Privacy Policy

Version 6.0
Last updated: 4 October 2026

This Privacy Policy explains how Certiget processes personal data relating to users of certiget.pl and certiget.eu, as well as individuals using Certiget services and features.

It covers, in particular, the certification body directory, certification offer comparison services, enquiries, implementation and training services, reviews, cooperation with certification bodies and other partners, newsletters and product reservations made through the Certiget Store.

1. Data Controller

The controller of your personal data is:

Certiget sp. z o.o.
ul. Sarmacka 20A/14
02-972 Warsaw
Poland
KRS: 0001060298
VAT ID (NIP): 9512578741

Contact:

E-mail: [email protected]
Telephone: +48 797 123 382

Certiget has not appointed a Data Protection Officer. If you have any questions concerning the processing of your personal data or wish to exercise your rights under the GDPR, you may contact us using the details above.

2. What Personal Data Do We Process?

The scope of personal data depends on how you use Certiget. We process only data that is necessary for a particular purpose.

Contacting Certiget

If you contact us through a form, by e-mail, by telephone or through another available communication channel, we may process:

  • your name and surname,
  • e-mail address,
  • telephone number,
  • organisation name and job title,
  • subject and content of your message,
  • other information you voluntarily provide during the communication.

Certification Offer Comparison and Negotiations

If you use Certiget to select a certification body, obtain or compare certification quotations, or negotiate certification terms, we may process:

  • contact details,
  • job title and organisation details,
  • the organisation's address and locations,
  • information about its activities,
  • employee numbers and organisational structure where needed to determine audit time,
  • information about existing or planned certifications,
  • the intended certification scope,
  • information required by certification bodies to prepare quotations,
  • correspondence and quotations received,
  • other information necessary to provide the requested service.

Implementation, Audits, Consulting and Training

Depending on the scope of the project, we may process:

  • contact details,
  • names and roles of individuals involved in a project,
  • training participant details,
  • organisation information,
  • information needed to perform a project, audit or training service,
  • information required to prepare service documentation or confirm training participation.

We do not require personal data that is unnecessary for the delivery of the service.

Reviews of Certification Bodies

If you submit a review, we may process:

  • your name, signature or other author name you provide,
  • an e-mail address used for verification,
  • review content,
  • ratings,
  • information regarding the certification or cooperation to which the review relates,
  • information supplied to confirm that the review is based on a genuine experience.

The review author's e-mail address is not published.

Cooperation with Certification Bodies and Other Partners

If you represent a certification body, training provider or another Certiget partner, we may process:

  • your name and surname,
  • job title,
  • e-mail address,
  • telephone number,
  • organisation details,
  • billing information,
  • information relating to services, accreditations, certifications and training,
  • materials supplied for publication,
  • information relating to the delivery and settlement of the cooperation.

Product Reservations in the Certiget Store

If you make a pre-order reservation, we may process:

  • the selected product and variant,
  • quantity,
  • your name or contact person details,
  • e-mail address,
  • telephone number, where provided,
  • whether you are acting as an individual or for a company,
  • company name,
  • VAT identification number, where provided,
  • any additional message,
  • information concerning the status and handling of the reservation.

A pre-order reservation is not an order, does not constitute a sales contract and does not create an obligation to pay.

Newsletter and Marketing Communications

If you subscribe to a newsletter or consent to specific marketing communications, we may process:

  • your e-mail address,
  • information recording the giving or withdrawal of consent,
  • technical information necessary to manage the subscription.

Use of Our Websites

When you use certiget.pl or certiget.eu, technical information may be processed, including:

  • IP address,
  • device and browser information,
  • operating system,
  • date and time of a request,
  • basic website usage information,
  • security logs,
  • information stored or accessed through cookies and similar technologies.

The scope of analytics and marketing data depends on your cookie choices.

Enquiries and Communication

We use personal data to respond to enquiries, communicate with you, explain our services and prepare proposals.

The legal basis is:

  • Article 6(1)(b) GDPR where communication relates to entering into or performing a contract with you,
  • Article 6(1)(f) GDPR in other cases, including where you contact us as an employee or representative of an organisation.

Our legitimate interest is to manage enquiries and business relationships.

