Privacy Notice

What data do we collect?

When you apply for AWS Membership, personal data is captured from your application form, through email, and through other forms of communication exchange between you and AWS. Data is collected when you, for example, register a site for certification, register for a webinar, register for an event, sign up for a newsletter or download documents. We do so under the legal basis of legitimate interest.

We also collect personal data if you share it with us on your own initiative, for example, when using our website, for purposes of contacting us, or when registering for training or personalised services.

In addition, for technical reasons, your browser will transmit a series of data to us as soon as you access our website. This includes, for example, the page(s) visited, the name and version of the browser used and your IP address.

Statistical information (such as the number of users, pages most accessed and timing of access) is collected through the AWS IT System (including, for example, the AWS website, the AWS Tools Hub and the Professional Credentialing Portal) and processed into aggregated data. Individual persons or organisations are not identified in this collection. We perform all the above collections under legitimate interest.

When you sign up for AWS Membership, we collect your data under the legal basis of a contract.

Depending on our relationship with you, we may process different kinds of personal data, as follows:

Members

Identity data includes first name, last name, username or similar identifier, title.
Contact data includes billing address, delivery address, email address and telephone numbers.
Usage data includes information about how you use our website, products, and services.
Marketing and communications data includes your preferences in receiving marketing from us and our third parties and your communication preferences.

Partners

Identity data includes first name, last name, username or similar identifier, title.
Contact data includes billing address, delivery address, email address and telephone numbers.
Usage data includes information about how you use our website, products, and services.
Marketing and communications data includes your preferences in receiving marketing from us and our third parties and your communication preferences.

Website users

Identity data includes first name, last name, username or similar identifier, title.
Contact data includes billing address, delivery address, email address and telephone numbers.
Usage data includes information about how you use our website, products, and services.
Marketing and communications data includes your preferences in receiving marketing from us and our third parties and your communication preferences.

We also collect, use and share aggregated data such as statistical or demographic data for any purpose. Aggregated data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity.

Children

While our website is designed for a general audience, we will not knowingly collect any data from children under the age of 18.

If we discover that we have collected any personal information from a child under the age of 18, we will remove that information from our database as soon as possible.

If you believe we might have any personal information from or about a person under the age of 18, please contact us at info@a4ws.org.

How we use personal data

Personal and organisational data that is collected is used to enable AWS to deliver membership benefits, manage our assurance system and administer services. This includes, but is not limited to, providing members information about meetings, events, application support, member support, member voting, and access to specific account or profile information for administrative purposes. Email addresses of AWS Members may be shared in group communications between AWS and its members (for example, in the organisation of meetings such as the AWS Technical Committee or one of the AWS Communities of Practice).

Information transmitted by your browser is used for security reasons, specifically to defend against attacks on our web server (legitimate interests). You can object at any time by contacting us at info@a4ws.org. Aggregated certification reports and audit data are used to enable the monitoring and evaluation of the AWS System and services, understand progress and challenges, identify progress, and improve efficiency.

Anonymised aggregated data may be made available to the public by AWS.

AWS audit reports, certification reports, and geospatial data provided to AWS, including organisational information and site locations, may be shared with third parties for academic research purposes.

We will further disclose personal data and information if required to do so by law, administrative order, or court order.

AWS may use third-party providers for data collection, storage and processing. All data collected may be kept and used by AWS and its contracted third-party provider inside and outside the United Kingdom or of your country of residence for commercial purposes.

Third-party providers may include, but are not limited to:

