Home › Privacy notice
Privacy notice
How Westmark Assurance handles personal data
This notice covers the register site, the Westmark hub and assessment activity. It is referenced at clause 10 of the Scheme Terms. Version 1.2, September 2026.
Who we are
Westmark Assurance is a trading name of Ross Macdonald Consultancy Ltd, registered in Scotland, company number SC848204. We are the controller of the personal data described in this notice. Contact: hello@westmarkassurance.co.uk, 1st Floor, 2 West Regent Street, Glasgow, G2 1RW.
What we process and why
| Activity | Personal data | Purpose and lawful basis | Retention |
|---|---|---|---|
| Enquiries and scoping | Names, positions and contact details of the people we deal with | To establish eligibility and agree an assessment. Legitimate interests, then contract | Seven years from file closure, or twelve months where no assessment follows |
| Assessment | Names and positions of accountable individuals, senior individuals, procedure owners and counterparts. Interview notes recording substance and role, not attributed to named workers in any output. Screening status recorded as held or not held with the date. Rota extracts recorded as numbers by shift | To conduct the assessment and reach an outcome. Our legitimate interests, and those of the organisation assessed, in operating and obtaining independent assurance. The individuals concerned are not parties to our agreement with that organisation, so we do not rely on contract for their data | Seven years from file closure |
| Public register | Organisation name, premises or event, outcome, dates and references. No individual is named on the register | To allow third parties to verify a claim. Our legitimate interests in a register that can be relied on, which is the purpose the organisation applied for | Twelve months after the outcome lapses, is suspended, withdrawn or surrendered |
| Assessor authorisation | Names, contact details, qualifications, screening records to BPSS, the statutory declaration and calibration results | To authorise and manage assessors. Contract with the assessor, and our legitimate interests in verifying that people we authorise are fit to hold that authorisation | Seven years after authorisation ends |
| Licensed Partners and commissioning parties | Names, positions and contact details | To administer licences and commissions. Contract | Seven years after the relationship ends |
| Complaints and appeals | Names and correspondence | To determine complaints and appeals. Legitimate interests | Seven years |
| Hub accounts and sign-in | Name, work email, role, sign-in times, IP address and device details | Access control and security of the Westmark hub. Legitimate interests in securing the scheme systems | Two years |
| Hub notifications | Name, work email, task and engagement references | Telling hub users what needs their attention. Contract and legitimate interests | Two years |
| Assessor competence file | Names, contact details, screening outcome dates, competence and CPD records, declarations | Keeping Authorised Assessors competent and independent. Contract with the assessor, and our legitimate interests in evidencing the competence behind every outcome we issue | Seven years from end of authorisation |
| Disclosure consent | Name of the person giving or withdrawing consent, the wording agreed to, the time and the IP address | Evidence of consent to disclose to a commissioning party. Consent | Seven years from expiry, withdrawal or surrender of the outcome |
| Guidance page contact form | Name, organisation, email, telephone if given, the options ticked and any message | To reply to your request and, if you asked, to email you when the guides are updated. Consent, which you can withdraw at any time | Twelve months from your last contact, or until you ask us to delete it. Seven years where an assessment follows |
Who we share it with
Authorised Assessors and Technical Reviewers engaged for the assessment concerned, bound by confidentiality terms. A commissioning party, to the extent set out in the Scheme Terms at clause 8 and in the Commissioning Party Engagement Letter. Our IT, document storage and email providers as processors. Anyone entitled to it by law. We do not disclose assessment findings to the Security Industry Authority, the Ministry of Defence, a Contracting Authority, a licensing authority or a police force except where required by law or with the organisation's consent.
Where we hold it
In the United Kingdom, on systems we control or on UK or EU hosted services under UK GDPR compliant terms. Assessment material is held under access controls confining it to the people working on that assessment, and floor plans and vulnerability assessments are held only for the period technical review requires.
Transfers outside the United Kingdom
Assessment material, hub records and scheme documents stay in the United Kingdom or the European Economic Area. There are two exceptions, and they apply only to visitors to this website. Assessment data stays within the Area. Some of the large photographs on these pages are loaded directly from Unsplash. When a page loads, your browser asks Unsplash's servers for the image, and those servers see your network address and browser details. We hold no contract with Unsplash covering that request and we send it nothing about you. The site sets a no-referrer policy, so the page you were viewing is not passed on. Blocking images.unsplash.com in your browser leaves every page fully readable. Nothing you send us travels that way.
