Version 2.0
Last updated: 5 November 2025
Applies to: certcrowd.com, app.certcrowd.com and related sites (the "Services")
At CertCrowd, we know that our customers care about how their information is used and shared, and we take your privacy seriously. This policy explains what information CertCrowd collects about you, why we collect it, how we use and share it, and your choices.
By registering for or using our Services you consent to the collection, transfer, processing, storage, disclosure and other uses described in this Privacy Policy.
CertCrowd Pty Ltd (ABN 68 634 250 758) and its associated entities (collectively, "CertCrowd", "we", "us").
We collect personal information when you register for an account, create or modify your profile, or otherwise use, access, or interact with our Services. Personal information we collect may include name, business email address, role/title, phone and similar identifiers. You may enter this information yourself, or an administrator from your organisation may enter it for you.
To provide compliance and risk-management functionality, CertCrowd allows you to import or create content, such as company details, employee names/emails/titles, compliance obligations and status, incidents and hazards, risk registers and ratings, and other records you choose to store in the Services. You control the substance of this information.
If you contact us (for example support tickets, chat, email) we collect the information you provide (including any files you attach) to resolve your request and improve our Services.
Like most online services, we gather certain information and store it in log files when you interact with the Services. This may include browser type, IP address, language, referrer URL, operating system, and time/date of interactions. Some URLs you access may contain your email address as necessary to perform requested operations and therefore may appear in logs.
We collect usage data as you interact with the Services to understand performance and improve user experience. Where we associate usage data with an identifiable user (for example to provide support) we treat the combined data in accordance with this Policy.
The Services use cookies and similar technologies to authenticate users, remember preferences, measure performance and (where permitted) support analytics/advertising. You can control cookies via your browser settings; essential cookies are required for the Services to function.
If you choose to authenticate via a third-party identity provider (for example Google), we receive identity information as permitted by that service (such as name, email address, profile picture URL) and use it in accordance with this Policy. You can manage the information that third-party services share via their settings.
We use trusted providers (for example hosting, backups, email delivery, payments, CRM/support, analytics) who may process personal information on our behalf strictly to provide their services to us. Each is bound by confidentiality and data-protection obligations. We maintain a current list on our Sub-processor Register.
We may disclose information as required by law or where we believe it necessary to protect rights, safety or security (for example to comply with lawful requests, to investigate fraud or security incidents, or to enforce our terms).
We may use remarketing services (for example Google Ads) to display relevant ads about CertCrowd. You can opt out via the provider's ad settings and the CertCrowd website disables these cookies by default unless you opt in.
If we undergo a merger, acquisition or asset sale, we may transfer relevant information as part of that transaction. We will notify you of any ownership changes and related choices.
You may request access to, correction or deletion of your personal information. Depending on your jurisdiction, you may also request restriction or object to certain processing. To exercise rights, contact privacy@certcrowd.com. We aim to respond within one month and may extend by up to two months for complex requests; we will notify you if we need more time.
We operate a multi-region architecture.
For transfers from the EEA/UK/CH to countries without an adequacy decision (including the United States and Australia), we rely on the EU Standard Contractual Clauses (2021) and, for the UK, the UK International Data Transfer Addendum, plus supplementary measures (encryption in transit/at rest, least-privilege access, logging, and vendor due diligence). See the EU/UK/CH Addendum below for more detail and our Sub-processor Register for current vendors and regions.
We may update this Policy from time to time. The "Last updated" date shows the latest revision. For material changes we will provide additional notice (for example in-app or email) before they take effect.
CertCrowd Pty Ltd
4/1027 Manly Road, Tingalpa, QLD 4173, Australia
General: info@certcrowd.com
Privacy/rights requests: privacy@certcrowd.com
This addendum applies to individuals in the European Economic Area (EEA), the United Kingdom (UK) and Switzerland and supplements the main CertCrowd Privacy Policy.
Controller (for Business Data): CertCrowd Pty Ltd, 4/1027 Manly Road, Tingalpa QLD 4173, Australia
Data Protection Officer: Not appointed (you may always contact privacy@certcrowd.com)
If you are located in the EU or UK and have questions or concerns regarding your personal data, you may contact our appointed GDPR representative.
EU Representative
Euverify Ltd (Ireland)
Unit 3D North Point House
North Point Business Park
New Mallow Road
Cork
T23 AT2P
Ireland
Email: gdpr@euverify.com
UK Representative
Euverify Ltd (UK)
3rd Floor
86-90 Paul Street
London
EC2A 4NE
United Kingdom
Email: gdpr@euverify.com
To submit a Data Subject Access Request (DSAR), data deletion request, or any other GDPR-related inquiry, please use our secure portal at: GDRP Portal
This link allows you to verify our appointed representative and submit GDPR requests directly. Requests submitted through this portal are logged and tracked to ensure timely response and compliance.
We process personal data for the purposes set out in the main Policy under the following legal bases:
Hosting regions: By default, EEA/UK customer tenants are hosted in Germany (EU). We also operate regions in Australia, the United States, and Singapore for non-EEA/UK customers.
Service providers: Certain functions (such as authentication, email delivery, payments, support/CRM, and analytics) are provided by third parties that may process personal data in the United States and other regions where they operate.
Safeguards: Where personal data originating in the EEA/UK/CH is transferred to a country without an adequacy decision (for example the United States or Australia), we implement the EU Standard Contractual Clauses (2021) and, for the UK, the UK International Data Transfer Addendum, along with supplementary measures (encryption in transit/at rest, access controls, logging, vendor due diligence, and regional data hosting for Customer Data). See our Sub-processor Register for current vendors/regions.
We keep personal data only for as long as necessary to provide the Services, comply with law, resolve disputes, and enforce agreements. We use objective criteria (for example account status, regulatory limits, and record type) to decide when data is no longer needed. Where deletion is not immediately possible (for example immutable backups), the data is isolated from further processing and removed once the backup rotates. You can request deletion at any time (subject to legal exceptions) via our GDPR portal; we will cascade your request to our processors.
You have the right to access, rectify, erase, restrict, object to processing, and data portability. You also have the right to withdraw consent and to lodge a complaint with your local supervisory authority. We will respond within one month of receiving a request at privacy@certcrowd.com and may extend by up to two months for complex or multiple requests.
Important: If your request concerns Customer Data (data in a workspace/tenant controlled by your organisation), please contact your organisation (the controller). If you send such a request to us directly, we will forward it to the controller and assist them in fulfilling it, in accordance with our DPA.
Non-essential cookies (for example analytics/advertising) are off by default until you choose Accept in our cookie banner. The first layer of the banner provides Accept All / Reject Non-Essential with equal prominence. You can change or withdraw consent at any time via Cookie Settings.
We do not knowingly process the personal data of children under 16 in the EEA/UK/CH.
We do not use automated decision-making or profiling that produces legal or similarly significant effects.