Eventbrite: For managing ticketing for events, we use Eventbrite, a service provided by Eventbrite, Inc., located in San Francisco, California, United States of America. See Eventbrite’s Privacy Policy.
FormAssembly: For building online forms, we use FormAssembly, a service provided by FormAssembly, Inc., located in Bloomington, Indiana, United States of America. See Form Assembly’s Privacy Policy.
GoToWebinar: For video conferencing and webinar broadcasts, we use GoToWebinar, a service provided by GoTo Technologies USA Inc, located in Boston, Massachusetts, United States of America. See GoTo’s Privacy Policy.
Google Analytics: To understand website user journeys and inform website improvements, we use Google Analytics, a service provided by Google LLC, located in Mountain View, California, United States of America. See Google’s Privacy Policy.
Google Search Console: To monitor our website’s presence in Google Search results, we use Google Search Console, a service provided by Google LLC, located in Mountain View, California, United States of America. See Google’s Privacy Policy.
Hotjar: To gather behaviour analytics and insights, we use Hotjar, a service provided by Hotjar Ltd, located in St Julian’s, Malta. See Hotjar’s Privacy Policy.
Intuit Mailchimp: For email marketing, including the AWS Newsletter, we use Intuit Mailchimp, a service provided by Intuit Inc. Intuit Mailchimp is located in Atlanta, Georgia, United States of America. See Mailchimp’s Data Processing Addendum and the Intuit Global Privacy Statement.
Salesforce: For CRM and data analysis, we use Salesforce, a service provided by Salesforce Inc., located in San Francisco, California, United States of America. See Salesforce’s Privacy Information.
Stripe: For payment processing, we use Stripe, a service provided by Stripe Inc., located in San Francisco, California, United States of America. See Stripe’s Privacy Policy.
SurveyMonkey: To create surveys and forms, we use SurveyMonkey, a service provided by SurveyMonkey Inc, located in San Mateo, California, United States of America. See Survey Monkey’s Privacy Notice.
Ticket Tailor: For managing tickets for large events, we use Ticket Tailor, a service provided by Zimma Ltd, located in London, United Kingdom. See Ticket Tailor’s Privacy Policy.
Wistia: For video integration, we use Wistia, a service provided by Wistia Inc. a video software company located in Cambridge, Massachusetts, United States of America. When you watch a video embedded with Wistia, a connection is established to the Wistia servers located in the USA. For storage in the USA, see Wistia’s Data Protection Policy.
Xero: For cloud-based accounting, we use Xero a service provided by Xero Ltd., located in Wellington, New Zealand. See Xero’s Privacy Notice.
YouTube: For sharing video content, we use YouTube, a platform provided by Google, located in Mountain View, California, United States of America. See Google’s Privacy Policy.
Zoom: For video meetings, training and webinars, we use Zoom, a service provided by Zoom Communications, Inc., located in San Jose, California, United States. See Zoom’s Privacy Statement.

AWS will not sell or otherwise disclose your personal or organisational data to third parties except as described above.

International data transfers

When we share your personal data with our suppliers and service providers, it may involve transferring your data outside the UK and European Economic Area (EEA).

When we transfer your personal data outside of the UK or European Economic Area (both providing protection under either the UK or EU GDPR), we will ensure that those transfers takeplace in accordance with the applicable data protection laws designed to ensure the privacy of your personal data, including by entering into data transfer agreements with recipients.

If you would like more information about how your personal data may be transferred, please contact us at info@a4ws.org.

How we protect your data

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach, where we are legally required to do so.

Your rights

Under data protection law, you have the following rights with respect to the personal data we process about you:

Informed: You have the right to know why your personal data is processed, what will happen to it and how long it will be retained for.
Access: You have the right to access your personal data.
Rectification: You have the right to supplement or correct your personal data.
Erasure: Under certain circumstances, you have the right to ask us to erase your personal data.
Restrict: You have the right to request we restrict how we process your personal data.
Data portability: You have the right to request we transfer all your personal data to another data controller.
Object: Under certain circumstances, you may object to our processing of your personal data.
Automated decision making: You have the right to not be subject to decisions based solely on automated processing.
Consent: You have the right to revoke any consent you have provided us that allows us to process your personal data.

To exercise these rights, please contact us at info@a4ws.org.

If you no longer wish to receive materials from us, we will need to add you to our ‘do not contact’ list and this will require us to retain a limited amount of your personal data. Therefore, please note that exercising your right to not receive such materials may be a more appropriate request than asking us to delete all of your personal data, as we could validly obtain your contact details in the future.

Cookies

We do not use any Permanent or Persistent Cookies on AWS websites. For more information, see our Cookie Policy.

Retention

Personal data will be stored as long as it is necessary for us to provide the specific service. For example, during your AWS Membership, and for the duration of the applicable retention periods as noted in our AWS Data Protection Handbook. It will be deleted afterwards, unless longer storage is required by laws.

Privacy Notice review cycle

This Privacy Notice will be updated as required and formally reviewed at least annually, in line with AWS’s commitment to continuous improvement.

Contact us with questions

If you have any questions about this Privacy Notice or wish to make a complaint about how we handle your data, please contact us at info@a4ws.org as soon as possible.

You also have the right to submit a complaint to the supervisory authority, the Information Commissioner’s Office (ICO).

*‘Personal data’ means any information relating to an identified or identifiable natural person (‘data subject’). an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.