Last updated 2026.
Who is responsible
TQC Accreditation, Am Bahnhof Westend 9, 14059 Berlin, Germany, is the controller for the personal data described here. Questions, or requests to exercise any of the rights below, should be sent to info@tqcaccreditation.org.
What we collect
When you use the contact form — your name, email address, and where you provide them your telephone number, organisation, country, certificate number and message. There is one form on this website and it is on the contact page; no other page collects personal data.
We also record the page you were on, the page you first arrived on, any campaign parameters in the link that brought you, how long you had been on the site, your browser identification and your IP address, so that we understand the context of your enquiry before replying and can investigate abuse of the form.
When you check a certificate — the certificate number searched, the result, the time and your IP address. The IP address is recorded so that repeated searches against numbers that do not exist can be traced, since that is how a forged certificate usually reveals itself. You are not asked to give your name or any other detail in order to check a certificate, and we do not publish who searched for what.
Automatically — standard web server logs, kept for a short period for security and diagnostics.
Spam protection
The contact form is protected by Cloudflare Turnstile, which checks that the submission comes from a real browser rather than an automated script. Turnstile receives technical signals from your browser and your IP address for that check. It does not track you across websites and does not serve advertising.
Why we process it
| Purpose | Lawful basis |
|---|---|
| Answering your enquiry and the correspondence that follows | Steps prior to a contract, and legitimate interests |
| Assessing and administering an accreditation | Performance of a contract, and legal obligation |
| Operating the certificate register | Legitimate interests — allowing third parties to rely on certificates |
| Detecting misuse of certificates and of the TQC mark | Legitimate interests |
| Blocking automated spam and abuse | Legitimate interests |
| Recording IP addresses against enquiries and certificate checks | Legitimate interests — detecting misuse and forged certificates |
What we do not do
- We do not sell personal data or share it with data brokers.
- We do not add enquirers to a marketing list. If you write to us you get a reply, not a sequence.
- We do not publish the identity or IP address of anyone who checks a certificate, and we do not use IP addresses to build a profile of anyone.
- We do not publish confidential information obtained during assessment.
Who else sees it
Our hosting provider, which stores the site and its data on our instructions; our email provider, which carries our correspondence; Cloudflare, for the spam check described above; and, where they have been configured, the analytics providers referred to below.
How long we keep it
Enquiries that do not lead to an application are kept for up to 24 months. Records relating to an accreditation are kept for the period required by our own rules and by law. Certificate check logs, including the IP addresses recorded with them, are kept for up to 12 months and then deleted. Server logs are kept for a short period only.
Cookies
This site sets no advertising cookies of its own. It uses your browser’s local storage to remember the page you first arrived on, so that we have context if you write to us. Cloudflare Turnstile may set a short-lived token for the spam check. If analytics tags are configured by the site owner, those providers may set their own cookies; where none are configured, none are loaded.
Your rights
Where the GDPR applies you may request access to your personal data, correction, erasure, restriction, portability, and you may object to processing carried out on the basis of legitimate interests. Write to info@tqcaccreditation.org and we will respond within one month. You also have the right to complain to a supervisory authority; in Germany this is the data protection authority for the federal state in which the controller is established.
Transfers outside the EEA
Where a provider we use processes data outside the European Economic Area, that transfer is made under an approved mechanism such as the European Commission’s standard contractual clauses.
Changes
If this notice changes materially, the date at the top of this page changes with it.