Privacy Policy

1. Who We Are

BuiltRight Technologies Ltd is the data controller for personal data collected in connection with National Assurance Standard (NAS) certification services. NAS is a trading service operated by BuiltRight Technologies Ltd.

Contact: support@nas-certification.co.uk

2. What Data We Collect

• Contact and identity information (name, email, phone number)
• Business information (company name, registration number, address)
• Application and assessment data (documents, evidence, submissions)
• Technical data (IP address, browser type, usage data)
• Payment information (processed securely by our payment provider)

3. How We Use Your Data

• To process and manage your NAS certification application
• To communicate with you about your certification status
• To maintain the NAS public register of certified businesses
• To administer appeals and complaints procedures
• To comply with our legal obligations

4. Legal Basis for Processing

We process your personal data on the basis of:

• Contract performance — to deliver NAS certification services
• Legitimate interests — to operate the NAS public register and communicate scheme updates
• Legal obligation — where required by law

5. Data Retention

Certification records are retained for a minimum of 7 years following the expiry or withdrawal of certification, in line with certification body best practice. Other data is retained only as long as necessary for the purpose for which it was collected.

6. Your Rights

Under UK GDPR you have the right to access, rectify, erase, restrict, or object to processing of your personal data, and the right to data portability. To exercise these rights, contact us at support@nas-certification.co.uk.

7. Complaints to the ICO

You have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.