Certification Offer Comparison, Quotations and Negotiations

Personal data may be used to:

  • analyse an organisation's requirements,
  • determine the certification scope,
  • identify suitable certification bodies,
  • obtain quotations,
  • compare costs and conditions,
  • analyse audit time,
  • negotiate terms,
  • present a comparison or recommendation to the client.

Where you are a party to the contract, the legal basis is Article 6(1)(b) GDPR.

For employees, representatives and other contact persons of a client organisation, the legal basis may be Article 6(1)(f) GDPR, based on our legitimate interest in properly delivering the service and communicating with the client organisation.

Sharing Information with Certification Bodies

If you ask Certiget to obtain or compare certification quotations, the information necessary for this purpose may be shared with selected certification bodies so that they can prepare a quotation or assess whether they can provide the requested certification.

We share only information that is necessary for the relevant purpose.

After receiving personal data, a certification body may act as an independent data controller in accordance with its own GDPR obligations.

Implementation, Audits, Consulting and Training

We use personal data to:

  • prepare and deliver projects,
  • communicate with participants and contact persons,
  • perform audits and consulting work,
  • organise training,
  • manage participants,
  • prepare documentation connected with the service.

The legal basis may be:

  • Article 6(1)(b) GDPR where the data subject is a party to the contract,
  • Article 6(1)(f) GDPR for employees, participants, representatives and other contact persons of a client organisation.

Publishing and Verifying Reviews

We process personal data to:

  • publish reviews,
  • display ratings and user experiences,
  • verify review authenticity,
  • handle reports concerning reviews,
  • prevent rating manipulation and other abuse.

The legal basis is, as appropriate:

  • Article 6(1)(b) GDPR for providing the review publication feature at the user's request,
  • Article 6(1)(f) GDPR for verification, moderation and protecting the platform against abuse.

Certification Body Directory

We may process publicly available professional information relating to representatives of certification bodies in order to maintain, update and develop our directory.

The legal basis is Article 6(1)(f) GDPR.

Our legitimate interest is to maintain a reliable directory of organisations operating in the certification market.

Where personal data has not been obtained directly from the data subject, we fulfil the information obligations under Article 14 GDPR to the extent and in the manner required by applicable law.

Cooperation with Certification Bodies and Other Partners

We process personal data to:

  • manage communications,
  • prepare and deliver cooperation arrangements,
  • maintain certification body profiles,
  • publish agreed materials,
  • promote training,
  • carry out other agreed activities,
  • manage billing and settlements.

Depending on the context, the legal basis may be Article 6(1)(b), (c) or (f) GDPR.

Reports provided to partners about interest in a profile or content are, as a rule, aggregated and are not intended to identify individual visitors.

Product Reservations

We process reservation data to:

  • record interest in a product,
  • manage the reservation,
  • contact you about the product,
  • inform you about pricing, variants and availability.

Where you make a reservation on your own behalf, the legal basis is Article 6(1)(b) GDPR — taking steps at your request prior to the possible conclusion of a contract.

Where you act as a representative of an organisation, your business contact details may also be processed on the basis of Article 6(1)(f) GDPR for the purpose of managing the business relationship.

Newsletter and Electronic Marketing

If you subscribe to our newsletter or consent to marketing communications, we use your data to provide the relevant communications.

The legal basis for processing personal data is Article 6(1)(a) GDPR — consent.

You may withdraw your consent at any time.

We process personal data where necessary to comply with legal obligations, including tax, accounting and bookkeeping requirements.

Legal basis: Article 6(1)(c) GDPR.

We may retain necessary personal data for the establishment, exercise or defence of legal claims.

Legal basis: Article 6(1)(f) GDPR, based on our legitimate interest in protecting our rights.

Website and Form Security

Technical data may be processed in order to:

  • protect our websites and infrastructure,
  • detect abuse,
  • prevent automated submissions,
  • protect forms,
  • prevent attacks and unauthorised access,
  • diagnose technical errors.

Legal basis: Article 6(1)(f) GDPR.

For these purposes, we use infrastructure and security solutions, including Cloudflare services. Forms may also be protected by solutions such as Cloudflare Turnstile.

Analytics

If you consent to analytics cookies and similar technologies, we may use Google Analytics to measure and analyse the use of our websites.

Where information obtained through these technologies constitutes personal data, the legal basis is Article 6(1)(a) GDPR.

Advertising Measurement

If you provide marketing consent, we may use Google Ads to measure campaign effectiveness and conversions in accordance with the current configuration of our websites.

