Published policy
Data Protection Policy v1.3 · PDFPublished November 2025. The policy covers personal data, assessment records, access controls, permitted sharing, training, incident management and retention. For this public website, also read our privacy notice.
Assessment data and sharing
EPB assessment data is subject to the relevant EPB legislation and scheme requirements as well as data-protection law. It must not be sold, disclosed or reused simply because it has been collected for an assessment. Requests for evidence or data sharing should come through the scheme’s approved process.
Where authorised sharing is permitted, the purpose, recipient and authority for release must be recorded. Legal requirements take precedence where policy or scheme wording conflicts with them.
Keeping records
The published policy distinguishes assessor job evidence, retained by the member for at least 15 years, from audit evidence supplied to Kaizen, retained only as necessary and not beyond 10 years from the audit date under its stated schedule. Other records are retained according to their purpose and applicable legal or regulatory requirements.
Requests and concerns
Contact the Data Protection Officer through hello@kaizencertification.co.uk or write to the registered office. Explain the information or issue involved; we may need to verify your identity before releasing records.
You can also raise a concern with the Information Commissioner’s Office.