Confidentiality

Assurco is committed to maintaining confidentiality throughout the certification process as this underpins the trust in the certification relationship.

People Controls

All people involved in the certification process sign up to a confidentiality clause in their contracts and/or a separate non-disclosure agreement.

Assurco promotes the importance of confidentiality throughout the organisation including during the induction process and at periodic CPD sessions.

IT Controls

Assurco implements strict IT controls including:

• Storing data within the UK region of Microsoft 365.
• Enforcing Multi-Factor Authentication for all Users and Third-Parties.
• Requiring all users to have up-to-date operating systems and anti-malware software.
• Limiting access to client data within the Microsoft 365 environment.

Making Information Public

We will inform the client, in advance, of any information we intends to place in to the public domain. All other information, except for information that is made publicly accessible by the client, shall be considered confidential.

Except as required in this section, information about a particular certified client or individual shall not be disclosed to a third party without the written consent of the certified client or individual concerned.

When we are required by law or authorised by contractual arrangements (such as with the accreditation body) to release confidential information, the client or individual concerned shall, unless prohibited by law, be notified of the information provided.

Information about a client from sources other than the client (e.g. complainant, regulators) shall be treated as confidential, consistent with our Confidentiality Policy.

Personnel including committee members, contractors, personnel of external bodies or individuals acting on Assurco’s behalf, shall keep confidential all information obtained or created during the performance of the certification body’s activities except as required by law.