Privacy Policy
Last updated 11 August 2026
This web site is owned and operated by isoassured Ltd.
isoassured Limited is a company registered in Scotland - registration No. SC383220
Registered address - 5 South Charlotte Street, Edinburgh, EH2 4AN
email:
This notice covers isomanaged.com and the alphaZ document store at isomanaged.com/alphazdocuments. It is a complete statement of what we collect through this web site and what we do with it.
isoassured Ltd is the data controller for the personal data described here. We comply with the UK General Data Protection Regulation and the Data Protection Act 2018. This web site is hosted in the UK.
Most of what we hold is company information, not personal data
It is worth saying this at the start, because it shapes everything below. Our business is management system documents. When you buy a toolkit or ask us to prepare a register, what we need is information about your organisation: its name, its logo, its sites, its activities, the standards it works to. Information about a company is not personal data and data protection law does not apply to it.
The personal data we hold is limited and mostly incidental: the name and email address of the person placing an order or making an enquiry, and any names that happen to appear inside documents a customer securely shares with us. We do not build profiles, we do not enrich our records from other sources, and we do not sell anything to anyone.
Personal Information we collect on this web site
Everyone who visits
IP address, web browser, operating system, internet service provider, approximate location, and cookie and tracking information. What we can see, and what you can switch off, is set out in the Cookies section below.
If you make an enquiry or contact us
Your name, email address, telephone number, company name, and whatever you tell us in your message. If you have done business with us in the past we may still hold this.
If you buy from the alphaZ store
Your name, email address, billing address, company name and details of what you ordered. Payments are handled by Stripe and GoCardless. Card details are entered on their systems, not ours, and we never see or store them.
If you create an account to download files
A username and password, a record of your logins including the IP address each login came from, and a record of the files you download. This is how we tell a genuine account from one that is being shared or has been compromised.
If you subscribe to our updates
Your email address and, where you give it, your name and company. You can unsubscribe from any mailing using the link in it.
If you buy remote support or document preparation
See the section below. In short, your company name and logo, and any documents you choose to securely share with us.
Remote support and document preparation
Remote support can be bought through this web site. It is the service where we help you set up, tailor or complete your management system documents.
To do it we need your company name and logo, so that the documents we prepare carry your branding. That is company information, not personal data.
We will also usually ask you to securely share company documents with us, so that we can prepare things like your hazard and risk assessment register, your environmental aspects register and your legal register. We ask for information about your organisation, its sites and its activities. We do not ask for personal data, and you should not share any with us that we have not asked for.
In practice, documents of this kind sometimes contain the names or job titles of your staff, for example the person responsible for a control or a task. Where that happens we are handling that personal data on your behalf and on your instructions, as your processor. We use it only to carry out the work you have asked for and for nothing else.
Any document you securely share with us that contains personal data is deleted once the job is finished. Company documents and form templates that contain no personal data are kept, so that we can pick the work back up when you come to us for an update or a revision.
We never ask you to email documents to us. Email is not a secure way to send files. Instead we set up secure file sharing for each job, normally using Dropbox, and both the files you supply and the finished documents we return travel that way. We do not use or transfer anything you provide out of Dropbox for any other purpose - https://www.dropbox.com/en_GB/privacy.
Use of personal information
We use the information described above to:
- supply the documents, subscriptions and support you have bought, and deal with your order
- answer your enquiries and provide customer support
- prepare and tailor documents on your instructions
- send you the updates you have asked to receive
- keep proper accounting and tax records
- keep download accounts secure, and detect accounts being shared or misused
- understand how the web site is used and improve it, and measure whether our advertising works
We rely on the following lawful bases. Contract, where we need the information to supply what you have bought. Legal obligation, for accounting and tax records. Consent, for marketing emails and for the optional cookies described below, either of which you can withdraw at any time. Legitimate interests, for answering enquiries, for keeping our own business records, and for protecting our accounts and files from misuse, where doing so does not override your rights.
Our terms and conditions require that account login details are not shared. If the login record suggests an account is being shared or has been compromised, we look into it and may deactivate the account. A person makes that decision. It is not automatic.
Who else sees your information
We use a small number of established suppliers to run the business. Each of them sees only what they need:
- Stripe and GoCardless - payment processing - https://stripe.com/gb/privacy and https://gocardless.com/privacy/
- Mailchimp - sending our email updates - https://mailchimp.com/legal/privacy/
- Dropbox - secure exchange of documents - https://www.dropbox.com/en_GB/privacy
- Google and Microsoft - web site analytics and advertising measurement, only where you have accepted the optional cookies below
- our web hosting provider, and our accountants and professional advisers where they need it
We may also disclose information where we are required to by law or by a regulator.
