Privacy & Data Use Notice

What information CertCase handles

• Account and sign-in data: name, email address, login and session information.
• Technician profile: contact details, roles, countries, nationalities, availability and preferences.
• Certificates, medicals and authorisations, with issue and expiry dates, and the evidence files uploaded for them.
• Competence and practical experience: logbook entries, supporting evidence, assessments and sign-offs.
• Employment and deployment information: organisation membership, project and rotation assignments, employer and deployment details recorded for an assignment.
• Organisation and user information for client, supplier and training-provider accounts.
• Access grants and share links, and audit logs of key actions (access, changes, verifications, downloads).
• Opportunities activity when signed in: vacancies viewed, "View original job" clicks and statuses you record yourself.

How it is used

To run CertCase: keeping your records, working out readiness against published role and project requirements, planning crews, supporting competence assessment, showing relevant opportunities, and enabling the sharing you or your organisation authorise.

Who can see it

Your records are private by default. An organisation can see your profile, certificates and evidence where you have granted access, through a share link you create, or where you work for or through that organisation on CertCase. You can revoke access grants and share links at any time. Public share links show a record's verification status, not reviewer details or private evidence.

Verification is separate from storage

Uploading a document stores it; it does not verify it. Each record shows its own status — for example awaiting review, verified (with who verified it, where recorded), rejected, or "Recorded – not evidenced" where there is no supporting evidence. Verification is carried out by authorised reviewers, such as your organisation's administrators or a training provider issuing a result. CertCase does not independently check certificates with issuing bodies unless a record says so.

Sensitive / health data

Some documents (for example medical or fitness-to-work certificates) may contain health-related information. Only upload fit-to-work confirmations where genuinely needed for deployment — never diagnoses, medical reports or other detailed health records.

Service providers

CertCase uses service providers to operate: cloud hosting, database and file storage; AI services that help read uploaded certificates, CVs and requirement documents so you do not have to retype them; email delivery; and a public IP-lookup service used to record the IP address when you accept a notice. Embedded videos use YouTube's privacy-enhanced mode.

Cookies and browser storage

CertCase does not use advertising or third-party analytics cookies. Your browser stores what is needed to keep you signed in, your language choice, and the campaign link you arrived from (if any) so sign-ups can be attributed.

Retention

Records are kept while your account is active and as needed to provide the service and keep audit history. Expired certificates stay visible on your record. Raw Opportunities activity events are deleted automatically after 400 days. Evidence files are kept in private storage and are never publicly accessible.

Your rights and requests

To ask for a copy of your information, a correction, or deletion of your account, contact tp@certcase.com. Some records may need to be kept where an organisation has a legitimate audit need, and we will tell you if that applies.