Privacy Policy

Validitas Sarl-S 32 Rue Principale, L-8814 Bigonville, Luxembourg
contact@validitas-certification.com

Last updated: May 2026

1. Who We Are
Validitas Sarl-S ("Validitas", "we", "us", "our") is an independent certification body accredited under ISO/IEC 17024:2026, registered in Luxembourg. We are the data controller responsible for the personal data collected through this website and through our certification processes.
We take data protection seriously. As a certification body operating under internationally recognised standards, our commitment to rigour applies equally to the way we handle your personal information. 
2. What Data We Collect
Depending on how you interact with us, we may collect the following categories of personal data:
Contact and enquiry data — name, email address, phone number, company name, and any information you voluntarily include in your message when you submit a contact form or reach out directly.
Candidate data — professional background, qualifications, work experience, examination results, assessment records, and certification status, collected when you apply for or undergo a certification scheme.
Technical data — IP address, browser type, device type, pages visited, and time spent on the site, collected automatically through cookies and analytics tools when you visit our website.
Communication data — records of correspondence between you and Validitas, including emails and WhatsApp messages.
3. How We Use Your Data
We process your personal data for the following purposes and on the following legal bases under GDPR.
4. How Long We Keep Your Data
We retain personal data only for as long as necessary for the purposes for which it was collected:

• Contact and enquiry data — 2 years from last contact, unless a certification process begins

• Candidate and certification data — 10 years from the date of certification, in accordance with ISO/IEC 17024 record-keeping requirements

• Technical and analytics data — 13 months from collection

• Newsletter subscription data — until you withdraw your consent

When data is no longer required, it is securely deleted or anonymised.
5. Who We Share Your Data With
We do not sell, rent or trade your personal data. We may share it only in the following limited circumstances:
Service providers — third-party tools we use to operate our website and certification process (such as Wix for website hosting, and email service providers). These processors act only on our instructions and are bound by data processing agreements.
Accreditation bodies — where required for the purpose of maintaining our ISO/IEC 17024 accreditation, relevant records may be reviewed by accreditation auditors under strict confidentiality obligations.
Legal authorities — where we are required by law or by a competent authority to disclose information.
Certificate verification — if you are certified by Validitas, your name, certification scheme, and certificate status may be included in our public certificate registry, which is accessible to third parties for verification purposes. You will be informed of this at the point of application.
We do not transfer personal data outside the European Economic Area unless appropriate safeguards are in place under GDPR Chapter V.
6. Cookies
Our website uses cookies to ensure basic functionality and to understand how visitors use the site. Cookies we use include:

• Essential cookies — necessary for the website to function. These cannot be disabled.

• Analytics cookies — help us understand visitor behaviour in aggregate. These are only set with your consent.

You can manage your cookie preferences at any time through the cookie banner displayed on your first visit, or through your browser settings. Refusing analytics cookies will not affect your ability to use the site.
7. Your Rights Under GDPR
As a data subject under the General Data Protection Regulation, you have the following rights:

• Right of access — to request a copy of the personal data we hold about you

• Right to rectification — to request correction of inaccurate or incomplete data

• Right to erasure — to request deletion of your data, subject to legal retention obligations

• Right to restriction — to request that we limit how we process your data in certain circumstances

• Right to data portability — to receive your data in a structured, machine-readable format

• Right to object — to object to processing based on legitimate interest

• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing

To exercise any of these rights, contact us at contact@validitas-certification.com. We will respond within 30 days. We may ask you to verify your identity before processing your request.
8. How We Protect Your Data
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration or disclosure. These include access controls, encrypted communications, and regular review of our data handling practices.
9. Complaints
If you believe we have not handled your personal data in accordance with applicable law, you have the right to lodge a complaint with the Luxembourg data protection supervisory authority:
Commission Nationale pour la Protection des Données (CNPD) 15, Boulevard du Jazz, L-4370 Belvaux, Luxembourg www.cnpd.lu
We would however always encourage you to contact us first so that we can address your concern directly.
10. Changes to This Policy
We may update this privacy policy from time to time to reflect changes in our practices or in applicable law. The date at the top of this page will always reflect the most recent version. Where changes are material, we will notify you directly where we hold your contact details.

11. Contact

For any questions about this privacy policy or about how we handle your data:

Validitas Sarl-S 32 Rue Principale, L-8814 Bigonville, Luxembourg contact@validitas-certification.com +352 661 500 204