Privacy Policy

The controller for the processing described here is Certa Analytical.

This policy covers the Certa Analytical website. It does not cover other websites you reach from links here.

Certa collects what you type into a form. Nothing else about you is gathered by this website — there is no analytics, no advertising tracking and no profiling.

Quote requests. The request form collects your name, email address and, optionally, your organisation and country; the compound or sample name, sample type, expected quantity and number of samples; the analyses you are requesting and any description of a custom analysis; whatever you write in the free-text field; and whether you indicated interest in a publicly verifiable report.

Contact messages. The contact form collects your name, email address, optionally your organisation, a subject and your message.

Report verification. Your report ID and verification code are sent over HTTPS to our server for verification. The website does not store the plaintext code. A private database holds publication records received from the Certa reporting system. Short-lived, pseudonymous request counters help prevent automated abuse.

Connection data. Any web server processes the technical data needed to deliver a page — your IP address, the time of the request and your browser user agent.

Each purpose below is tied to the legal basis that actually applies to it under the GDPR.

Responding to your enquiry and preparing a quotation — assessing whether the analysis is feasible, scoping it and replying to you. Article 6(1)(b): steps taken at your request before entering into a contract.

Delivering an agreed analysis — coordinating sample submission, performing the testing, issuing the report and supporting its verification. Article 6(1)(b): performance of the contract.

Keeping the site usable — delivering pages and rejecting automated form submissions. Article 6(1)(f): the legitimate interest in a working, non-abused website. The hidden field used to catch automated submissions collects nothing about you.

Meeting legal obligations — where record-keeping or accounting law requires information to be retained. Article 6(1)(c).

Certa does not use your information for marketing, does not send a newsletter and does not share it for advertising purposes.

Analytical reports identify a sample and an analysis, using a report identifier and sample metadata rather than personal details.

The verification interface is built to reveal only what is needed to authenticate a report. A publicly accessible report should not disclose the name, email address, postal address or organisation of the person who submitted the sample, unless that has been expressly authorised and is appropriate in the circumstances.

Publication is never automatic. See public reports in the terms.

Report verification uses a private Postgres database. Contact and quote submissions continue to be delivered by email rather than stored in the verification register. Configured service providers are listed below.

• Resend — Delivers quote requests and contact messages to Certa by email. Processor acting on Certa's instructions.

Analytical work may involve specialist laboratories. Where that happens, the material and the information needed to perform and document the analysis are shared for that purpose only, and the arrangements are set out with the quotation for your request.

Where a provider processes information outside the European Economic Area, that transfer needs a valid legal basis — an adequacy decision or appropriate safeguards such as standard contractual clauses.

The processing locations of the providers used here are confirmed as part of setting up each service, and are stated in this section once they are established for the live deployment.

Certa keeps information for as long as the purpose it was collected for requires, and then for as long as a legal obligation requires it.

Enquiries that do not lead to an analysis are kept only as long as needed to handle the exchange and to answer follow-up questions about it.

Information about an agreed analysis is kept for as long as the service documentation requires, including the ability to answer questions about an issued report.

Analytical reports may be kept longer, because continued verification of an issued report is part of the service.

Specific statutory retention periods depend on the country in which the Certa legal entity is established, and are stated here once that is settled rather than estimated now.

Under the GDPR you can ask for:

• access to the personal information held about you
• correction of information that is inaccurate or incomplete
• erasure of information, where no ground to keep it applies
• restriction of processing in certain circumstances
• a copy of information you provided, in a portable format
• objection to processing based on legitimate interests
• withdrawal of consent, where processing is based on consent

Some requests can be limited by an obligation to retain records — analytical documentation, for instance, cannot always be deleted on request. Where that applies, you are told which obligation prevents it.

You can also complain to the data protection authority competent for you — normally the authority in your country of residence, or the one competent for the place where Certa is established.

The site is served over HTTPS. Credentials for the email service, database and publication API are held server-side as environment variables and are never sent to the browser.

Because form submissions are delivered by email rather than written to a database, this website holds no store of enquiries that could be read from it.

No system is entirely secure, and Certa does not claim otherwise. Please do not send information through this website that you would not want to send by email.

This policy is updated when the site or the processing behind it changes — for example when a provider is added or a form starts collecting something new.