Legal basis for personal data processing: Article 6(1)(a) GDPR.

4. Where Do We Obtain Personal Data?

We may obtain personal data:

  • directly from you,
  • from the organisation you represent,
  • from another person authorised to provide information in connection with a service,
  • through Certiget forms,
  • during the delivery of our services,
  • from certification bodies or partners where this is necessary for the service,
  • from publicly available sources,
  • automatically when you use our websites.

Publicly available sources may include:

  • official organisation websites,
  • public registers,
  • accreditation and certification registers,
  • official industry directories,
  • professional business contact details made publicly available in connection with professional activity.

5. Who May Receive Personal Data?

We do not sell personal data.

Access to personal data is limited to organisations and individuals that need it for a specific purpose.

These may include:

Certification Bodies

If you request certification quotations or comparison services, selected information may be provided to certification bodies to the extent necessary for them to prepare quotations or proceed with the relevant process.

Training Providers and Other Service Providers

Where a service is delivered by an external provider and the delivery requires personal data to be shared, the relevant data may be provided to that provider.

Where Certiget merely links or directs you to a third-party training provider's website, this does not by itself mean that personal data previously provided to Certiget is transferred to that provider.

Contractors and Subcontractors

Consultants, trainers, auditors, subject matter experts and other contractors may have access to personal data where necessary to perform services.

IT and Infrastructure Providers

We may use providers of:

  • website hosting and delivery,
  • cloud infrastructure and databases,
  • network and application security,
  • form protection and anti-abuse services,
  • e-mail and office tools,
  • communication services,
  • analytics,
  • advertising measurement.

Solutions currently used include Cloudflare services and — subject to the relevant consent — Google Analytics and Google Ads.

Accountants, Lawyers and Professional Advisers

Personal data may be provided to accounting, tax, legal, audit or other professional service providers where necessary.

Public Authorities

We may disclose personal data to authorities or other entities entitled to receive it under applicable law.

6. International Data Transfers

Some technology providers used by Certiget operate globally. As a result, personal data may in certain circumstances be processed outside the European Economic Area.

Where such a transfer takes place, it is based on a mechanism permitted under the GDPR, such as:

  • an adequacy decision adopted by the European Commission,
  • the EU–U.S. Data Privacy Framework where applicable,
  • Standard Contractual Clauses adopted by the European Commission,
  • another transfer mechanism permitted under the GDPR.

The scope of any transfer depends on the relevant tool and processing activity.

You may contact us at [email protected] for additional information concerning transfers applicable to a particular service.

7. How Long Do We Keep Personal Data?

We keep personal data only for as long as necessary for the purpose for which it was collected, unless a longer retention period is required by law or necessary in connection with legal claims.

In particular:

  • enquiry data — for the period required to handle the enquiry and subsequently for a period justified by the need to demonstrate the history of communication or deal with potential claims;
  • service and contract data — for the duration of the service and subsequently for the period required by legal obligations and applicable limitation periods;
  • accounting and tax records — for the period required by applicable law;
  • review data — while the review is published and for the period required to handle reports, verification and prevention of abuse;
  • product reservation data — until the reservation is completed, withdrawn or communication relating to the product ends, and subsequently for a period necessary to deal with potential claims;
  • newsletter and marketing data — until consent is withdrawn or we stop using the data for the relevant purpose, unless another lawful basis requires further retention;
  • security and technical data — for the period justified by security requirements and system configuration;
  • analytics and marketing data — in accordance with the settings of the relevant tools and the consents provided.

After the applicable period expires, personal data is deleted or anonymised unless there is another lawful basis for retaining it.

8. Your Rights

Depending on the circumstances, you may have the following rights:

Right of Access

You may ask whether we process your personal data and obtain a copy of it.

Right to Rectification

You may request correction of inaccurate personal data or completion of incomplete data.

Right to Erasure

In the circumstances set out in the GDPR, you may request deletion of your personal data.

Right to Restriction

You may request restriction of processing in certain circumstances.

Right to Data Portability

Where processing is automated and based on consent or a contract, you may have the right to receive personal data in a structured format or request its transmission to another controller.

Right to Object

You have the right to object, on grounds relating to your particular situation, to processing based on Article 6(1)(f) GDPR.

Where personal data is processed for direct marketing purposes, you may object to such processing at any time.

