{"id":2140,"date":"2021-01-14T14:53:11","date_gmt":"2021-01-14T14:53:11","guid":{"rendered":"https:\/\/www.bcta.group\/attma\/?page_id=2140"},"modified":"2025-01-17T12:01:34","modified_gmt":"2025-01-17T12:01:34","slug":"data-policy","status":"publish","type":"page","link":"https:\/\/www.bcta.group\/attma\/data-policy\/","title":{"rendered":"Data Policy"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Data Management Policy<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The purpose of this document is to establish guidelines and procedures related to\u00a0the management of data within the Air Tightness Testing & Measurement
Association (ATTMA). This policy document applies to all member entities and by\u00a0extension to the individuals involved in the collection, processing, storage, and
dissemination of data related to those entities.\u00a0ATTMA is committed to complying with all applicable privacy and data protection\u00a0laws and regulations while maintaining the highest standards of data security and\u00a0confidentiality.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t
Key Members of Staff<\/h5>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
Data Protection Officers<\/h6>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Under the General Data Protection Regulation, all businesses that market goods or\u00a0services to customers and collect data as a result must appoint a data protection\u00a0officer. The data protection officer keeps up with laws and practices around data\u00a0protection and ensures that all other matters of compliance pertaining to data are up\u00a0to date.
The key members of staff who are responsible for the data within the ATTMA are:
\u2022 Barry Cope \u2013 Scheme Director
\u2022 David Pickavance \u2013 Chairperson
There are multiple members of staff who use data to conduct their everyday jobs but\u00a0do not have overall responsibility, such as the Membership Co-ordinator, Scheme\u00a0Auditors, and Quality Manager.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t
Processing<\/h5>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

All personal data is processed in accordance with GDPR. This means that all\u00a0personal data is processed lawfully, fairly, and in a transparent manner, and is only
used for the purposes of certification\/recertification and other associated\u00a0requirements. ATTMA ensures that personal data is accurate, up-to-date, and not
kept longer than is necessary and that access to personal data is limited to\u00a0authorised personnel only.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t
Policy Statement<\/h6>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Any personal data that is collected during the certification and recertification process\u00a0shall only be used for the purpose of assessing and maintaining certification. The\u00a0collection of personal data shall be limited to what is necessary and relevant to the\u00a0certification process. Personal data shall only be collected with the consent of the\u00a0individual concerned.
All test data uploaded by individuals to the ATTMA lodgement systems may be used\u00a0and shared with pre-approved research bodies and home nation governments. Any\u00a0personal data that may be included in the test data shall be strictly managed in\u00a0accordance with applicable privacy and data protection laws and regulations.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t
Types of Data<\/h6>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Broadly speaking, ATTMA manages four types of data:
1. Tester data:<\/b> In this context, the term \u2018tester data\u2019 refers to the personal data of\u00a0individuals throughout the certification process (applicants, candidates, and
certified persons). This may include names, addresses, contact information, and\u00a0associated company information.
2. Lodgement data:<\/b> This refers to test data that has been uploaded to the ATTMA\u00a0lodgement system. This may include tester data, test location, and test results.
3. Emails:<\/b> This refers to personal data contained in emails that have been sent\u00a0and received by ATTMA while conducting certification business. This may
include names, contact information, and any other personal information\u00a0contained in email correspondence.
4. Letters:<\/b> This refers to personal data contained in letters sent and received by\u00a0ATTMA while conducting certification business. This may include names, contact
information, and any other personal information contained in postal\u00a0correspondence.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t
How is Data Collected<\/h6>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Member companies collect all required data through the following methods:
\u2022 Application Process:
All individuals that wish to join ATTMA are required to complete an online application.
All applicants to any ATTMA are required to have completed the\u00a0assessment process as defined within the relevant Methods &
Routes of Entry publication.
\u2022 Audits (Initial and Surveillance)
All scheme members are subject to auditing, both in order to gain\u00a0certification and then to maintain their certified status.
\u2022 Telephone (Direct Contact)
Members of ATTMA may choose to contact the scheme via\u00a0telephone and ask for details to be updated.
\u2022 Lodgement System (Portal)
Certified persons can upload certificates, update, and edit their\u00a0personal details through the relevant Lodgement system.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t
Data Storage & Security<\/h6>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

