Data Security Declaration

Company Statement of GDPR Compliance

Company Name…………ISAAP Ltd……………………………………………….

GDPR applies to processing carried out by organisations operating within the EU. It also applies to organisations outside the EU that offer goods or services to individuals in the EU.

	Yes	No
(1) We confirm that GDPR applies to our company	YES

If you have answered no to this question please detail why you believe that GDPR does not apply to your company

	Yes	No
(2) We confirm that the company named above and who is applying for ISAAP Compliance Accreditation is GDPR compliant.	N/A

	Yes	No
(3) We confirm that we have a GDPR compliant privacy policy/data notice	YES

Please confirm where this notice is displayed and/or how it is provided eg on your website/via email/hard copy

	Yes	No
(4) Our Privacy Notice/Data Policy Identifies who the Data Controller is	YES

	Yes	No
(5) Our Privacy Notice/Data Policy Identifies the full name of the legal entity, postal address and email contact address	YES

	Yes	No
(6) Our Privacy Notice/Data Policy Identifies the website(s) to which the policy applies	YES

Please confirm the URLs of the website(s) that your privacy notice/data policy applies to

www.isaap.org

	Yes	No
(7) Our Privacy Notice/Data Policy clearly identifies the data we collect about individuals and, if sensitive data is collected, we highlight this separately.	YES
	Yes	No
(8) Our Privacy Notice/Data Policy clearly identifies how we collect data, and via which methods	YES

	Yes	No
(9) Our Privacy Notice/Data Policy clearly identifies how we use the data that is collected	YES

	Yes	No
(10) Our Privacy Notice/Data Policy clearly identifies purposes for processing personal data	YES

	Yes	No
(11) Our Privacy Notice/Data Policy clearly identifies disclosure of personal data	YES

	Yes	No
(12) Our Privacy Notice/Data Policy clearly identifies if information is transferred internationally	YES

	Yes	No
(12) Our Privacy Notice/Data Policy clearly identifies data security and what steps are in place to secure data	YES

	Yes	No
(13) Our Privacy Notice/Data Policy clearly identifies data retention processes and the periods of time data is retained for	YES

	Yes	No
(14) Our website(s) as detailed in (5) use cookies	YES

	Yes	No	N/a
(15) We confirm that, where applicable, the website(s) detailed in (5) identify that cookies are accessing the website	YES

	Yes	No	N/a
(16) We confirm that we have either a separate cookie policy or notice or that information regarding our cookie policy and usage is detailed within the main data/privacy notice as displayed on the website(s), as detailed in (5)	YES

	Yes	No
(17) We confirm that our company collects data via the website(s) as detailed in (5), whether this be via a contact form, booking form or other form of collection	YES

	Yes	No
(18) We confirm that the first point of contact or collection of data via the website(s), as detailed in (5), includes a GDPR compliant statement/notice on data collection, usage and storage and includes the information as detailed in (1) to (17), as applicable	YES

The GDPR introduces a duty on all organisations to report certain types of personal data breach to the relevant supervisory authority. You must do this within 72 hours of becoming aware of the breach, where feasible.

	Yes	No
(19) We confirm that we have established procedures in place for ensuring any data breach is reported within the required timeframes, regular reviewing systems of data collection, usage and storage	YES

	Yes	No
(20) We confirm that we have robust breach detection, investigation and internal reporting procedures in place and methods for recording data breaches regardless of whether we are required to notify.	YES

	Yes	No
(21) Where appropriate we confirm the use of pseudonymisation and encryption, and that security measures ensure the confidentiality, integrity and availability of our systems and services and the personal data we process within them. We have an information security policy (or equivalent) and take steps to make sure the policy is implemented.	YES

(21) We wish to add the following in relation to our GDPR Compliance Declaration (please detail if applicable any further information you wish to detail)

ISAAP Ltd is a centralised organisation. No agent of the company retains personal data of any individual or confidential information of any business. All data is managed and secured centrally by the company CEO.

We confirm the person named below is authorised to complete this form on behalf of the company named and that the information and confirmation provided is true and correct.

Signed by	David Baker
Full name	Mr David Baker
Position within company	Data Protection and Web Manager
Date Form Completed	04 April 2024

This strategy is reviewed annually on 1^st September by the Chief Executive Officer.

The Chief Executive Officer is responsible for the successful implementation of the ISAAP Ltd Environmental Policy

Stephen Martin MIH – CEO & Director – ISAAP Ltd. – 1^st September 2025

Data Security Declaration

Policies

Information