A. General Information
Last updated: July 2026
ASG Cert GmbH (“ASG Cert”, “we”, “our” or “us”) is committed to protecting the privacy and personal data of all individuals with whom we interact. We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the German Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG) and all other applicable data protection legislation.
This Privacy Policy explains how we collect, process, use, disclose and protect personal data when you visit our website, contact us, enquire about our services or engage us to perform certification, auditing or related conformity assessment services.
1. Controller
The controller responsible for the processing of personal data is:
ASG Cert GmbH
Pedro F. Pitzinger
Innere Wiener Straße 30
D-81667 München
Germany
Email: mail@asg-cert.com
Further information about ASG Cert can be found in the Legal Notice (Imprint) on this website.
2. Data Protection Contact
If you have any questions regarding this Privacy Policy or wish to exercise your rights under applicable data protection legislation, please contact:
ASG Cert GmbH
Pedro F. Pitzinger
Innere Wiener Straße 30
D-81667 München
Germany
Email: mail@asg-cert.com
3. Scope of this Privacy Policy
This Privacy Policy applies to the processing of personal data collected
- when visiting our website
- when contacting us by email, telephone or via our contact form
- during the preparation, performance and administration of certification, audit and related services
- during contractual relationships with customers, suppliers and business partners
- where required by law or regulatory obligations.
This Privacy Policy does not apply to third-party websites that may be linked from our website.
4. Definitions
For the purposes of this Privacy Policy, the terms “personal data”, “processing”, “controller”, “processor”, “recipient”, “consent” and “data subject” shall have the meanings assigned to them in Article 4 GDPR.
5. Categories of Personal Data
Depending on the nature of our relationship with you, we may process the following categories of personal data:
Contact Data
- name
- title
- job title and organisational function
- employer
- business address
- business location and country
- telephone number
- email address
Customer and Contract Data
Where you request our certification services, we may process:
- customer master data
- contractual information
- project information
- certification records
- audit documentation
- communication records
- invoicing information
- information relating to customer representatives and designated contact persons
- audit participation and interview records
- corrective action and non-conformity records
- operational and certification-related site information
Where audit reports identify individual contact persons of the customer organisation (for example management representatives, quality managers or interview participants), such information is processed solely to the extent necessary for planning, conducting and documenting certification activities.
ASG Cert does not intentionally process special categories of personal data within the meaning of Article 9 GDPR unless this is exceptionally required by law or becomes unavoidable in the course of providing our services.
Auditor and Business Partner Data
- professional qualifications
- competence and training records
- CVs and work experience
- language skills
- contractual information
- business contact details
- payment and banking information
Website Data
When you visit our website we may automatically collect technical information including:
- IP address
- browser type and version
- operating system
- date and time of access
- referring website
- requested pages
- server log information
- device information
6. Purposes of Processing
We process personal data only for specified, explicit and legitimate purposes.
These include in particular:
- responding to enquiries
- communicating with prospective customers
- preparing quotations
- concluding and administering contracts
- planning and conducting certification and audit activities
- issuing certificates
- customer relationship management
- compliance with legal obligations
- accounting and tax obligations
- exercising or defending legal claims
- maintaining the security and functionality of our website
- preventing misuse and ensuring IT security
Personal data will not be processed for purposes incompatible with these purposes unless required or permitted by applicable law.
7. Legal Basis for Processing
Where required by applicable law, ASG Cert processes personal data on one or more of the following legal grounds:
Article 6 (1) (a) GDPR
where the data subject has provided consent.
Article 6 (1) (b) GDPR
where processing is necessary to take steps prior to entering into a contract or for the performance of a contract.
Article 6 (1) (c) GDPR
where processing is necessary for compliance with a legal obligation.
Article 6 (1) (f) GDPR
where processing is necessary for the purposes of the legitimate interests pursued by ASG Cert or a third party, including in particular:
- operation of our website
- communication with customers
- ensuring network and information security
- internal administration
- quality assurance
- establishment, exercise or defence of legal claims.
Where processing is based on legitimate interests, ASG Cert carefully balances those interests against the rights and freedoms of the data subject.
8. Data Retention
Personal data will be retained only for as long as necessary to fulfil the purposes for which it was collected.
