Certly.

Legal

GDPR & data protection

Version 1.0 · last updated 10 July 2026

This is an English translation provided for convenience. In case of any discrepancy, the Dutch version prevails.

Certly processes data about employees, vehicles and plant on behalf of our customers. This page explains how we comply with the General Data Protection Regulation (GDPR) and what agreements come with that.

Roles: who is responsible for what?

  • The customer is the controller for the data they enter into Certly: employee names, vehicle registrations, certificates and expiry dates. The customer decides which data is entered and for what purpose.
  • Certly is the processor: we process this data solely to provide the service (storing it, showing it on the dashboard, sending email reminders) and never for our own purposes.
  • For account data (name, email, payment status) Certly is itself the controller — see the privacy policy.

Data processing agreement

When you take out a subscription, our data processing agreement applies as part of the terms & conditions. Among other things, it states that Certly:

  • processes data only on the customer's instructions;
  • binds its staff to confidentiality;
  • takes appropriate security measures;
  • engages sub-processors only under the same obligations and announces changes in advance;
  • cooperates with data subject requests and with audits within reasonable limits;
  • deletes all customer data within 30 days after the subscription ends.

Would you like a signed copy of the data processing agreement for your own records? Email support@certly.nl.

Sub-processors

Certly uses a limited number of sub-processors (hosting, database, email, payments). The current list of parties, purposes and locations is in the privacy policy. Data is stored within the EU where possible; for transfers outside the EEA, EU Standard Contractual Clauses (SCCs) or the EU-U.S. Data Privacy Framework apply.

Security measures

  • Encrypted connections (TLS) for all traffic
  • Passwords hashed with a modern algorithm
  • Strict separation of data per organisation (multi-tenant isolation on every query)
  • Role-based access (administrator / member)
  • Secured, non-public file storage with temporary links
  • Backups and logging for recovery and detection

Data breaches

If we discover a personal data breach, we inform affected customers without undue delay after discovery, with a description of the nature of the breach, the likely consequences and the measures taken — so that the customer, as controller, can meet their notification obligations towards their supervisory authority (in the UK, the ICO) and the data subjects.

Rights of data subjects

Employees whose data is held in Certly can exercise their GDPR rights (access, correction, erasure) with their employer — who is the controller. Certly supports customers in this: a holder's data can be viewed, changed or deleted at any time via the dashboard. Requests that reach us directly are forwarded to the relevant customer.

Tips for you as a customer

  • Only enter data that is needed for tracking documents (data minimisation).
  • Inform your employees that their certificate data is kept in Certly, for example via your staff handbook.
  • Delete holders who have left; their data is then removed from the active service immediately.
  • Give team members access only where their role requires it.

Questions?

For all data protection questions: support@certly.nl.