Privacy Policy

1. What Personal Data Do We Collect?

We collect and process personal data about you when you interact with us and our website. The personal data we process includes:

• name
• work email address, phone number, and company name
• job title
• payment and transaction details, where you use our payment page (available via credit/debit card, PayPal, ACH transfer, or international wire transfer) — we do not collect or store your card number, PayPal login or payment details, or bank account and routing numbers; card and PayPal payments are processed entirely within PayPal's own systems, and ACH/wire transfers go directly between your bank and CertPro's bank account
• personal data related to the browser or device you use to access our website
• internet browser and operating system
• IP address
• recordings of our meetings
• any other information you provide to us, for example through a contact or enquiry form

We record meetings only after informing participants and obtaining their agreement.

Providing this information is generally necessary for us to respond to your enquiry, schedule a meeting, or process a payment; if you choose not to provide it, we may not be able to carry out the relevant request.

Your browsing activity on certpro.com is also tracked using cookies, including analytics and functionality cookies.

Our website does not currently respond to Do Not Track browser signals.

2. How Do We Use This Personal Data and What Is the Legal Basis for This Use?

We process the personal data listed above to respond to your enquiries, schedule meetings, process payments, operate and improve certpro.com, and comply with our legal and regulatory obligations.

Under the GDPR, we rely on contract (to take the steps you request before entering an engagement), our legitimate interests (responding to your enquiry, keeping the website secure, and understanding how it's used, balanced against your rights), and legal obligation (regulatory recordkeeping).

Under the DPDP Act, we rely on Section 7 of the Act: where you have voluntarily provided your personal data for a specified purpose such as filling in a contact form, this is treated as a legitimate use for that purpose.

We do not use your data for any purpose beyond what you were told at the point of collection. We will not send you marketing communications without your consent, and you can withdraw that consent at any time by emailing [email protected].

3. With Whom and Where Will We Share Your Personal Data?

We may share your personal data with:

• service providers acting on our behalf, including Zoho (contact forms, CRM, live chat, and meeting scheduling), Google Analytics and Google Tag Manager, Cloudflare (website security and performance), our website hosting provider, and PayPal (card and PayPal payment processing — your payment details go directly to them, not to CertPro; ACH and wire transfers go directly between your bank and CertPro's bank account)
• regulators and law enforcement, where required by law

We do not sell your personal data, and we do not share it with third parties for their own marketing purposes.

4. How Long Will You Keep My Personal Data?

We will not keep your personal data for any purpose longer than necessary to fulfil the original purpose it was collected for:

• Enquiry and contact form data: for up to 5 years from your last interaction with us, or until you ask us to delete it
• Payment page records (excluding card, PayPal, and bank account details, which we never hold): for up to 5 years, in line with our financial recordkeeping obligations
• Data relating to an active client relationship: for the duration of the engagement and up to 5 years afterward

In the case of any contact with our team, we retain your details for as long as necessary to resolve your query.

5. Where Is My Data Stored?

As CertPro operates from both the United States and India, your personal data may be transferred between and accessed from both locations. For individuals in the European Economic Area (EEA), such transfers rely on the European Commission's adequacy decisions or appropriate safeguards such as Standard Contractual Clauses. For data principals under the DPDP Act, transfers are made consistent with the Act's cross-border transfer framework; as of this policy's date, the Indian government has not notified a restricted list of countries under the Act.

We apply technical and organizational security measures appropriate to the data we hold, including encrypted connections and access controls limiting who within CertPro can view personal data.

Breach notification: if a personal data breach occurs that is likely to risk your rights, we will notify the relevant supervisory authority within 72 hours of becoming aware of it under the GDPR, and the Data Protection Board of India within the timelines set out in the DPDP Rules (also 72 hours for the Board's report). We will notify you directly where the risk to you is high, and in all cases required under the DPDP Act.

6. What Are My Rights in Relation to My Personal Data?

If the GDPR applies to you, you have the right to: access the personal data we hold about you; have inaccurate data corrected; request erasure in certain circumstances; restrict or object to our processing; receive your data in a portable format; withdraw consent at any time where we rely on it as our basis (for example, marketing communications you've opted into); and lodge a complaint with your national data protection supervisory authority.

If the DPDP Act applies to you, as a Data Principal you have the right to: obtain a summary of the personal data we hold about you and how it is processed; request correction, completion, updating, or erasure of your personal data; withdraw your consent at any time, as easily as you gave it, wherever we rely on consent as our basis for processing; nominate another individual to exercise these rights on your behalf in the event of your death or incapacity; and seek redressal of grievances through CertPro's Grievance Officer before approaching the Data Protection Board of India.

We do not use automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you.

certpro.com is not directed at children, and we do not knowingly collect personal data from anyone under 18. If we become aware that we have done so without appropriate consent, we will delete it promptly.

To exercise any of these rights, contact us at [email protected] or through the Grievance Officer named below.

7. Where Can I Find More Information About CertPro's Handling of My Data?

If you have any questions, or wish to raise a grievance about how your personal data has been handled, please contact our Grievance Officer, designated under the DPDP Act:

We aim to acknowledge grievances promptly and resolve them within 90 days. If you remain unsatisfied, you may escalate your complaint to the Data Protection Board of India (under the DPDP Act) or your national data protection supervisory authority (under the GDPR).

We may update this Privacy Policy from time to time. Material changes will be indicated by an updated "last modified" date at the top of this page.