Where processing is based on consent, you may withdraw your consent at any time.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Exercising Your Rights

Please contact:

[email protected]

Where necessary to protect personal data, we may request information required to verify the identity of the person making the request.

We respond within the time limits provided for by the GDPR.

Right to Lodge a Complaint

If you believe that your personal data is being processed unlawfully, you may lodge a complaint with the competent supervisory authority.

In Poland, the supervisory authority is:

President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych)
ul. Stawki 2
00-193 Warsaw
Poland

If you live or work in another EEA country, or the alleged infringement occurred in another EEA country, you may also exercise your rights in relation to the competent supervisory authority under the GDPR.

9. Cookies and Similar Technologies

Certiget websites use cookies and similar technologies for website operation and security and — subject to the appropriate consent — analytics and advertising measurement.

On your first visit, you can:

  • reject optional technologies,
  • open the settings panel,
  • accept all optional categories.

You may make separate choices for:

  • analytics,
  • marketing.

Necessary Technologies

Necessary technologies are active to the extent required for the website to function properly or to provide a feature requested by the user.

They may be used to:

  • operate the website,
  • remember cookie consent choices,
  • protect website security,
  • protect forms,
  • prevent abuse.

They are not used for optional analytics or advertising.

Analytics

If you provide analytics consent, we may use Google Analytics.

It helps us understand how visitors use the website, including pages viewed, traffic sources, device types and events performed on the website.

We do not describe Google Analytics data as fully anonymous unless the technical configuration provides genuine anonymisation.

Marketing

If you provide marketing consent, we may use Google Ads.

It may be used for:

  • measuring campaign performance,
  • measuring conversions,
  • evaluating the effectiveness of advertising activities.

The precise operation depends on the current configuration of the advertising services.

We apply the relevant electronic communications rules where information is stored on, or accessed from, a user's device.

Technologies requiring consent are activated after the relevant consent has been obtained.

Where information obtained through optional technologies constitutes personal data, processing is based on Article 6(1)(a) GDPR.

Technologies that are genuinely necessary to provide a service requested by the user may operate without consent to the extent permitted by applicable law.

You can reopen the consent panel at any time through the “Cookie settings” link in the website footer.

You may then change or withdraw previously provided consent.

A change applies to future use of optional technologies. It does not automatically delete all data lawfully processed before consent was withdrawn or data already held by third-party providers.

You may also manage cookies through your browser settings.

Third-Party Embedded Content

If external embedded content that uses optional tracking technologies is introduced in the future, it will be assigned to the appropriate consent category before activation where required by law.

10. Data Security

We use technical and organisational measures appropriate to the type of personal data and the risks associated with processing.

These measures include, as appropriate:

  • access controls,
  • infrastructure protection,
  • form protection,
  • mechanisms designed to prevent automated abuse,
  • measures intended to detect and limit unauthorised access,
  • limiting access to personal data to persons who need it for their assigned tasks.

No method of data transmission or storage can, however, provide an absolute guarantee of security.

11. Automated Decision-Making

Certiget does not make decisions about users based solely on automated processing that produce legal effects or similarly significantly affect them within the meaning of Article 22 GDPR.

Automated tools may support particular tasks but do not replace required individual assessment in services provided to clients.

12. Is Providing Personal Data Mandatory?

Providing personal data is generally voluntary.

However, certain information may be necessary to:

  • respond to your enquiry,
  • prepare a quotation,
  • deliver a service,
  • obtain certification quotations,
  • publish and verify a review,
  • handle a product reservation,
  • subscribe to a newsletter.

If you do not provide information marked as required, we may be unable to provide the relevant feature or service.

Where information must be provided because of a legal requirement, we will inform you where applicable.

13. Privacy Contact

If you have any questions about this Privacy Policy or the processing of personal data, please contact:

Certiget sp. z o.o.
ul. Sarmacka 20A/14
02-972 Warsaw
Poland

E-mail: [email protected]
Telephone: +48 797 123 382

14. Changes to This Privacy Policy

We may update this Privacy Policy, particularly where there are changes to:

  • applicable law,
  • Certiget services,
  • forms and processes,
  • technologies we use,
  • service providers,
  • cookies and similar technologies.

The current version is made available on our website together with its last updated date.

Where a change is material, we may provide additional notice where appropriate.

Document version: 6.0
Last updated: 4 October 2026