Privacy Policy

1. Introduction

Ingrain Global Standard Private Limited (“IGSPL”, “we”, “our” or “us”) is committed to protecting the privacy, confidentiality and security of personal information entrusted to us.

This Privacy Policy explains how we collect, receive, use, store, disclose and protect personal information when you visit our website, www.ingrain.world, submit an enquiry or certification application, use our services, participate in our training programmes, communicate with us, or otherwise interact with IGSPL.

As a certification body, we understand the importance of confidentiality, impartiality, integrity and responsible information management in certification and auditing activities.

This Policy applies to website visitors, prospective clients, existing clients, client representatives, auditors, technical experts, trainers, trainees, employees, business partners and other individuals whose personal information we process.

2. Scope of This Policy

This Policy covers personal information processed in connection with:

Website visits, contact forms and enquiries.
ISO management system certification applications and related services.
Certification transfers, surveillance audits, recertification and other certification activities.
Compliance certification services, including applicable GMP, HALAL and HACCP programmes.
Lead Auditor training, course registrations, assessments and certificates.
Certificate issuance, verification, publication and status enquiries.
Auditor, technical expert, trainer and employee administration.
Contracts, quotations, invoicing, payments and correspondence.
Complaints, appeals, feedback and other official communications.

This Policy should be read alongside any specific privacy notice, application form, client agreement, training agreement or other contractual terms applicable to a particular service.

3. Information We Collect

We collect only the information reasonably required for the relevant purpose, subject to applicable legal, contractual and accreditation requirements.

3.1 Personal Identification Information

Depending on the service, we may collect:

Full name.
Job title, designation and department.
Business or professional identification details.
Signature or declaration details.
Other identification information required for a legitimate verification or administrative purpose.

3.2 Contact Information

This may include:

Business email address.
Telephone and mobile number.
Business address and correspondence address.
Organization name and website.
Contact details of authorized representatives.

3.3 Organization and Certification Information

When an organization applies for certification or receives certification services, we may process:

Organization name, registration details and business address.
Scope of activities and requested certification standards.
Site locations, number of employees, shifts and operational details.
Relevant processes, products, services and activities.
Application forms, contract review information and supporting documents.
Audit plans, audit reports, findings, corrective actions and related evidence.
Certification decisions, certificate details, certification status and validity dates.
Surveillance, recertification, transfer and certificate dispatch records.
Relevant information concerning the organization's representatives and personnel.

Some of these records may contain personal information about employees, contractors or other individuals associated with the organization.

3.4 Auditor, Expert and Trainer Information

For competence evaluation, audit assignment, training delivery and programme administration, we may collect:

Qualifications, education and professional experience.
Auditor or trainer competence records.
Training and examination results.
Certifications, authorizations and professional credentials.
Availability and assignment details.
Confidentiality and conflict-of-interest declarations.
Performance evaluation and authorization records.
Relevant contractual and payment information.

3.5 Training Information

For training and Lead Auditor programmes, we may collect:

Participant names and contact details.
Course registrations and attendance.
Educational or professional background, where relevant.
Examination, assessment and evaluation results.
Training certificates and certificate verification details.
Feedback and course-related communications.

3.6 Financial and Transaction Information

Where applicable, we may process:

Billing name and address.
Invoice and quotation details.
Payment status and transaction references.
Receipt and refund records.
Tax and accounting information required for business transactions.

Payment card details or banking credentials should not be collected by IGSPL unless there is a specific, secure and legitimate business requirement. Information handled directly by an external payment provider is subject to that provider's applicable privacy terms.

3.7 Website and Technical Information

When you access our website, certain technical information may be collected automatically, depending on the website configuration and your browser settings:

IP address.
Browser type and version.
Device and operating system information.
Pages visited and interactions with the website.
Referral source and approximate location derived from technical information.
Date, time and duration of visits.
Cookie identifiers and website usage information.

The collection of analytics, advertising or other non-essential tracking information will depend on the tools installed and the applicable consent requirements.

3.8 Communication and Supporting Information

We may retain information contained in emails, telephone enquiries, contact forms, feedback submissions, complaints, appeals, uploaded documents and other communications with IGSPL.

Please do not submit unnecessary sensitive personal information through general website forms or email.

