Roles
For customer documents and participant data, the professional customer generally acts as controller. Certify Express acts as technical processor when it hosts, generates, stores or transmits this data on behalf of the customer. For accounts, access requests, security, support, payment management, analytics and prospecting, Certify Express acts as controller.
Pre-launch controller information
The final commercial controller is still being formed. After the Estonian company is created, this page will be updated with its legal name, address, registration number, VAT number if any, official contact and, if required, GDPR contact or representative.
Data processed
- account data: email, identifier, organization, role, team invitations and access logs;
- participant data: first name, last name, email, organization, employer if entered;
- document data: title, date, duration, category, template, colors, logo, visual signature and generated files;
- evidence data: attendance, score, quiz answers, completion data, private evidence references, uploaded files and simple drawn attendance signature if used;
- registry data: document identifier, status, issue date, expiry, revocation, replacement and verification link;
- payment data: order references, rights, renewal, cancellation and refund status depending on the provider selected;
- support, security, incident, analytics and prospecting data depending on enabled services.
Purposes and legal bases
Data is processed to create and manage professional accounts, provide the Studio, generate PDFs and badges, store drafts and registries, provide verification links, handle support, secure the service, prevent abuse, manage payments and comply with legal obligations. The legal bases may include contract performance, pre-contractual steps, legal obligations, legitimate interest and, for some trackers or campaigns, consent where required.
Data processing agreement approach
For paid B2B customers, Certify Express intends to provide the information usually expected from a processor: subject matter, duration, nature and purpose of processing, categories of data, categories of data subjects, confidentiality, security, sub-processors, assistance with rights requests, deletion or return of data, and incident handling.
Retention periods proposed for launch
- active customer account: during the contractual relationship;
- account data after closure: up to 12 months unless a longer legal obligation applies;
- issued documents, registries and evidence: 36 months by default, unless deleted earlier or configured for a shorter period;
- unissued drafts: 12 months after last modification;
- beneficiary access links: 30 days by default;
- security logs and incidents: 6 to 12 months;
- support requests: 24 months after closure;
- B2B prospects: 3 years after the last active contact or until objection;
- backups: short documented retention, for example 30 to 90 days.
Expected processors and transfers
Expected providers include Cloudflare, Resend if email is enabled, a payment provider or Merchant of Record to be selected, an analytics tool to be selected, and Estonian accounting or domiciliation providers. The service may involve customers in France, the EU, Southeast Asia and Hong Kong. Processing regions, transfer safeguards and provider contracts must be confirmed before commercial opening.
Security and access
Customer spaces are private. Access tokens are temporary where possible, sensitive tokens are not stored in clear text, and access should be limited to operation, support, security and legal needs. Privacy of a customer space does not remove GDPR obligations.
Incident handling
If a security incident affecting personal data is identified, Certify Express will assess the nature of the incident, affected data, likely risk, containment measures and notification obligations. When acting as processor, Certify Express will assist the relevant customer controller.
Children and sensitive data
The service is intended for B2B use and not for minors. Customers must not intentionally upload minors' data or special categories of personal data unless a specific written framework and legal basis are in place.
Rights
Data subjects may request access, rectification, erasure, restriction, objection or portability according to the applicable framework. When a request concerns a document issued by a customer, Certify Express may redirect the request to the issuing customer or assist as processor.
Commercial prospecting
Any B2B prospecting, including AI-assisted prospecting, must remain documented, limited, relevant, transparent and easy to object to. No large-scale campaign should start before the contact source, message, opt-out process and recordkeeping are fixed.
Pre-launch version updated on September 23, 2026. These texts are working documents and must be reviewed and completed before any final commercial launch.