National Site Standard Limited ("NSS", "we", "us" or "our") respects your privacy. This policy explains how we collect, use and protect personal information when you visit our website, contact us, become a member, apply for accreditation, participate in assessments or events, or use our reporting channels.

​

1 Who is responsible for your information

​

NSS is the data controller for the membership, accreditation and other activities described in this policy. This means we decide why and how personal information is used. We handle it in accordance with the UK GDPR and the Data Protection Act 2018, as amended.

​

For privacy questions or requests, email info@nationalsitestandard.org or write to National Site Standard Limited, The Old School House, Manchester Road, Carrington, Manchester M31 4UG.

​

2 What information we collect

​

Depending on your interaction with us, we may collect:

​

• Your name, job title, organisation, business address, email address and telephone number.

• Membership and application details, assessment evidence, qualifications and training information, feedback, assessment findings and accreditation records that relate to individuals.

• Billing details, subscription and transaction records, payment status and relevant payment references.

• Information you provide in enquiries, complaints, appeals, surveys or workforce and safeguarding reports.

• Event registrations, accessibility or dietary requirements, and photographs, video or meeting recordings where you have been informed about them.

• Website information, such as your IP address, browser, pages visited and cookie preferences.

 

We receive information directly from you, through forms and correspondence, and during assessments or events. We may also receive relevant information from your employer, an applicant organisation, assessors, project partners, people making reports, and publicly available business sources such as company websites and professional directories.

 

Please provide only information needed for the purpose. Organisations submitting evidence should remove unnecessary names and sensitive details and ensure they have a lawful basis for sharing information about workers or learners.

​

3 How we use information and our lawful grounds

​

• Enquiries, membership, assessment and accreditation: to respond, manage applications, verify evidence, arrange assessments and communicate decisions. We rely on our legitimate interests in running a reliable accreditation scheme and managing business relationships. Where you personally enter a contract with us, we use the contract basis for processing necessary to perform it.

• Billing and payments: to administer subscriptions, payments and invoices. We rely on legitimate interests in collecting agreed charges, contract where applicable, and legal obligations for accounting and tax records.

• Complaints, appeals and reports: to investigate concerns, maintain impartiality and protect scheme integrity. We rely on legitimate interests in resolving concerns and protecting people; legal obligations apply where a specific duty requires processing.

• Events, feedback and service improvements: to manage attendance, gather feedback and improve NSS. We rely on legitimate interests, or consent where appropriate, including for optional recorded interviews or promotional testimonials.

• Marketing: to send relevant NSS news, resources and event invitations. We use consent where required and, where permitted, legitimate interests in communicating with business contacts.

 

When relying on legitimate interests, we consider your rights and the potential impact on you. If you do not provide information needed for an application, assessment or payment, we may be unable to deliver that service. Optional marketing consent is not a condition of membership.

​

4 Sensitive information and confidential reports

 

Assessment evidence or reports may include sensitive information, such as health, disability or ethnicity, or allegations of criminal conduct. We seek anonymised or summarised evidence wherever possible. Where identifiable sensitive information is necessary, we will explain the purpose and the additional legal condition that permits its use in the relevant form or separate privacy information.

 

You may report anonymously where the reporting form allows this. We restrict access to reports to people who need the information to assess or respond to the concern. We may need to share relevant details to investigate, comply with law or protect someone from harm, so we cannot promise absolute confidentiality. We will consider whether identifying details are necessary before sharing them.

​

5 Payments through Stripe

 

Stripe processes online membership and registration payments. Payment details entered in Stripe Checkout are handled by Stripe; NSS does not receive or store your full card number or card security code through this checkout. We receive information needed to manage billing, such as contact details, payment status and limited payment-method details.

 

Stripe also uses information for its own payment, security and legal purposes, as explained in its privacy policy.

​

Stripe Privacy Policy

​

6 Who we share information with

​

We share information only where needed for the purposes described above, including with authorised assessors and reviewers; website, form, IT and communications providers such as Wix and Jotform; Stripe; event suppliers; professional advisers; and authorities where legally required or necessary to address a safeguarding concern.

​

We require providers acting on our behalf to protect personal information and use it under our instructions. Some recipients, including payment providers and authorities, act as independent controllers for their own purposes.

​

We may publish organisational accreditation details, including the organisation or site name, scope, grade, reference, validity dates and status. We do not publish confidential assessment evidence or personal reporting information. We do not sell personal information or give partners contact lists for their own marketing without permission.

​

7 International transfers

​

Some technology providers process or access information outside the UK. Where this involves a restricted transfer, we use a recognised legal safeguard, such as UK adequacy regulations or approved contractual safeguards, with any required assessment of protection. Contact us for details of the relevant destinations and safeguards, or a copy of the safeguards that apply to your information.

​

8 Security and how long we keep information

​

We use appropriate technical and organisational measures to protect information, including controlled access and secure storage. No online service can guarantee complete security.

​

We retain information only for as long as needed for its purpose. Membership and assessment records are kept while needed to administer membership, verify accreditation history, complete assurance reviews and deal with appeals or legal claims. Financial records are retained for applicable accounting and tax requirements. Enquiries, event records and reports are reviewed according to whether follow-up, investigation or a legal requirement remains outstanding.

​

We delete or anonymise information when it is no longer needed. If you opt out of marketing, we may retain a minimal record to ensure we respect that choice. You can ask us about the retention period for a particular record.

​

9 Cookies and marketing preferences

​

Our website uses cookies and similar technologies. Essential cookies support the website and its security. Where consent is required, optional analytics or advertising technologies are used only after you agree. You can change your choices through the website cookie settings; further details are provided there.

 

You can stop marketing emails at any time using the unsubscribe link or by emailing us. We may still send necessary membership, billing or accreditation messages.

​

10 AI and automated decisions

​

If we use AI tools to assist with administration or analyse feedback, we will assess the provider and privacy risks, minimise the personal information used and apply appropriate safeguards. Any new use involving personal information will be explained before it begins. Accreditation decisions are made by authorised people, not solely by automated systems.

​

11 Your rights and complaints

​

Depending on the circumstances, you can ask to access or correct your information, request deletion or restriction, object to processing, or receive certain information in a portable format. You can withdraw consent at any time without affecting earlier lawful processing. You have the right to object to direct marketing at any time.

​

Email info@nationalsitestandard.org to make a request or raise a concern. We may need to verify your identity. We normally respond to rights requests within one month, subject to lawful extensions or exemptions, and will explain any restriction that applies.

​

You can also complain to the Information Commissioner’s Office (ICO), the UK data protection regulator, whether or not you have contacted NSS first.

​

ICO complaints and contact information

​

12 Changes to this policy

​

We may update this policy as our services or legal requirements change. The current version and its update date will be available on our website. We will bring significant changes to your attention where appropriate.