Unless longer retention periods are required or permitted by law, ASG Cert generally retains personal data:
- for the duration of the contractual relationship
- for the period necessary to comply with statutory limitation periods
- for accounting, tax and commercial law retention obligations, generally between six (6) and ten (10) years following completion of the relevant transaction or termination of the contractual relationship.
Where personal data is no longer required, it will be securely deleted or anonymised unless further retention is legally required.
9. Recipients of Personal Data
ASG Cert treats all personal data as confidential. Personal data will only be disclosed where this is necessary for the purposes described in this Privacy Policy, required by law, or where the data subject has given consent.
Depending on the nature of the processing activity, personal data may be disclosed to the following categories of recipients:
- auditors and technical experts acting on behalf of ASG Cert
- accreditation bodies
- scheme owners
- certification partners where required for the relevant certification scheme
- external IT service providers responsible for hosting, cloud services, document management, collaboration platforms, accounting software, maintenance, technical support and system administration
- external tax advisers, accountants and auditors
- legal advisers and professional consultants
- banking and payment service providers
- certification partners or accreditation bodies where disclosure is necessary in connection with certification activities
- public authorities, supervisory authorities, courts and other governmental bodies where disclosure is required by applicable law or official order
- other service providers acting as processors on behalf of ASG Cert in accordance with Article 28 GDPR.
All processors are carefully selected and contractually obliged to process personal data only on documented instructions from ASG Cert and in compliance with the GDPR.
ASG Cert does not sell personal data to third parties.
10. International Data Transfers
Personal data is generally processed within the European Union (“EU”) or the European Economic Area (“EEA”).
ASG Cert also uses cloud-based collaboration and documentation tools to support its internal business processes and the provision of certification services. This includes, in particular, cloud-based collaboration, documentation and business software (including Notion as a documentation and collaboration platform). Depending on the technical operation of these services, personal data may be processed or accessed from countries outside the EU/EEA.
International certification projects may require the exchange of personal data with customers, auditors, technical experts, accreditation bodies or other authorised organisations located outside the European Economic Area (“EEA”). Such transfers are carried out only where necessary for the performance of certification services, compliance with legal or accreditation requirements, or the establishment, exercise or defence of legal claims.
Should personal data be transferred to recipients located outside the EU or EEA, ASG Cert will ensure that an adequate level of protection is maintained in accordance with Articles 44 et seq. GDPR.
Where no adequacy decision of the European Commission exists, transfers will only take place where appropriate safeguards have been implemented, including, where applicable, the European Commission’s Standard Contractual Clauses or another lawful transfer mechanism recognised under the GDPR. While the majority of personal data is processed within the EU/EEA, certain cloud service providers may process data in third countries under these safeguards.
11. Data Security
ASG Cert has implemented appropriate technical and organisational measures (“TOMs”) designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access.
These measures are regularly reviewed and adapted to reflect technological developments and the level of risk associated with the processing activities.
Such measures include, where appropriate:
- encrypted data transmission using SSL/TLS technology
- role-based access controls
- authentication procedures
- regular software updates
- backup and recovery procedures
- protection against malware and cyber attacks
- confidentiality obligations for employees
- processor agreements with external service providers.
Despite these measures, no method of electronic transmission or storage can be guaranteed to be completely secure.
12. Storage Location
Unless otherwise stated in this Privacy Policy, personal data is stored on servers operated by our hosting provider.
The hosting provider of our website is Serverprofis GmbH, headquartered in Feldkirchen near Munich, Germany. Personal data is processed and stored on servers located in Germany.
Where external service providers process personal data on behalf of ASG Cert, such processing is carried out exclusively in accordance with applicable data protection legislation.
13. No Automated Individual Decision-Making
ASG Cert does not use personal data for automated decision-making, including profiling, within the meaning of Article 22 GDPR.
14. Obligation to Provide Personal Data
The provision of personal data is generally voluntary.
However, certain personal data is required in order to:
- respond to enquiries
- conclude and perform contracts
- carry out certification and audit services
- comply with statutory obligations.
Failure to provide the required information may result in ASG Cert being unable to provide the requested services or enter into a contractual relationship.
