Emitcert Privacy Notice

1. Controller

Capitalised terms have the meaning given to them in the Terms of Service.

Emitcert is the controller of the personal data of the Authorised Users who use an account in the Service and of the visitors to this website.

The Issuer is the controller of the personal data it enters into the Service about Recipients and about the people who sign its Certificates; Emitcert processes those data as processor, on the Issuer’s behalf and in accordance with section 14 of the Terms of Service. Recipients should address any request about their Certificates and data to the Issuer; we may forward to it any such request we receive.

2. Data we process

Account data: the e-mail address, name and password of each Authorised User, the password being stored only in hashed form; the second-factor enrolment and the recovery codes, if two-step verification is enabled, the recovery codes being kept only in hashed form; the organisation’s details (name, legal name, tax identification number, country, fiscal address and billing e-mail address); and, if provided at sign-up, a telephone number, a website and notes.

Activity data: a record of the actions carried out in each account, such as who issued, corrected, withdrew or deleted a Certificate and when. The Issuer can consult it, and we use it to keep the Service secure and to resolve incidents.

Certificate data, entered by the Issuer: the Recipient’s name and, where the Issuer records them, the Recipient’s e-mail address and a student or reference number; the course, grade, honours, dates and texts of the Certificate; and the names, titles and signatures of the people who sign it.

Billing data: the plan, the orders, the amounts and the identifiers that PayPal returns for each payment or subscription. Card and bank details are entered with PayPal, not with us.

Technical data: the information that every browser sends with each request, such as the IP address, the type of browser and the address requested. The Service uses it to deliver pages, to limit the rate of requests and to protect itself against abuse. A photograph of a QR code sent to read a code is used only for that purpose.

3. Purposes and legal bases

(a) To provide the Service, that is, to create and manage accounts, to issue, sign, deliver, display and verify Certificates and to send the notices the Service generates, on the basis of the performance of the contract with the Issuer and, for Certificate data, of the Issuer’s instructions.

(b) To invoice and collect fees and to keep accounting and tax records, on the basis of the contract and of our legal obligations.

(c) To keep the Service secure, to prevent fraud and misuse and to keep the activity record, on the basis of our legitimate interest, and that of Issuers, Recipients and Verifiers, in the integrity of Certificates.

(d) To comply with legal obligations and with requests from competent authorities.

We do not sell personal data, do not use them for advertising and do not take decisions based solely on automated processing that produce legal effects concerning you.

4. Cookies

This website uses only cookies that are strictly necessary for it to work: to keep a session signed in, to protect forms against cross-site request forgery, to remember the language chosen and to remember the choice made about cookies.

5. Who receives the data

Verifiers: the information shown on a verification page is visible to anyone who holds the Certificate’s code or link. Issuers: each Issuer’s Authorised Users access its data according to their role; each Issuer’s data are logically separated from those of other Issuers.

Service providers that act on our behalf, such as hosting, e-mail delivery and payment (PayPal) providers, only to the extent necessary for the service they provide. LinkedIn receives the Certificate’s title, the organisation, the month of issue, the link and the code only if a Recipient uses the “Add to LinkedIn” link.

Competent authorities, where the law so requires.

6. International transfers

Our providers may process data in countries other than the one where you live, which may not offer the same level of protection. Where the applicable law so requires, we apply the safeguards it provides for.

7. Retention periods

Certificate data are kept for as long as the Issuer keeps the Certificate in the Service. When the Issuer deletes a Certificate, the personal data it contained are removed from the Service, and its link indicates only that the Certificate is no longer valid. Deleted data may remain in backup copies, kept for security purposes, until those copies are deleted in their ordinary rotation.

Account data are kept while the account remains active. Once it is closed, we delete or anonymise them, except for the data we must keep to meet legal, accounting or tax obligations or to establish, exercise or defend claims, for the periods those purposes require.

One-time links, such as those used for invitations or password resets, expire and are purged automatically. Technical data are kept only for as long as the purposes described in section 3 require.

8. Security

We apply technical and organisational measures appropriate to the risk, such as encrypted connections, hashed passwords, optional two-step verification, the logical separation of each Issuer’s data and a record of the actions carried out in each account. No system is completely secure; if a breach affecting your data occurs, we will notify it as the law requires.

9. Your rights

Depending on the law that applies to you, you may request access to your personal data, their rectification or erasure, the restriction of their processing or their portability, and you may object to their processing. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of the processing carried out before.

To exercise these rights, write to security@emitcert.com. We will reply within the period set by the applicable law and may ask you to prove your identity. If your request concerns data controlled by an Issuer, we may forward it to that Issuer. You may also lodge a complaint with the data protection authority of your country.

10. Minors

Accounts are intended for organisations and for their Authorised Users, who must be of legal age. Where an Issuer grants Certificates to minors, it is responsible for obtaining any consent from parents or guardians that the law requires.

11. Changes to this Notice

We may update this Notice to reflect changes in the Service or in the law. The version in force is always the one published on this page, with its effective date; we will notify Issuers of material changes by e-mail or through the Service.

12. Contact

For any question about this Notice or about the processing of your data, write to security@emitcert.com.