- Home
- Privacy Policy
Privacy Policy
1. Introduction
Innovative Quality Certifications Pvt. Ltd. (“IQCPL”, “we”, “us”, or “our”) is an independent, third-party certification and assessment body headquartered in Pune, Maharashtra, India, accredited by the National Accreditation Board for Certification Bodies (NABCB). We provide ISO management system certification (including ISO 9001, ISO 27001, ISO 14001, ISO 27701, ISO 13485, ISO 22000, ISO 22301, ISO 45001), CMMI appraisals, cybersecurity and VAPT services, and professional training.
This Privacy Policy explains what personal information we collect through our website (www.iqcpl.com), our certification and audit engagements, our training programmes, and our other business interactions; why we collect it; how we use, share, and protect it; and the rights available to you. It applies to prospective and existing clients, auditees and their personnel, website visitors, job applicants, vendors, auditors/assessors, and training participants.
By using our website or engaging our services, you agree to the collection and use of information in accordance with this Policy. Where we rely on your consent for a particular activity, we ask for it separately at the relevant point of collection.
Information We Collect
Depending on your relationship with IQCPL, we collect the following categories of personal information:
| Category | Examples |
|---|---|
| Identity & Contact Data | Name, job title, company/organisation, email address, phone number, postal address, and professional profile details submitted via enquiry or contact forms. |
| Certification & Audit Data | Information provided during enquiry, application, and audit processes – e.g. organisational details, scope of certification, management-system documentation, audit findings, non-conformities, corrective action records, and auditor/assessor names and qualifications. |
| Training Data | Registration details, attendance records, assessment/exam results, and certificates issued to individual participants. |
| Financial Data | Billing name, GSTIN, invoice and payment details for fee processing. Full card and bank credentials are handled directly by our banking and payment-gateway partners and are not stored by IQCPL. |
| Website & Technical Data | IP address, browser type, device information, pages visited, and referring URL, collected automatically through standard web server logs. |
| Recruitment Data | CV/resume, qualifications, experience, and references submitted by job applicants or prospective auditors/assessors. |
| Grievance & Appeals Data | Details of complaints, appeals, or feedback submitted regarding our certification decisions or conduct, handled under our Redressal process. |
We do not seek to collect sensitive categories of personal data, such as health records or biometric data, except where strictly necessary for a specific certification scheme (for example, ISO 45001 occupational health and safety audits) or required by law, and in each such case we apply additional safeguards to that information.
3. How We Collect Information
- Directly from you – when you submit an enquiry, complete our online contact/quotation form, register for training, or sign a certification agreement.
- During audits and assessments – information shared by your organisation and its personnel in the course of documentation review, on-site or remote audits, and surveillance visits.
- Automatically – through cookies, web server logs, and similar technologies when you browse our website (see Section 8).
- From third parties – such as your employer/client organisation, accreditation bodies (e.g. NABCB), professional references, or publicly available business directories.
4. Purpose of Processing and Legal Basis
We process personal information for the following purposes, each supported by an appropriate legal basis under India's Digital Personal Data Protection Act, 2023 (DPDP Act):
- To respond to enquiries and provide fee quotations – based on your consent and steps taken at your request prior to entering a contract.
- To perform certification, assessment, audit, and training services under a signed agreement – based on performance of a contract.
- To maintain the impartiality, integrity, and traceability of certification decisions – as required by ISO/IEC 17021-1:2015 and our accreditation obligations to NABCB, based on legal and regulatory obligation.
- To issue invoices, process payments, and maintain statutory financial and tax records – based on legal obligation.
- To communicate certification status, renewal reminders, surveillance schedules, and service updates – based on contract performance and legitimate business interest.
- To evaluate job applications and onboard auditors/assessors – based on your consent and steps toward a potential contract.
- To investigate and resolve complaints, appeals, and grievances – based on legal obligation and legitimate interest in maintaining service quality.
- To improve our website and services – using aggregated or de-identified data, based on legitimate interest.
- To comply with applicable laws, regulatory requests, court orders, or accreditation audits – based on legal obligation.
5. Confidentiality of Certification and Audit Information
As an ISO/IEC 17021-1:2015 accredited certification body, IQCPL treats information obtained during the certification and audit process as confidential, except where disclosure is required by law, by our accreditation body (NABCB), or with the explicit consent of the client organisation. Access to audit findings, non-conformity reports, and related records is restricted to personnel, auditors, and committee members who need this information to perform certification-related duties, and who are bound by confidentiality obligations in their engagement or employment terms.
Our Impartiality Committee oversees the handling of client and audit information to safeguard the objectivity of certification decisions and to manage any potential conflicts of interest.