15. Rights of Data Subjects
Subject to the applicable legal requirements, data subjects have the following rights under the GDPR:
- the right of access (Article 15 GDPR)
- the right to rectification (Article 16 GDPR)
- the right to erasure (“right to be forgotten”) (Article 17 GDPR)
- the right to restriction of processing (Article 18 GDPR)
- the right to data portability (Article 20 GDPR)
- the right to object to processing based on Article 6 (1) (e) or (f) GDPR (Article 21 GDPR)
- the right to withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out prior to withdrawal
- the right to lodge a complaint with a competent supervisory authority.
Requests concerning these rights may be addressed at any time to the contact details provided in this Privacy Policy.
16. Right to Lodge a Complaint
If you believe that the processing of your personal data infringes applicable data protection law, you have the right to lodge a complaint with a competent supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement. This right is without prejudice to any other administrative or judicial remedy available under applicable law.
17. Changes to this Privacy Policy
ASG Cert reserves the right to amend this Privacy Policy from time to time in order to reflect changes in legal requirements, regulatory guidance, technological developments or our processing activities. The current version will always be available on this website together with the date of its latest revision.
B. Website and Certification Services
18. Website Visits
When you visit our website, certain information is automatically transmitted by your browser to our web server.
This information is temporarily stored in server log files and may include:
- IP address
- date and time of access
- requested URL
- referring website (Referrer URL)
- browser type and version
- operating system
- language settings
- amount of data transferred
- HTTP status code
- internet service provider, where technically available.
The collection of this information is technically necessary to ensure the proper operation, security and stability of our website.
The legal basis for this processing is Article 6 (1) (f) GDPR. Our legitimate interest consists in ensuring the secure and reliable operation of our website and protecting it against misuse and cyber attacks. Server log files are deleted as soon as they are no longer required for these purposes unless their further retention is required for evidential purposes.
19. Contact Form and General Enquiries
Our website provides a contact form enabling prospective customers and other interested parties to contact us electronically. Where you contact us via the contact form or by email, we process the personal data you voluntarily provide, including, where applicable:
- name
- company
- email address
- telephone number
- country
- subject of your enquiry
- message content
- any attachments submitted.
The processing of these data is carried out exclusively for the purpose of responding to your enquiry and, where applicable, initiating or preparing a contractual relationship.
The legal basis is:
- Article 6 (1) (b) GDPR where your enquiry relates to the initiation or performance of a contract; or
- Article 6 (1) (f) GDPR where processing is based on our legitimate interest in responding to general business enquiries.
Your data will not be used for marketing purposes unless you have separately consented to such use.
20. Certification and Audit Services
As part of our certification, auditing and conformity assessment services, ASG Cert processes personal data that is necessary for the preparation, performance, documentation and administration of certification activities.
Depending on the specific engagement, this may include:
- contact details of customer representatives
- organisational functions and business contact information
- correspondence relating to certification projects
- audit schedules
- audit reports
- certification records
- corrective action documentation
- contractual and invoicing information.
Where audit reports refer to individual employees or representatives of the customer, such references are limited to the extent necessary for documenting audit findings and certification decisions.
ASG Cert processes such personal data solely for legitimate certification purposes and does not use it for profiling or unrelated commercial purposes.
The legal basis for this processing is generally Article 6 (1) (b) GDPR and, where applicable, Article 6 (1) (f) GDPR. Where processing is necessary to comply with statutory or accreditation-related obligations, Article 6 (1) (c) GDPR also applies.
20.1 Processing of Personal Data during Certification Activities
As part of its certification, auditing and conformity assessment services, ASG Cert processes personal data only to the extent necessary for the planning, performance, documentation and administration of certification activities.
Depending on the scope of the engagement, this may include personal data relating to customer representatives, employees participating in interviews, management representatives, quality managers or other designated contact persons. Such data typically comprises names, business contact details, job titles, organisational functions, correspondence and information documented during certification activities.
ASG Cert processes such personal data solely for legitimate certification purposes and does not use it for profiling, marketing or any purpose incompatible with the certification process.
