Privacy notice

Who we are

The Installation Assurance Authority ('The IAA, ‘IAA’, ‘we’, ‘us’ or ‘our’) gather and process your personal information in accordance with this privacy notice and in compliance with the relevant data protection Regulation and law. This notice provides you with the necessary information regarding your rights and obligations, and explains how, why and when we collect and process your personal data.

The IAA’s registered office is at Unit 3, Ouzel Industrial Estate, Grovebury Road, Leighton Buzzard, LU7 4ER and we are a company registered in England and Wales under company number 12483858. We are registered on the Information Commissioner’s Office Register of Data Controllers under registration number ZA750415, and act as the data controller. Our Appointed Person for the organisation is Amanda Rees, and we can be contacted at Unit 3, Ouzel Industrial Estate, Grovebury Road, Leighton Buzzard, LU7 4ER.

We may collect the following personal information

• Name

• Home Address

• Email

• Telephone Number

• National Insurance Number

• Date of Birth

• Photographs which contain faces

• CPD evidence and accreditation evidence provided for the verification process

• Details which you disclose to us during telephone conversations

• Technical and usage data including internet protocol (IP) addresses, browser type, operating system, app version, language settings, log data and information about how you interact with our website and mobile app.

If you are an organisation who is applying for Installer Registration Scheme Cards on behalf of individuals, we will ask you to provide data in respect and on behalf of those individuals. You should bring the content of this Privacy Notice to the attention of such individuals at or before the time at which you provide their respective personal data to us and you should have obtained their consent to do so.

Purpose

We use information held about you in the following ways:

• To ensure that our site and services are presented in the most effective manner for you and for your computer.

• To respond to your enquiries and provide you with information, products or services that you request from us or which we feel may interest you.

• To carry out our obligations arising from any contracts entered into between you and us, including providing our services to you.

• To allow you to participate in interactive features of our service, when you choose to do so.

• To notify you about changes to our services.

Legal basis for processing

The IAA processes your personal information to meet our legal, statutory and contractual obligations. We will never collect any unnecessary personal data from you and do not process your information in any way, other than already specified in this notice.

• the processing is necessary to perform a contract with you, or to comply with your request before entering that contract

• the processing is necessary for our legitimate interests or the legitimate interests of a third party, however where we use this legal basis we will consider if there is a good reason to protect the individual’s personal data which overrides those legitimate interests

• the processing is necessary for us to comply with a legal obligation

• you have consented to the processing.

Consequences of not providing your data

As an applicant, you are not obligated to provide your personal information to The Installer Registration Card Scheme, however, as this information is required for us to process your application, we will not be able to process your application without it.

Where we store your personal data and transfers out of the EEA

The data that we collect from you will be stored within the European Economic Area (EEA) and may be processed by staff operating within the EEA who work for us or for one of our suppliers.

We will not transfer any data that we collect or receive from you that constitutes personal data outside of the EEA unless there are appropriate safeguards or an adequacy decision in relation to the transfer as set out in the data protection legislation or the transfer otherwise complies with the data protection legislation. Such transfers may involve, for example, our use of third-party services which make use of facilities in third countries to process and store data.

By logging in to the app and site, you agree to this storing or processing.

Your rights

You have the right to request access to any personal information that The IAA processes about you and to request information about: -

• Request access to your personal information (commonly known as a "data subject access request"). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.

• Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.

• Request erasure of your personal information (commonly known as “the right to be forgotten”). This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing.

• Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.

• Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.

• Request the transfer of your personal information to another party.

Where our processing is based on your explicit consent to our processing, you have the right to withdraw such consent.

If we receive a request from you to exercise any of the above rights, we may ask you to verify your identity before acting on the relevant request; this is to ensure that your data is protected and kept secure.

Please be aware that any actionable request to delete data will result in the services provided under the relevant Card being ceased.

Sharing and disclosing your personal information

We do not share or disclosure any of your personal information without your consent, other than for the purposes specified in this notice or where there is a legal requirement.

In order to process your card application, we will share your information with the following organisations;

In order to check your qualifications, the data you provide may be verified against information held by qualification awarding bodies, training organisations, product manufacturers and system designers.

In order to verify your identity, your personal data will be verified by Teemo Technology Ltd, a company registered in England and Wales under company number 12392069, whose registered address is Crown House, 27 Old Gloucester Street, London, United Kingdom, WC1N 3AX. Teemo Technology Ltd, trading as ComplyCube, is a certified identity service provider listed on the GOV.UK Digital Verification Services Register. Service details - GOV.UK

In order to check your employer(s), your data will be verified against information held by the employer(s) listed by you.

The IAA and its named data processors under the Installer Card Scheme above, use third-parties to provide some services and business functions, however all processors acting on our behalf only process your data in accordance with instructions from us, and comply fully with this privacy notice, the data protection laws and any other appropriate confidentiality and security measures.

If you have a card, by allowing your card to be used with the validation card checker functionality, you acknowledge and agree that the person using the validation card checker will be able to view your name and occupational competencies, the organisation you are contracted to carry out the work with, and other relevant information required to verify your qualifications that is stored on or accessed using the Installer Registration Card.

We may disclose or share your personal data to comply with any legal obligations, or to protect the rights, property, or safety of The IAA, our employees, our customers, or others.

Cookies

When you access the mobile app and website, some information in the form of a “cookie” or similar file may be automatically downloaded to your device. This helps us enhance the online experience of visitors to the mobile app and website.

If you do not want cookies sent to or stored on your system, most internet browsers allow you to delete or block cookies, prevent them from being stored, or show a warning before a cookie is stored. If you block cookies, you may not be able to access all or parts of the website.

Third-party links

The mobile app and website may from time to time include links to third-party websites, plug-ins and applications.

Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control those third-party websites and are not responsible for their privacy statements. We encourage you to read the privacy policy of every website you visit or to which you may provide personal data.

Safeguarding measures

The IAA takes your privacy seriously and we take every reasonable measure and precaution to protect and secure your personal data. We work hard to protect you and your information from unauthorised access, alteration, disclosure or destruction and have several layers of security measures in place to protect your data

If a password is used to help protect your accounts and personal information, it is your responsibility to keep your password confidential. Do not share this information with anyone. If you are sharing a mobile device or computer with anyone, you should always log out before leaving the mobile app or website to protect access to your information from subsequent users.

How long we keep your data

We retain personal data for as long as necessary to fulfil the purposes for which they have been collected as outlined in this Privacy Notice unless a longer retention period is required by law.

We reserve the right to keep records of former Scheme members for the purposes of operating the Scheme, fielding enquiries and compliance purposes.

Where you have consented to us using your details for direct marketing, we will keep such data until you notify us otherwise and/or withdraw your consent.

Marketing and communications

We may use your personal data (such as your contact details (e.g. name, address, email address, telephone number) to send you marketing-related correspondence by email related to our Services.

When we process your personal data for marketing purposes, we do so on the basis that we have obtained your consent to use your personal data for these purposes.

We may also use your personal data to personalise and to target more effectively our marketing and communications to ensure, to the extent possible, that any marketing-related correspondence is relevant to you.

You may withdraw consent to be contacted in this way at any time by email to carding@theiaa.co.uk.

Lodging a complaint

The IAA in fulfilling its obligations to provide the Installer Registration Card Scheme only processes your personal information in compliance with this privacy notice and in accordance with the relevant data protection laws. If, however you wish to raise a complaint regarding the processing of your personal data or are unsatisfied with how we have handled your information, you have the right to lodge a complaint with The IAA or with the Information Commissioners Office.