Privacy policy
Digital Trust Audit Ltd is the controller of the personal data described on this page. Registered office 20 Old Bailey, London, United Kingdom, EC4M 7AN.Company number 17547803.
What is collected when you request an assessment
your name, business email, signature block and role
the domain and company details of the business being assessed
The lawful basis
The lawful basis is legitimate interests. The balancing assessment is recorded and is available on request.
Information about the business assessed
An assessment processes information about the business assessed and the people named in its public records. That information is drawn from public sources: the business’s website, its domain and email records, its public company records and what is published about it elsewhere.
A Supplier Check processes information about a business the requester is considering, which the subject business may not know about. Where that is the case, the subject business’s rights under this policy are unaffected: it may exercise any of them at any time, and doing so does not require it to know that an assessment was requested.
Assessments requested by a partner
Some assessments are requested by a firm we work with, called a partner, rather than by the business being assessed. A partner may request one before it meets a business, so the business may not know about the assessment until it is shown the report.
When a partner requests an assessment, it gives us the business’s name, company number and website, and nothing else. We carry out, score and issue the assessment ourselves, in the same way as for a business that comes to us directly. The partner cannot see the report before we issue it, change a finding or issue a report. It receives the report because it asked for it, and it may share that report only with the business the report is about.
Where a business asks for an assessment itself through a partner’s website, a copy of the report goes to that partner, with the business’s agreement recorded when the request is made.
We rely on legitimate interests to assess a business at a partner’s request, using only the public sources described above. Where those sources name people, such as directors listed at Companies House, their names can appear in the assessment because they appear in the public record.
Until the business claims its report, we hold only its company details, the assessment and the record that the partner requested and paid for it. We hold no contact details for anyone at the business and we do not contact it to market anything.
If a business asks us not to hold a report it did not request, we remove the report from its file and keep only the record that the assessment was carried out and billed, which we need for our accounts. Write to [email protected].
Every report requested by a partner names that partner and states any connection between Digital Trust Audit and it.
The free website health check
When you request the free check we collect your name, your business name, your work email address, the website address, your phone number if you give it, and the IP address the request came from. We use them to run the check, to email you the result and to stop the form being misused. The check itself reads only what the website and its domain publish to everyone, and the business’s entry on the Companies House register. Our lawful basis is legitimate interests: you have asked for the check, and we cannot run or send it without this information.
We keep a record of each business we check or assess, and we may contact the business about our other assessments. We do this in our legitimate interest in running and selling our service. We send regular email only to an address that ticked the box, or to an address on the domain of a business that is an active company, and every message tells you how to stop.
If you tick the box to receive occasional email about our own assessments, our lawful basis for that email is your consent. You can withdraw it at any time using the link in any email, or by writing to [email protected].
A check starts a record of the business on our files. The result and the evidence behind it are kept on that record, so later checks and assessments can be compared with it.
Enquiries by email
When you email us, at [email protected] or any other address on this site, we receive your name, your email address, anything in your email signature and whatever you choose to tell us. We use it to reply and to deal with what you have asked about. Our lawful basis is legitimate interests: you have written to us, and we cannot reply without it.
The report link
The private report link is issued when the assessment is completed and does not expire on its own. It can be rotated on request, which invalidates the previous link immediately.
How long we keep records
If a business has only used the free check, we keep its record for three years after its last check or other dealings with us. If it has bought an assessment or any other service from us, we keep it for six years after its last transaction, which is how long we must keep accounting records.
We keep a report requested by a partner, and the record of it, for six years after the assessment, for the same reason.
Email from someone who has not used the free check or bought anything from us is kept for three years after our last exchange.
Our do-not-email list is kept permanently, because it is what stops us emailing someone who has asked us not to.
Nothing is deleted automatically. When a record passes its period, it is deleted by hand.
Who we share information with
Where an assessment is requested by or through a partner, the report goes to that partner as described above.
If Digital Trust Audit Ltd or its business is sold, these records pass to the buyer, who may use them only for the purposes set out here.
Where data is hosted
Data is hosted in the United Kingdom and the European Economic Area. Where a sub-processor operates outside those territories, transfers rely on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
Sub-processors
Contabo GmbH — hosts our website, and hosts the free check service on servers in the United Kingdom.
Google LLC — provides our email through Google Workspace, including the mailboxes that receive enquiries and the email that sends the free check result.
Cloudflare, Inc. — the spam check on the free check form (Turnstile).
A technical services company connected to us through common ownership — maintains our free check service and back office. Its engineers can see request records when they do this work, including from outside the United Kingdom. That access is covered by a processor agreement and the UK International Data Transfer Agreement; you can ask for a copy of the transfer safeguards at [email protected].
Your rights
Access a copy of the personal data held about you.
Rectification correction of anything inaccurate.
Erasure deletion where there is no overriding reason to keep it.
Restriction a limit on how it is used while a question is resolved.
Portability a copy in a structured, machine-readable form.
Objection an objection to processing carried out on the basis of legitimate interests.
To exercise any of them, write to [email protected].
Complaining to the Information Commissioner
You have the right to complain to the Information Commissioner’s Office. You may do so at any time, and you do not have to raise the matter with us first.
How this site uses cookies is set out in the cookie policy, and the terms on which assessments are carried out are in the terms of engagement.