Who is responsible for your data
Attestware Systems Limited ("Attestware", "we", "us") is a private company limited by shares, registered in Ireland. We provide independent audit services for ISO/IEC 27001, ISO/IEC 42001 and ISO 22301. Under the EU General Data Protection Regulation (GDPR) and the Irish Data Protection Act 2018, Attestware is the data controller for the personal data described on this page.
The data we collect
This website only receives personal data that you decide to send us:
- Enquiries. Your name, email address and message when you use the contact form or email us, so that we can reply.
- The internal audit checklist. Your name and work email when you activate the checklist, together with which items you have ticked. The checklist tells you this before you activate it. We use it to make any follow-up conversation relevant to where you are.
- Audit engagements. Business contact details for the people involved in an audit, along with the audit evidence and records your organisation provides. This is handled under a written engagement agreement and its confidentiality terms.
We do not run analytics or advertising trackers on this website. We do not keep a marketing list or buy contact data.
Why we are allowed to use it
We rely on three legal bases: taking steps you ask for before a contract is agreed, performing a contract with your organisation, and our legitimate interest in answering people who get in touch with us.
Cookies and browser storage
This website does not set cookies. When you activate the checklist, your ticked items are saved in your own browser's local storage so that your progress is still there when you return. Clearing your browser data for this site removes it.
Service providers
A small number of providers process data for us: the company that hosts this website, a form delivery service that passes form submissions to our mailbox, and our domain and email provider. They act on our instructions under data processing terms. Where a provider processes data outside the European Economic Area, the transfer is covered by safeguards such as the European Commission's standard contractual clauses. You can ask us for the current list of providers at any time.
Sharing
We never sell personal data. We pass it only to the providers described above, to a certification body where an audit is carried out under contract to that body, or to an authority where the law obliges us to.
Retention
Enquiries and checklist records are deleted within 24 months of our last contact with you. Audit engagement records are kept for as long as the engagement agreement, the relevant certification body's rules or tax and company law require, which is normally up to seven years.
Security
We collect as little as we can, encrypt data in transit and restrict access to the people working on your enquiry or engagement. Audit evidence is kept separate for each client.
Your rights
You can ask us for a copy of your personal data, ask us to correct or erase it, ask us to restrict how we use it, object to our use of it and, in some cases, receive it in a portable format. We make no automated decisions about individuals. To use any of these rights, write to hello@attestware.com or use the contact form.
If you are unhappy with how we have handled your data, you can complain to the Data Protection Commission at dataprotection.ie.
Updates
When this policy changes, the date at the top of the page changes with it.