Privacy notice for the Hillscom gap analysis tool
Last updated 12 October 2026. This covers the free ISO 9001:2026 self-assessment and, for organisations working with us, the HCM client platform. Our general website has its own notice at hillscom.co.uk.
Who we are
Hillscom Limited is the controller of the personal data in this tool. You can contact us through https://hillscom.co.uk/contact/ or at info@hillscom.co.uk.
What we collect, and why
| What | Why | Our lawful basis |
|---|---|---|
| Your name, work email, job title, organisation name and password (stored only as a one-way hash) | To create and secure your account and send the emails you need, such as confirmation and password reset | Providing the service you asked for (contract) |
| Your assessment answers, notes on how you meet each requirement, evidence descriptions and links, action plans, comments and question assignments | To give you your scores, results and action report, and, for engagement clients, to let your team and Hillscom work together | Providing the service you asked for (contract) |
| Whether you have chosen to share your answers with Hillscom, or asked to talk to us, and when | To keep your answers private unless you choose otherwise, and to respond to your request | Your consent |
| Whether you want occasional marketing emails from us | To send you updates about ISO standards and our services. This is off unless you tick the box | Your consent |
| Security and activity records: sign-ins and other events, with your IP address and browser type | To keep accounts secure, block misuse, and show an organisation's own activity history | Our legitimate interest in running a secure service |
| The campaign tag on the link you used to register, for example a LinkedIn post | To see which of our posts and pages bring people to the tool | Our legitimate interest in understanding how people find us |
Who can see your answers
Your answers belong to your organisation. Until you share them or start working with us, Hillscom's administrators see your account details, how far you have got and your scores, but not what you wrote. If you choose to share, or your organisation starts an engagement with us, the Hillscom people assigned to you can see your answers at the level you have agreed. Everyone at your own organisation sees only what the access levels set by your administrator allow.
We do not sell personal data, show advertising or use advertising trackers.
Who else handles your data
We use a small number of providers to run the tool. They act on our instructions and may not use your data for their own purposes:
- Hostinger, which hosts the tool and its database.
- Microsoft 365, which sends the emails from this tool.
If any provider handles data outside the UK, we rely on the safeguards the law requires. Ask us if you would like details.
How long we keep it
- Your account and answers: until you delete them, or until we close the account at your request. There is no automatic expiry while your account exists.
- Accounts that never confirm their email address: deleted after 14 days.
- Security and activity records: deleted after 24 months. If you delete your account, records that identified only you are deleted straight away and the rest lose your IP address and browser details.
- Unused invitations, confirmation and reset links: deleted soon after they expire or are cancelled.
- Backups: may hold deleted data for a short time until they roll off. We only restore a backup to recover from a failure, and delete anything you had already asked us to remove.
- Engagement clients: work we do together under an engagement letter is kept as that letter describes.
Your rights
You can ask us to see, correct, restrict or delete your data, to move it, or to stop using it for a purpose you object to. Most of this you can do yourself:
- Download your answers as a CSV from your results page.
- Delete your account and data from Account and privacy. It is immediate and cannot be undone.
- Stop marketing emails from the same page, or by using the link in any marketing email.
For anything else, contact us using the details above. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Cookies
The tool sets one cookie, which keeps you signed in. It is strictly necessary, expires when you sign out or after a period of inactivity, and is not used for tracking. We do not use analytics or advertising cookies in this tool.
Changes
If we change this notice in a way that matters to you, we will say so on the sign-in page and by email to registered users.