Privacy Notice

Controller

International Awards Group Ltd (company no. 16366777), 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom, is the data controller for personal data processed through TrustStanding. We are registered with the UK Information Commissioner's Office under registration number ZB886392. Contact us at support@truststanding.com.

What we collect

• Account data: email address, name and authentication identifiers.
• Business listing data you choose to publish: business name, contact details, social handles and description.
• Review content you write, including your display name and rating.
• Billing data: subscription status, plan and payment provider identifiers. We never see or store your full card details.
• Technical data: IP address, device and usage logs used for security and abuse prevention.

Why and on what basis

We process account, listing and review data to perform our contract with you and to operate a public review directory (legitimate interests). Billing data is processed to perform the contract and meet legal accounting obligations. Security logs rest on our legitimate interest in preventing fraud and abuse. We do not sell your personal data.

Publicly visible information

Business listings and reviews — including the reviewer name shown on a review — are public by design and may be indexed by search engines. Do not include information in a review that you do not want to be public.

Processors

We use service providers to run the platform: our cloud hosting and database provider, our authentication provider, and Paddle.com Market Limited, which acts as Merchant of Record for all orders and handles checkout, subscription management, payments, invoicing and tax compliance under its own privacy notice. We also share data with professional advisers (legal and accounting) and with authorities where required by law. Data may be transferred outside the UK under appropriate safeguards, such as UK/EU standard contractual clauses or adequacy decisions.

Assessment evidence and identity documents

When you apply for a Business Standing, Customer Service Excellence or Digital & AI Readiness certificate, or for Business Identity Verification, you submit evidence to support your answers. This section explains exactly how we handle it.

• What we receive: assessment evidence (policies, procedures, certificates, screenshots, survey results); financial documents (filed accounts, management accounts, turnover figures, insurance documents); HR attestations (headcount, training, employment and pay declarations); supplier and payment evidence (payment-terms declarations, sample invoices, supplier confirmations); and identity documentation (company registration documents, proof of address, director or authorised-representative identity documents).
• Who can access it: access is restricted to named assessment and verification staff of International Awards Group Ltd who need it to reach a certification decision, and to our hosting provider strictly as a technical processor. Evidence is never shared with other businesses, reviewers, sponsors or advertisers, and is never sold. Database access controls limit each submission to its own submitter and to authorised assessment staff.
• Confidentiality: evidence is confidential and is never published. Only the resulting score, band, section breakdown, certificate serial, issue date and expiry date are shown publicly — never the underlying documents or figures.
• AI processing: we use automated assistance to summarise and cross-check submitted evidence against our published rubrics. AI output is advisory only: every certification decision, score and band is made and signed off by a human assessor. Your evidence is not used to train third-party AI models.
• Where it is hosted: evidence files and assessment records are held in our managed cloud database and object storage in access-controlled data centres operated by our hosting provider, separate from public listing content.
• Retention: we keep raw documents only for as long as the related certification is valid — that is, the 12-month certificate period plus any appeal or surveillance window — and then delete them. After deletion we retain only the assessment record needed to evidence and enforce the certification decision: the scores, section breakdown, certificate serial, decision, assessor and dates, together with billing records kept for 7 years for tax purposes.
• Deletion: you can ask us to delete submitted evidence at any time by emailing support@truststanding.com. Where an assessment is in progress, deletion will end that assessment; where a certificate has already been issued, we may need to withdraw it, because we cannot stand behind a certificate we can no longer substantiate.
• Encryption and security: evidence is encrypted in transit (TLS) and at rest, stored in private buckets that are not publicly listable and reachable only through short-lived signed links, protected by row-level access rules, and accessed by staff over authenticated accounts on a least-privilege basis. Access is logged.
• International transfers: evidence may be processed outside the UK by our hosting and automated-review providers. Those transfers are covered by the UK International Data Transfer Addendum, EU standard contractual clauses or an applicable adequacy decision.

Retention

Account and listing data is kept while your account is active. Billing records are kept for 7 years for tax purposes. Reviews may be retained after account closure in anonymised form so ratings remain accurate.

Your rights

You can request access, correction, deletion, restriction, portability, or object to processing based on legitimate interests. Email us and we will respond within one month. You may also complain to the UK Information Commissioner's Office.

Cookies

We use strictly necessary cookies and local storage to keep you signed in and to run checkout. We do not use advertising cookies.