4. How We Collect Information

We may collect information:

Directly from you through forms, applications, enquiries, registrations and communications.
From your employer, organization or authorized representative when they arrange certification, auditing or training services.
From auditors, technical experts, trainers and other authorized persons involved in delivering our services.
From accreditation bodies, recognition organizations, training programme partners and other relevant institutions where necessary and permitted.
From public registers, official business records or other legitimate sources for verification and certification-related purposes.
Automatically through website technologies, server logs and analytics tools, where enabled.
From service providers that support our website, communications, document management, payment processing or business operations.

Where information concerns another individual, the person or organization providing it is responsible for ensuring that it has the appropriate authority or lawful basis to share it with us.

5. Purposes for Which We Use Information

We may use personal information for the following purposes:

5.1 Enquiries and Customer Support

Responding to enquiries and requests for information.
Providing quotations and service details.
Arranging meetings and communicating with clients.
Managing complaints, feedback and service requests.

5.2 Certification and Audit Activities

Receiving and reviewing certification applications.
Conducting application and contract reviews.
Determining audit requirements and planning audit activities.
Assigning competent auditors and technical experts.
Conducting or coordinating audits and certification assessments.
Reviewing audit findings and corrective actions.
Supporting impartial certification decisions.
Issuing, maintaining, renewing, suspending, restoring or withdrawing certificates, as applicable.
Managing certification transfers and related records.
Maintaining certification files and required audit trails.

5.3 Certificate Verification and Public Information

Confirming the authenticity and status of certificates.
Responding to legitimate certificate verification requests.
Maintaining a directory of certified organizations where applicable.
Publishing certification information required by applicable accreditation rules, standards, contractual arrangements or law.
Providing status information concerning valid, suspended, withdrawn or otherwise changed certifications, where applicable.

5.4 Training and Competence Management

Processing course registrations.
Delivering training and conducting assessments.
Maintaining attendance, examination and competence records.
Issuing and verifying training certificates.
Administering applicable training programme or recognition requirements.

5.5 Business and Legal Administration

Preparing contracts, invoices and receipts.
Managing payments and accounting records.
Maintaining internal records and operational controls.
Responding to lawful requests from regulators, courts or competent authorities.
Establishing, exercising or defending legal claims where appropriate.

5.6 Website Operation and Security

Maintaining website functionality.
Diagnosing technical errors.
Preventing fraud, unauthorized access and misuse.
Monitoring website performance where appropriate.
Improving user experience using analytics tools, where enabled and permitted.

5.7 Marketing and Updates

Where permitted by applicable law and, where required, with your consent, we may use contact details to send information about services, training batches, events, updates and other relevant communications.

You may opt out of promotional communications using the unsubscribe facility provided or by contacting us. Opting out of marketing will not prevent us from sending necessary service, contractual, certification, security or legal communications.

6. Legal Basis and Permission for Processing

We process personal information in accordance with applicable laws and the requirements relevant to the service concerned.

Depending on the circumstances and the law applicable to the processing, this may include:

Your consent.
Steps requested by you before entering into a contract.
Performance of a contract or administration of a service.
Compliance with legal, regulatory, accreditation or other applicable obligations.
Other lawful grounds available under applicable legislation.

Where consent is required, we will seek it for the relevant purpose. Where processing relies on consent, you may withdraw it through the available method, subject to applicable law.

Withdrawal of consent does not invalidate processing that was lawful before withdrawal. It may also not require deletion of records that must be retained for other lawful purposes.

7. Confidentiality of Certification and Audit Information

IGSPL recognizes the importance of confidentiality in third-party certification activities.

Information obtained or generated during certification and auditing is handled in accordance with applicable confidentiality obligations, contractual arrangements, relevant certification requirements and applicable laws.

We restrict access to client information to authorized personnel and other persons who have an appropriate need to access it for their assigned responsibilities.

Client information may be disclosed where:

The client has authorized the disclosure.
Disclosure is necessary for certification, audit review or certification decision activities.
Disclosure is required by law, a competent authority or a legally binding order.
Disclosure is required by applicable accreditation, recognition or certification programme requirements.
Disclosure is necessary for an authorized complaint, appeal, investigation or review.
Disclosure is otherwise permitted by applicable law and the relevant contractual arrangements.

Where disclosure is legally required, we will handle the disclosure in accordance with applicable requirements, including any applicable restrictions on notifying the client.

Confidential audit evidence, internal audit notes, personal information and other restricted records will not be treated as public information merely because an organization has obtained certification.