In order for ATTMA to conduct its core business operations, different data points may\u00a0be stored in the following locations:
Accounting Software:<\/b> ATTMA uses a cloud-based accounting package to store\u00a0member details for the purpose of creating accurate invoices, credit notes etc.
Security is maintained by way of being:
\u2022 Secured with a username and password.
\u2022 Encrypted with a class 2 SSL certificate.
\u2022 Contracted with the accounting software provider to not share data in\u00a0accordance with its own GDPR processes.
Lodgement System<\/b>: ATTMA operates specialised lodgement systems to record\u00a0conducted testing. Portals are saved on Microsoft servers (Azure platform).
3.5.5 Security for this system is maintained by way of:
\u2022 Contracts containing NDA agreements are in place between the\u00a0member companies and developers that ensure that no data is to be\u00a0shared externally.
\u2022 All data is saved on a Microsoft server and is password protected.
\u2022 The website is secured with a class 2 SSL certificate.
Email Accounts: <\/b>ATTMA may hold some tester data within its email accounts,\u00a0including a list of contacts for the purposes of communication.
“Emailing is hosted by Microsoft Office 365, which provides email services via Microsoft\u2019s email platform. Passwords are set by the users when registering. Additional security is maintained by way of:
\u2022 All data is saved on a Microsoft server and is password protected.
\u2022 Websites are secured with class 2 SSL certificates.
Mobile Telephones (work-phones)<\/b>: ATTMA holds some tester data within\u00a0employees\u2019 work phones. This is required for field-based employees to make and
receive calls whilst out of the office.
Security is maintained by way of:
All mobile phones are secured with a thumbprint and\/or a password to\u00a0enter.
SharePoint: <\/b>ATTMA keeps its data stored within SharePoint systems with each SharePoint only being accessible to the employees of that particular company (local copies of data may be saved to office computers).
For the account to be accessed, a two-step verification is required. Firstly, a complex password requiring alphanumeric, non-alphanumeric characters, and a number is required. To then gain access, a 6-digit password is sent to the Group Managing Director\u2019s mobile telephone each time access is required.
Additional security is maintained by way of:
\u2022 All data is saved on a Microsoft server and is password restricted.
\u2022 Websites are secured with a class 2 SSL certificate.
\u2022 All computers are password protected and have antivirus softwareinstalled to minimise the risk of malware and viruses.
\u2022 Only users authorised by the Group Managing Director can access the files stored in SharePoint.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t
Data Retention<\/h5>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

ATTMA will keep test data that is used as part of the lodgement system indefinitely.\u00a0The legal justification for this is that ATTMA records and test buildings multiple years\u00a0in the future and it is therefore necessary to know who tested a building and when.
Records of testers that are secured within the relevant SharePoint but not\u00a0lodgement, such as contracts, reports, audit reports and corrective actions,\u00a0complaints and other testing-relevant information should be kept securely for a\u00a0period of no less than 10 years.
Testers\u2019 personal data shall be retained for no less than five years after membership\u00a0ceases but may be archived after two years<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t
Destruction of Files<\/h5>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Electronic and paper files are destroyed once the relevant statutory or regulatory\u00a0periods for retention or periods of limitation have elapsed, and the relevant scheme\u00a0is satisfied that there is no further purpose in retaining them.
Disposal of paper copies of documents will take place through confidential waste\u00a0disposal. The disposal of electronically stored material should be done in a manner which preserves confidentiality.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t
Data Files<\/h5>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

