise your right to object, set out below, and there are no overriding legitimate grounds for processing, the data is unlawfully processed or the data needs to be erased to comply with a legal obligation;
• for the processing of that information to be restricted if the accuracy of that data is contested, the processing is unlawful, the personal data is no longer necessary for the purposes for which it was collected, or you exercise your right to object (pending verification of whether there are legitimate grounds for processing);
• for data portability if the processing is carried out by automated means and the legal basis for processing is consent or contract.

If you would like to exercise these rights, please contact us by sending an email or by one of the means set out at the end of this privacy notice. We may require you to prove your identity before processing a request.

Marketing

Where we are legally required to obtain your consent to provide you with marketing materials, we will only provide you with such marketing materials if you have provided consent for us to do so. For business to business marketing, we carry this out in our legitimate interests to promote our products and services and do not require consent, however you can unsubscribe at any time by clicking the unsubscribe link in our emails.

You may receive information from us as part of a subscription with us and you may receive automated emails when content is updated.

If you subscribe to any newsletters, you will receive emails known as newsletters. If you select any preferences such as issues, topics, subjects or industries, you may receive email communications related to those self-selected topics.

If you want to unsubscribe from mailing lists or any marketing, you should look for and follow the instructions we have provided within the appropriate area(s) of the website or in the relevant communications to you.

If you do not wish to receive emails or marketing communications from us, you can at any time contact us to request that such communications cease. If you choose to unsubscribe from any or all mailings, we may retain information sufficient to identify you so that we can honour your request.

Security

We have implemented generally accepted standards of technology and operational security in order to protect personal information from loss, misuse, alteration or destruction. Only authorised persons are provided access to personal information collected via the website; such individuals have agreed to maintain the confidentiality of this information.

Although we use appropriate security measures once we have received your personal data, the transmission of data over the Internet (including by e-mail) is never completely secure. We endeavour to protect personal data, but we cannot guarantee the security of data transmitted to or by us.

Automated Decision Making

We will not use your personal information for automated decision making or profiling.

Children

We understand the importance of protecting children’s privacy and we never knowingly collect personal information about individuals under the age of 13.

Cookies

Cookies are small files that are put onto your device when you visit websites like ours. We use cookies in order to collect information that helps us improve your user experience. For more information about cookies, please see our Cookie Notice.

Contact Details

If you have any questions or complaints about this privacy notice or the way your personal information is processed, or would like to exercise one of your rights set out above, please contact us by one of the following means:

• Email: admin@chas.co.uk
• Post: FAO: CHAS 2013 Ltd, 14th Floor, Civic Centre, London Road, Morden, Surrey, SM4 5DX

Your Right to Lodge a Complaint With the ICO

If you have a complaint about the way we are handling your personal information or think we have not complied with our obligations under data protection law, you may contact the Information Commissioner’s Office (ICO), which is the supervisory authority (regulator) in the UK.

You may make a complaint to the ICO as follows;

Online: https://ico.org.uk/make-a-complaint

Live chat: https://ico.org.uk/global/contact-us/live-chat

Tel: 0303 123 1113.

Please note you should raise your complaint with the ICO within three months of your last meaningful contact with us.

Updating

We may update this Privacy Notice at any time by publishing an updated version here. So that you know when we make changes, we will amend the revision date at the bottom of this page. The new modified or amended privacy policy will apply from that revision date.

This Privacy Notice was last updated on 28th September 2023.