We will never sell your data, and we will never share it with a third party who would use it for anything unconnected with providing our services.
Some of these suppliers process information outside the UK. Where they do, they are required to protect it to UK standards through the safeguards that data protection law provides for.
Data Retention
We keep the documents we prepare for customers, and the company information they are built from, indefinitely. Customers come back to us years later for updates, revisions and re-certification work, and being able to pick up where we left off is the service. It is also, overwhelmingly, company information rather than personal data.
Order and payment records are kept for at least six years, as company and tax law requires.
If you subscribe to our email updates we keep your details until you unsubscribe.
Documents you securely share with us for a piece of work are treated in two ways. Anything containing personal data is deleted at the end of the job. Company documents and form templates, which contain no personal data, are kept indefinitely for the reason above.
If you would like us to delete information we hold about you, ask us and we will, unless we are required to keep it.
Data Subject Access
You have the right to be informed about what we do with your personal data, and the rights to access it, have it corrected, have it erased, restrict how we use it, receive a copy of it in a portable form, object to our using it, and not be subject to decisions made purely by automated means. We do not make automated decisions about anyone.
To exercise any of these, email
If you are not happy with how we have handled your information you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, or on 0303 123 1113. We would rather you came to us first so we can put it right.
Cookies
Cookies are small data files stored on your device when you visit a website. We use them on this site and on the alphaZ document store at isomanaged.com/alphazdocuments.
We set only the cookies needed to run the site unless you tell us otherwise. When you first arrive you are asked whether you are willing to accept analytics and advertising cookies. Until you say yes, none are set. If you say no, none are set. Your answer is remembered for six months, after which we ask again.
You can change your answer at any time using the Cookie Settings link at the foot of every page. Withdrawing permission also deletes the cookies already placed under it.
Strictly necessary cookies
These keep the site working. They hold your session, your basket, your chosen currency and language, and they record the cookie choice you made. The site cannot function without them, so they are always set and we do not ask permission for them.
| Name | Set by | Purpose | Expires |
|---|---|---|---|
| OCSESSID | This site | Keeps your basket and login together across pages in the alphaZ store | End of session |
| currency | This site | Remembers the currency you chose in the store | 30 days |
| language | This site | Remembers the language you chose in the store | 30 days |
| Joomla session cookie (a random string of letters and numbers) | This site | Keeps your session on the main site | End of session |
| az_consent | This site | Records your cookie choice so we do not ask again | 6 months |
Analytics cookies, only with your permission
We use Google Analytics to count visits and see which pages and documents people use, so we know what to improve. If you decline, Google Analytics still runs but sets no cookies and cannot recognise you between visits.
| Name | Set by | Purpose | Expires |
|---|---|---|---|
| _ga | Distinguishes one visitor from another | 2 years | |
| _ga_ZB1PR0KY06 | Keeps track of the visit for this particular site | 2 years |
Advertising cookies, only with your permission
We advertise on Google and on Microsoft Bing. These cookies let us see which adverts led to a sale, so we are not paying for ones that do not work. They can also be used to show you our adverts on other websites. If you decline, both services still load but set no cookies, and we receive only anonymous, aggregated information.
| Name | Set by | Purpose | Expires |
|---|---|---|---|
| _gcl_au | Records that you arrived from a Google advert, so a later purchase can be matched to it | 90 days | |
| _uetsid | Microsoft | Identifies this visit for Microsoft Advertising | 1 day |
| _uetvid | Microsoft | Identifies a returning visitor for Microsoft Advertising | 13 months |
| MUID | Microsoft | Recognises the same browser across Microsoft sites | 13 months |
Who else receives this information
Where you have given permission, Google and Microsoft act as separate data controllers for the information their cookies collect, and both may transfer it outside the UK. Their own notices explain what they do with it: Google privacy policy and Microsoft privacy statement.
Turning cookies off in your browser
You can also block or delete cookies in your browser settings. Doing so for the strictly necessary cookies above will stop parts of the store working, including the basket and the checkout.
Security
We have procedures in place for the protection of personal information and comply in full with relevant data protection legislation. Your data is held securely on this web site and on our own computer network and software systems, and on cloud services based in the UK or the EEA. Documents are exchanged using encrypted file transfer.
Changes to this notice
We review this notice at least once a year and update it whenever what we do changes. The date at the top tells you when it last changed.
If you have a question about any of this, email
