Privacy statement
How the Agency processes personal data
A body that certifies data protection is obliged to be exact about its own processing. This statement describes what is collected through this website, why, on what basis, and for how long.
Controller
European Digital Certification Agency, Narva mnt 5, 10117 Tallinn, Estonia, registration number 16842197, is the controller for the processing described in this statement. Enquiries about data protection are addressed to official@edca.pro.
What is processed and why
| Processing | Data | Lawful basis | Retention |
|---|---|---|---|
| Applications for certification | Organisation particulars; name, role, email and telephone number of the contact person; description of the proposed scope | Steps taken at the request of the data subject prior to entering into a contract, Article 6(1)(b); legitimate interests in assessing eligibility, Article 6(1)(f) | Six years from the close of the application or the end of the certification relationship |
| Enquiries sent through the contact form | Name, organisation, email address, subject and content of the enquiry | Legitimate interests in responding to correspondence, Article 6(1)(f) | Two years from the last exchange |
| Public register of certified organisations | Organisation particulars, certificate number, scope, level, dates and status. No personal data of individuals is published in the register. | Legitimate interests in the verifiability of certificates, Article 6(1)(f); performance of the certification contract, Article 6(1)(b) | Published for the period of validity; retained as a historical record of decisions taken |
| Server logs | IP address, request line, response status, user agent, timestamp | Legitimate interests in the security and availability of the service, Article 6(1)(f) | 14 days |
| Administration console access | Session identifier, IP address, times of access | Legitimate interests in securing access to the register, Article 6(1)(f) | Session duration; access records 12 months |
Cookies
This website sets no analytics, advertising or tracking cookies, and embeds no third-party content. Consequently no consent banner is presented.
One strictly necessary cookie is set, and only for members of the Agency's staff who sign in to the administration console: a session cookie that identifies an authenticated session and is deleted when the session ends. Visitors to the public parts of the site receive no cookies at all.
Recipients and transfers
Personal data is processed by the Agency's own personnel and by its hosting provider acting as a processor. It is not sold, and it is not disclosed to third parties except where required by law or where disclosure is necessary to the conduct of an assessment with the knowledge of the organisation concerned.
Data is hosted within the European Economic Area. Where a transfer to a third country becomes necessary, it takes place only under an adequacy decision or with appropriate safeguards under Chapter V of Regulation (EU) 2016/679.
Rights of data subjects
Data subjects have the right of access (Article 15), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20), and the right to object to processing based on legitimate interests (Article 21).
Requests are addressed to official@edca.pro and are answered within one month. Where a request concerns data that forms part of the record of a certification decision, the Agency may retain the record for the purposes of establishing, exercising or defending legal claims, and will explain the reasons.
A data subject who considers that processing infringes the Regulation may lodge a complaint with the supervisory authority of the Republic of Estonia or of their habitual residence.
Security
The site is served exclusively over TLS. Access to the administration console requires authentication and is restricted to authorised personnel. Sessions are held server-side and expire automatically. Changes to the register are recorded in an append-only log that is not editable through the console.
Changes to this statement
Material changes are published on this page with a revised date. This version is dated 1 August 2026.