Privacy Policy — Certify Supplier Portal

Last updated: April 2026

Who we are

The Certify Supplier Portal is operated by Tom Carter trading as Joule ("we", "us", "our").

  • Data Controller: Tom Carter
  • Trading name: Joule
  • Email: tom@getjoule.co.uk
  • Website: supplier.getjoule.co.uk
  • ICO Registration Number: [PENDING — to be added on registration]

What data we collect

When suppliers use the portal, we may collect:

  • Supplier contact names
  • Business email addresses
  • Organisation names
  • Plant model and checklist data uploaded or entered by suppliers
  • Login and authentication data, including magic-link tokens and session information
  • Technical and security logs, such as IP address, browser data, and audit activity

We do not intentionally collect payment card data through the portal.

Why we collect it and our lawful basis

Data Purpose Lawful Basis
Contact and organisation details Providing supplier access and account management Contract
Plant model and checklist submissions Operating the supplier portal and review workflow Contract
Login and token data Authentication and security Legitimate interests
Security and audit logs Preventing misuse and maintaining platform integrity Legitimate interests

How long we keep your data

  • Account and organisation data: for the duration of the supplier relationship and a reasonable period afterwards
  • Checklist and model submission history: retained as part of the product record and audit trail
  • Authentication and security logs: retained only as long as needed for security and compliance purposes

Who we share data with

We do not sell personal data. We share it only with:

  • Hosting providers used to run the portal
  • Email providers used to send login links and operational emails
  • Internal Certify services where needed to review, approve, or publish supplier-submitted content

Your rights

Under UK GDPR, you have the right to:

  • Access
  • Rectification
  • Erasure
  • Restriction
  • Portability
  • Object

To exercise your rights, email tom@getjoule.co.uk with subject Data Request.

Complaints

You can complain to the Information Commissioner's Office (ICO):

  • Website: ico.org.uk/make-a-complaint
  • Phone: 0303 123 1113

Changes to this policy

The latest version of this policy will be available at /privacy on the Supplier Portal site.