The optional contact form on the guidance page is processed by our hosting provider, Netlify, which may hold submissions outside the United Kingdom under its data processing terms. If you would rather your details stayed off that route, email hello@westmarkassurance.co.uk instead.
Where we later add a supplier outside the UK or the EEA, we do so on the basis of UK adequacy regulations or the International Data Transfer Agreement or Addendum, and we record the assessment behind that decision.
Legitimate interests
Where the table above relies on legitimate interests, we have weighed our interest in running a credible assurance scheme against the interests and rights of the people concerned. The data involved is workplace data of a limited kind, the people it concerns are told about it, findings are never attributed to a named worker, and you can object at any time using the contact address below. We will stop unless we can show compelling grounds that override your objection. A record of the balancing exercise is available on request.
Automated decisions
We make no decision about you by automated means alone, and we do not profile you. Scoring in the hub supports an assessor's judgement and does not replace it. Every outcome is decided by a person.
The Westmark hub
Clients, Licensed Partners, Authorised Assessors and Westmark staff use the Westmark hub, our online system for running the schemes. Access is by named account only. Westmark staff and assessors sign in through Microsoft Entra ID with multi-factor authentication. Partners and clients sign in by a one-time link followed by an authenticator app. The hub sets only the cookies it needs to keep you signed in and for security, and none for advertising or analytics.
The hub records every sign-in and every change made to a record, with the account, time and network address, so that we can show who did what and detect misuse. It is hosted on Supabase for the database and files in the London region, and on Netlify for pages and functions, both under UK GDPR compliant terms, with a retention copy of issued documents held on our own Microsoft 365 tenant. A register of our processing activities is maintained in the hub and is available on request.
Where an assessment is commissioned by a prime contractor, landlord, licensing authority, insurer or other commissioning party, we disclose the outcome to that party only where the assessed organisation has consented in the hub or in writing. Section scores are disclosed only with a separate consent. Consent can be withdrawn at any time from the hub, and the withdrawal is recorded in the same way as the consent.
This website
westmarkassurance.co.uk sets no cookies, runs no analytics and carries no advertising or third-party tracking. The only form on the site is the optional contact form on the guidance page. Its submissions are received and stored by our hosting provider, Netlify, and emailed to us. Downloading a guide never requires it. Our hosting provider records ordinary server logs, including IP addresses, for security and availability. Following a link from here into the hub takes you to a signed-in system covered by the section above.
Some of the large photographs on this site are loaded directly from Unsplash, so your browser asks its servers for them and those servers see the request and your network address. Everything else, including the brochure cover images, comes from our own server. No other outside address is loaded by any page here.
Your rights
You may ask for access to the personal data we hold about you, for correction of inaccurate data, for erasure where we have no continuing basis to hold it, for restriction of processing, and to object to processing based on legitimate interests. Where we hold data under a contract with you or with your consent, and hold it by automated means, you may also ask for a copy in a portable form or ask us to send it to someone else. Where we rely on consent you may withdraw it at any time, and withdrawing it does not affect what was done beforehand. We respond within one month. Write to hello@westmarkassurance.co.uk. You may complain to the Information Commissioner's Office at ico.org.uk.
Workers interviewed during an assessment
If you are interviewed during an assessment of your employer or the place you work, the notes record what was said and your role and worker category. They do not name you in any output, report or disclosure. Your employer has been asked to tell you that an assessment is taking place and that notes will be held by us. You may ask for a manager to be present, and the choice is yours.
Changes
This notice is reviewed annually and on any change to how we process personal data. Version 1.3, September 2026. Version 1.3 adds the guidance page contact form. Version 1.1 added the Westmark hub, the sign-in and activity records it keeps, the assessor competence file and disclosure consent. Version 1.2 restates the lawful basis for assessment data, the public register and assessor records, and adds sections on transfers outside the United Kingdom, legitimate interests and automated decisions.