The legal basis for this processing is generally Article 6 (1) (b) GDPR (performance of a contract), Article 6 (1) (c) GDPR (compliance with legal or accreditation-related obligations), and Article 6 (1) (f) GDPR (legitimate interests in ensuring the integrity and proper administration of certification activities).
20.2 Data Minimisation
ASG Cert adheres to the principle of data minimisation pursuant to Article 5 (1) (c) GDPR.
Only personal data that is necessary for the preparation, conduct, documentation and administration of certification activities is collected and processed. Wherever reasonably possible, certification activities are organised in a manner that avoids or minimises the processing of personal data. ASG Cert requests that customers provide only such personal data as is necessary for the respective certification engagement.
20.3 Confidentiality of Certification Activities
ASG Cert recognises that certification and audit activities frequently involve access to confidential business information and, in certain cases, personal data relating to employees or representatives of certified organisations.
All information obtained during certification activities is treated as strictly confidential and is processed exclusively for purposes directly connected with the provision, administration and safeguarding of certification services. Access to such information is restricted to authorised personnel and carefully selected service providers who require access for the performance of their duties and who are subject to appropriate statutory or contractual confidentiality obligations.
20.4 Disclosure in Connection with Accreditation and Regulatory Requirements
As an accredited certification body, ASG Cert may be required to disclose information relating to certification activities to accreditation bodies, scheme owners, competent regulatory authorities, public authorities, peer evaluators, external technical experts or other organisations authorised by applicable law or accreditation and certification requirements.
Such disclosures are limited to the extent necessary to comply with legal, regulatory or accreditation-related obligations and are carried out in accordance with applicable data protection legislation. Where personal data is disclosed, ASG Cert ensures that the disclosure is proportionate, restricted to the information necessary for the relevant purpose and subject to appropriate safeguards.
The legal basis for such processing is Article 6 (1) (c) GDPR where disclosure is required by law or accreditation requirements and, where applicable, Article 6 (1) (f) GDPR for the legitimate interest in maintaining accreditation, ensuring the integrity of certification activities and demonstrating compliance with applicable standards.
21. Business Communications
ASG Cert processes personal data of customers, suppliers, service providers and other business partners for the purposes of maintaining business relationships.
Such processing includes, in particular:
- correspondence
- appointment coordination
- contract administration
- invoicing
- accounting
- payment processing
- legal compliance.
The legal basis is Article 6 (1) (b) GDPR and, where applicable, Article 6 (1) (c) and Article 6 (1) (f) GDPR.
C. Cookies and Related Technologies
22. Cookies
Our website uses cookies and similar technologies.
Cookies are small text files stored on your device that enable certain functions of the website and improve the user experience.
We distinguish between:
- strictly necessary cookies
- functional cookies
- analytical cookies (where applicable).
Strictly necessary cookies are processed on the basis of our legitimate interest in providing a secure and functional website and, where applicable, pursuant to Section 25 (2) German Telecommunications Digital Services Data Protection Act (TDDDG).
All other cookies requiring consent are only activated after you have provided your consent via our cookie management platform. You may withdraw your consent at any time with future effect.
23. Google Fonts
Our website uses Google Fonts to ensure a consistent presentation of fonts.
Where Google Fonts are hosted locally, no connection to Google servers is established when you visit our website.
No personal data is transferred to Google for this purpose.
24. CAPTCHA
To protect our website and online forms against automated misuse, spam and malicious attacks, we may use CAPTCHA technology.
Depending on the technical implementation, certain technical information, including your IP address, browser information, interaction data and device characteristics, may be processed for the purpose of distinguishing human users from automated requests.
Where required by applicable law, such processing is based on your consent pursuant to Article 6 (1) (a) GDPR. Otherwise, processing is carried out on the basis of Article 6 (1) (f) GDPR, our legitimate interest being the protection of our website and online services against misuse. Further information regarding the specific CAPTCHA service used can be found in the relevant provider’s privacy information.
25. SSL/TLS Encryption
For security reasons and to protect confidential information transmitted via our website, ASG Cert uses state-of-the-art SSL/TLS encryption.
Encrypted connections can generally be recognised by the “https://” prefix in your browser’s address bar and the padlock symbol displayed by your browser.