8. Public Certification Information and Certificate Verification

To support transparency and confidence in certification, IGSPL may maintain a certificate verification facility or directory of certified organizations.

Depending on applicable requirements, the information made publicly available may include:

Certified organization's name.
Certified organization's relevant location or site.
Applicable management system standard.
Certified scope.
Certificate number.
Initial certification date and validity dates.
Current certification status.
Other information required for verification or by applicable accreditation arrangements.

Only information appropriate for publication will be made available through public verification channels. Personal contact details, confidential audit reports, examination answers, private correspondence and other non-public records will not be published unless there is an appropriate lawful basis or other valid authorization.

Where a client requests corrections to published certification information, IGSPL will review the request and make appropriate corrections in accordance with the applicable certification and record-control requirements.

9. Sharing and Disclosure of Information

IGSPL does not disclose personal information indiscriminately. Information may be shared with the following categories of recipients where necessary and lawful.

9.1 Accreditation and Recognition Bodies

Relevant information may be provided to accreditation bodies, recognition organizations and authorized programme owners for accreditation oversight, witness assessments, competence verification, certification monitoring, complaints, investigations and other applicable requirements.

9.2 Auditors and Technical Experts

Relevant application, site, operational and audit information may be shared with assigned auditors, technical experts, reviewers and authorized certification personnel to enable them to perform their duties.

9.3 Training and Programme Partners

Where a training programme or qualification involves an external recognition or programme partner, relevant participant, assessment or certificate information may be shared as required for programme administration and verification.

9.4 Technology and Business Service Providers

We may use third-party service providers for website hosting, business email, cloud storage, CRM, document management, IT support, payment processing, website analytics and other business functions.

Such providers may process information on our behalf, subject to the applicable arrangements and requirements.

9.5 Clients and Authorized Representatives

We may share relevant information with the client organization, its authorized representatives or other persons involved in the relevant certification or training service, where appropriate.

9.6 Government and Legal Authorities

We may disclose information to a competent public authority, regulator, court, law enforcement agency or other authorized body when required or permitted by applicable law.

9.7 Business Transfers

If a merger, restructuring, acquisition or transfer of business occurs, relevant information may be transferred where legally permitted and subject to appropriate safeguards.

We do not sell personal information to third parties as a business practice. If our actual data-sharing practices change materially, this Policy will be updated as appropriate.

10. International Transfers of Information

IGSPL operates in an environment that may involve international clients, auditors, recognition organizations and service providers.

Where necessary, personal information may be accessed, processed or transferred across national borders for certification administration, training, technical support, record management, accreditation or other legitimate business purposes.

Any such transfer will be subject to applicable legal requirements, relevant contractual safeguards and any restrictions imposed by applicable laws or regulatory authorities.

We do not assume that information can be transferred internationally without restriction. The permissibility of a transfer will be assessed according to the circumstances and applicable requirements.

11. Data Retention

IGSPL retains personal information only for as long as reasonably necessary for the purpose for which it was collected, subject to applicable legal, contractual, certification, accreditation, accounting and record-retention requirements.

Different categories of information may have different retention periods.

Examples include:

Certification records: retained in accordance with applicable certification and accreditation requirements.
Audit records: retained for the period required by applicable standards, procedures, contracts and legal obligations.
Training records: retained as necessary for programme administration, certificate verification, competence evidence and applicable requirements.
Financial records: retained in accordance with applicable accounting, tax and legal requirements.
Enquiry records: retained for a reasonable period to respond to requests and maintain relevant business records.
Website logs and analytics: retained according to the configuration of the relevant systems and the applicable operational or legal requirements.
Complaints and appeals: retained in accordance with applicable procedures and record-retention requirements.

When information is no longer required and there is no lawful reason to retain it, we will take appropriate steps to delete it, anonymize it or otherwise dispose of it securely, subject to applicable law and legitimate record-preservation requirements.

A request to delete information may not result in immediate deletion where retention is required or otherwise permitted by law or applicable certification requirements.

12. Information Security

IGSPL takes appropriate organizational, technical and administrative measures to protect personal information against unauthorized access, disclosure, alteration, loss, misuse or destruction.

Depending on the systems and information involved, these measures may include:

Access restrictions and role-based permissions.
Password and account security controls.
Secure transmission and storage practices where supported.
Backup and recovery procedures.
Staff confidentiality obligations.
Secure document handling and record management.
Appropriate oversight of service providers.
Procedures for identifying and responding to suspected security incidents.

