Data protection
How Certiqual Limited collects, uses, protects, retains and publishes personal data.
Registered office: Level 2, The Forum, Triq il-Kostituzzjoni, Mosta MST 9051, Malta
Company Registration No. C 86412 · VAT No. MT 2566 5405
Last updated: 26 August 2026
The data controller is Certiqual Limited, Company Registration No. C 86412, VAT No. MT 2566 5405, with registered office at Level 2, The Forum, Triq il-Kostituzzjoni, Mosta MST 9051, Malta.
Privacy enquiries and requests to exercise data-protection rights may be submitted through the official Contact page.
Contact and eligibility forms may collect a name, email address, organisation, country, message, requested scope, website and other information supplied by the enquirer.
Operational records may include organisation and site details, application and audit evidence, findings, decisions, professional identity and contact details, qualification or CPD outcomes, verification codes, consent choices and account or role information for authorised administrators.
Necessary technical and security data may include request metadata, session information, login timestamps and hashed network identifiers where audit or security controls require them.
Data are used to answer enquiries, assess eligibility, manage applications, audits, decisions, recognitions, memberships, qualifications and CPD, issue and verify records, protect the service, maintain accountability and comply with legal obligations.
Depending on the activity, processing is based on steps requested before a contract, performance of a contract, compliance with legal obligations, Certiqual's legitimate interests in operating a secure and credible quality system, or consent where it is specifically requested.
Certiqual uses Vercel for website hosting and application delivery, Neon for managed database services and Resend for transactional email. These providers process only the information needed to deliver their contracted services.
Personal data may also be disclosed to authorised personnel, professional advisers or competent authorities where necessary. Certiqual does not sell personal data or use enquiry data for behavioural advertising.
Where a provider processes data outside the European Economic Area, Certiqual relies on the transfer safeguards applicable under data-protection law, such as an adequacy decision or approved contractual safeguards.
Public records are limited to the information needed to identify and verify a recognition, membership, qualification or CPD outcome, including its scope, status, dates and public code.
Private applications, audit evidence, findings and correspondence are not made public. Personal names are published only when necessary for verification and supported by the applicable lawful basis and publication choice.
Data are retained only for as long as needed for the relevant enquiry or service, the validity and history of a public record, contractual and audit accountability, legal obligations, security and the establishment or defence of legal claims.
When data are no longer required under those criteria, they are deleted, anonymised or retained in a restricted archive where continued retention is legally justified.
Certiqual applies access controls, role separation, encrypted transport, controlled server-side processing, security headers, traceable records and other proportionate technical and organisational measures.
No internet service can guarantee absolute security. Suspected misuse of a certificate, mark, account or public record should be reported promptly through the verification-concern route.
Subject to the conditions of applicable law, individuals may request access, rectification, erasure, restriction, portability or objection, and may withdraw consent where processing relies on consent.
Individuals may also lodge a complaint with Malta's Information and Data Protection Commissioner or another competent supervisory authority.
Use the official Contact page for legal, privacy or data-protection enquiries.