All individuals that provide personal data to ATTMA have the following GDPR-related\u00a0rights:
a. Right to Access: Any individual has the right to obtain confirmation as to\u00a0whether or not their personal data is being processed, and if so, to access their
personal data and related information.
b. Right to Rectification: Any individual has the right to request the rectification of their personal data if it is inaccurate, incomplete, or out of date.
c. Right to Erasure: Any individual has the right to request the erasure of their personal data in certain circumstances, such as if the personal data is no\u00a0longer necessary for the purpose for which it was collected.
d. Right to Restriction of Processing: Any individual has the right to request the restriction of processing of their personal data in certain circumstances, such as if the accuracy of the personal data is contested.
e. Right to Data Portability: Any individual has the right to receive their personal data in a structured, commonly used, and machine-readable format, and to\u00a0transmit that data to another controller.
f. Right to Object: Any individual has the right to object to the processing of their\u00a0personal data in certain circumstances, such as if the processing is for direct\u00a0marketing purposes.
g. Right to Withdraw Consent: Any individual has the right to withdraw their\u00a0consent to the processing of their personal data at any time.
6.1.2 At any time, users may access a copy of all the data that is held with their personal\u00a0details. ATTMA acknowledges that it has 30 days to comply with any request.
6.1.3 Access can be granted by making a formal request to the Group Managing Director\u00a0in writing (email requests are considered acceptable).<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t
External Users of Data<\/h5>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

ATTMA will never give or sell applicants\u2019, candidates\u2019, or certified persons\u2019 data to\u00a0any company.
ATTMA will never release information from applicants, candidates, or certified persons without prior express consent except when required by law.
Lodgement data, minus any personal or identifying information, may be provided to\u00a0research bodies that are pre-approved by the relevant member company. The data\u00a0that may be shared will only be:
\u2022 Building type
\u2022 Construction type
\u2022 Result
\u2022 Target
\u2022 Town and\/or postcode of site
Examples of companies that may use this data for research purposes are:
\u2022 Universities
\u2022 Home nation governments*
\u2022 Public health authority
\u2022 HSE
*Home nation governments may periodically request specific data from the scheme,
such as:
\u2022 Membership numbers
\u2022 Complaints
\u2022 Financial information (not for public dissemination)
\u2022 Information regarding third party audits (not for public dissemination)
7.1.6 Should a request be made for data that falls outside of research use (e.g., a\u00a0company wishing to purchase data), we would require permission from each tester in\u00a0order to do so. This would be done on a case-by-case basis. There is no blanket\u00a0\u2018yes\u2019 or \u2018no\u2019 for all data being shared<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t
Enforceable Arrangements<\/h5>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
Members Code of Conduct<\/h6>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

As part of the Application Process that is completed by all applicants when looking to\u00a0join a ATTMA is the \u2018Members Code of Conduct,\u2019 this is a signed agreement
between the relevant company and the member.\u00a0
Part of the Code of Conduct is the requirement that all members are to \u2018inform the\u00a0Scheme Management without delay of matters that can affect your capability to\u00a0continue fulfilling your certification requirements\u2026\u2019<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t
Members Code of Conduct<\/h6>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

ATTMA Members that have been registered with TrustMark are subject to an enhanced Code of Conduct as defined by TrustMark<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Ref: QMA007 – Issue 2.3<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

Data Management Policy The purpose of this document is to establish guidelines and procedures related to\u00a0the management of data within<\/p>\n","protected":false},"author":3,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"elementor_header_footer","meta":{"footnotes":""},"class_list":["post-2140","page","type-page","status-publish","hentry"],"publishpress_future_action":{"enabled":false,"date":"2026-04-26 15:58:59","action":"change-status","newStatus":"draft","terms":[],"taxonomy":"","extraData":[]},"publishpress_future_workflow_manual_trigger":{"enabledWorkflows":[]},"_links":{"self":[{"href":"https:\/\/www.bcta.group\/attma\/wp-json\/wp\/v2\/pages\/2140","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.bcta.group\/attma\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.bcta.group\/attma\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.bcta.group\/attma\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.bcta.group\/attma\/wp-json\/wp\/v2\/comments?post=2140"}],"version-history":[{"count":8,"href":"https:\/\/www.bcta.group\/attma\/wp-json\/wp\/v2\/pages\/2140\/revisions"}],"predecessor-version":[{"id":5182,"href":"https:\/\/www.bcta.group\/attma\/wp-json\/wp\/v2\/pages\/2140\/revisions\/5182"}],"wp:attachment":[{"href":"https:\/\/www.bcta.group\/attma\/wp-json\/wp\/v2\/media?parent=2140"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}