No method of transmission or electronic storage can be guaranteed to be completely secure. However, we aim to apply safeguards appropriate to the nature of the information and the risks involved.

Individuals who suspect unauthorized access to information submitted to IGSPL should contact us promptly using the details provided in this Policy.

13. Cookies and Similar Technologies

Our website may use cookies or similar technologies to support its operation and, where enabled, to understand website usage and improve user experience.

Cookies may include:

Essential cookies: Used for core website functionality, security or other necessary technical purposes.
Analytics cookies: Used to understand website traffic, visitor interactions and performance, where analytics tools are enabled.
Preference cookies: Used to remember selected website settings or preferences, where supported.
Marketing cookies: Used for advertising or marketing measurement only if such technologies are implemented.

The actual cookies used will depend on the website's configuration and the third-party services integrated into it.

Where required, non-essential cookies or tracking technologies will be activated only in accordance with the applicable consent requirements. You may also manage cookies through your browser settings, although disabling certain cookies may affect website functionality.

Where third-party services are used, their collection and processing of information may also be subject to their own privacy policies.

14. Your Privacy Rights

Subject to applicable law, the rights available to you may include:

Requesting information about how your personal information is processed.
Requesting access to information where such access is available under applicable law.
Requesting correction or updating of inaccurate or incomplete personal information.
Requesting erasure of personal information where applicable.
Withdrawing consent where processing is based on consent.
Raising concerns or complaints regarding the processing of personal information.
Using an authorized representative where permitted by applicable law.
Exercising any other applicable statutory rights.

These rights may be subject to verification, legal exceptions, retention obligations and the rights of other individuals.

For certification-related records, a request for correction or deletion will be reviewed carefully to ensure that mandatory certification records, audit evidence, decision records and the integrity of certification activities are appropriately maintained.

How to Exercise Your Rights

You may submit a privacy request using the contact details in Section 19 of this Policy.

Please include sufficient information to help us identify the relevant records and understand your request. We may request reasonable additional information to verify your identity or authority before processing the request.

We will review and respond to requests in accordance with applicable law and our relevant procedures.

15. Complaints and Privacy Grievances

If you have a concern regarding the collection, use, disclosure, retention or security of your personal information, you may contact IGSPL using the details provided below.

Please describe the nature of your concern and provide relevant details so that we can review it appropriately.

We will acknowledge, investigate and respond to privacy grievances in accordance with applicable law and our grievance-handling arrangements.

Where applicable statutory remedies are available and a concern remains unresolved, you may pursue the remedies available under the relevant law.

16. Third-Party Websites and Services

Our website may contain links to external websites, verification portals, accreditation bodies, training partners or other third-party services.

IGSPL does not control the privacy practices, security measures or content of external websites unless expressly stated otherwise.

When you access a third-party website or service, you should review its applicable privacy policy and terms of use.

The inclusion of a link does not, by itself, mean that IGSPL endorses every privacy practice of the external website.

17. Children's Privacy

IGSPL's certification and professional training services are generally intended for organizations, working professionals and other appropriate business or professional participants.

We do not knowingly collect children's personal information through general website forms unless there is an appropriate and lawful reason to do so.

Where a service involves a child or a person requiring special protection under applicable law, we will handle the relevant information in accordance with the applicable legal requirements.

If you believe that a child has provided personal information to us inappropriately, please contact us so that we can review the matter and take appropriate action.

18. Changes to This Privacy Policy

IGSPL may update this Privacy Policy to reflect changes in our services, website functionality, technology, operational procedures or applicable legal and accreditation requirements.

The updated version will be published on our website with a revised “Last Updated” date.

Where required by applicable law, we will provide additional notice or seek consent for material changes to the relevant processing activities.

We encourage visitors and clients to review this Policy periodically.

19. Applicable Law

This Privacy Policy is intended to be interpreted in accordance with applicable laws governing the processing and protection of personal information.

For processing within the relevant scope of Indian law, this may include the Digital Personal Data Protection Act, 2023, the Digital Personal Data Protection Rules, 2025, and other applicable legislation, to the extent in force and applicable to the relevant processing.

Where services, individuals or processing activities are subject to other applicable privacy laws, including laws in jurisdictions where IGSPL operates or provides services, the relevant legal requirements will apply to the extent required.

Nothing in this Policy is intended to exclude or limit a right or obligation that cannot lawfully be excluded or limited.