6. How We Share Information
We do not sell personal information. We share it only in the following circumstances:
- Accreditation bodies – NABCB and, where applicable, international accreditation or peer-evaluation bodies, for oversight of our certification activities.
- Service providers – IT hosting, email, and payment processing vendors who process data on our behalf under confidentiality and data-protection terms.
- Professional bodies – such as ISACA, where relevant to a specific training or partnership programme you have enrolled in.
- Legal and regulatory authorities – where required to comply with law, respond to lawful requests, or protect our legal rights.
- Business transfers – in the event of a merger, acquisition, or restructuring, subject to the same protections described in this Policy.
- With your consent – for any other purpose we specifically disclose and you agree to.
All third parties who process personal information on our behalf are required to maintain confidentiality and security safeguards consistent with this Policy.
7. Cross-Border Data Transfers
IQCPL primarily stores and processes data within India. Where we engage international accreditation partners, cloud service providers, or clients located outside India, personal information may be transferred outside India. In such cases, we take reasonable steps to ensure the recipient provides an adequate level of protection, consistent with the DPDP Act, 2023 and any country-specific restrictions notified by the Government of India.
8. Cookies and Website Technologies
Our website uses essential cookies and standard web server logs required for the site to function correctly, such as maintaining session state and load balancing. We do not use third-party advertising, retargeting, or cross-site tracking cookies. Most browsers allow you to refuse or delete cookies through browser settings; doing so may affect certain website functionality.
9. Data Security
We implement technical, administrative, and physical safeguards designed to protect personal information from loss, misuse, unauthorised access, alteration, or destruction, consistent with our ISO 27001 (Information Security Management) practices. These include access controls, confidentiality undertakings by staff and auditors, and secure storage of audit and client records. While we take these precautions seriously, no method of transmission or storage over the internet is completely secure.
10. Data Retention
We retain personal information for as long as necessary to fulfil the purposes described in this Policy, applying the following retention periods:
- Certification and audit records – retained for the duration of the certification cycle plus 6 years thereafter, in line with NABCB accreditation requirements.
- Financial and invoicing records – retained for 8 years, as required under applicable Indian tax and company law.
- Website enquiry data – retained for 12 months from the date of last contact, unless the enquiry converts into a client relationship, in which case certification and audit retention periods apply.
- Recruitment data – retained for 12 months from the date of application, after which it is securely deleted unless the candidate is engaged by IQCPL.
- Grievance and appeals records – retained for 6 years from the date of resolution.
Where a retention period expires, we securely delete or anonymise the corresponding information.
11. Your Rights
Subject to applicable law, including the DPDP Act, 2023, you have the following rights regarding your personal information:
| Your Right | What It Means |
|---|---|
| Access | Request confirmation of whether we process your personal information, and obtain a copy of it. |
| Correction | Request correction of inaccurate or incomplete personal information. |
| Erasure | Request deletion of personal information that is no longer necessary for the purpose it was collected, subject to legal and accreditation retention requirements. |
| Withdraw Consent | Withdraw consent at any time for processing based on consent, without affecting the lawfulness of processing carried out before withdrawal. |
| Grievance Redressal | Raise a complaint about how we have handled your personal information through our Grievance Officer, or with the applicable Data Protection Board. |
| Nominate | Nominate another individual to exercise your rights on your behalf in the event of death or incapacity, where permitted by law. |
To exercise any of these rights, contact us using the details in Section 15. We verify identity before acting on a request and respond within the timeframe required by applicable law.
12. Children's Privacy
Our website and services are intended for business and professional use and are not directed at individuals under the age of 18. We do not knowingly collect personal information from children. Any personal information found to have been submitted by a child is deleted upon discovery.
13. Third-Party Links
Our website may contain links to third-party websites, including accreditation bodies such as NABCB and professional associations such as NASSCOM and ISACA. IQCPL is not responsible for the privacy practices or content of these third-party sites, and this Policy does not extend to them.
14. Changes to This Policy
We review and update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or accreditation standards. The version number and “Last Updated” date at the top of this Policy indicate its current status, and prior versions are recorded in the Version History table. Material changes are communicated through a notice on our website.
15. Contact Us / Grievance Officer
Questions, requests, or grievances regarding this Privacy Policy or IQCPL's handling of personal information may be directed to:
Innovative Quality Certifications Pvt. Ltd. (IQCPL)
Off No. 504, 5th Floor, Pentagon P-3, Magarpatta City, Hadapsar, Pune – 411028, Maharashtra, India
Email (Grievance Officer): info@iqcpl.com
Phone: +91 9225661919 / +91 7709046555 | 020 67000001 / 67000007
Formal complaints and appeals relating to certification decisions may also be submitted through our published Redressal process at www.iqcpl.com/Redressal.html.