Effective date: 27 September 2026
Version: 1.0
International Qualification Verification Services (IQVS) is the trading name used for this website. This interim notice does not yet identify the legal person operating IQVS or provide that operator's postal/service address. Those details remain unresolved and this omission must be corrected for the current website and email processing as well as before any application or paid service opens. You can contact the privacy team at privacy@iqvs.co.uk.
Our application and document-upload services are currently closed while we complete our pre-launch controls. This interim notice will be replaced as soon as the legal operator name, company number if applicable, and postal/service address are confirmed.
What this notice covers
This notice covers our website, enquiries, accounts and the qualification verification, comparative assessment and document translation services that we are preparing to offer. DBS application support, B2B accounts and payments are not yet available. We will update this notice before any of those services begins.
Information we use
Depending on how you use IQVS, we may use:
- account and contact details, such as your name, email, telephone number and account identifiers;
- profile details, such as your address and, where genuinely needed, date and place of birth;
- service and case details, including your case reference, requested service, destination, purpose and recipient;
- qualification records, such as certificates, transcripts, institutions, attendance, grades and thesis information;
- translation source documents, requested languages, intended use, translated output and quality-review records;
- identity or authority evidence where it is necessary for a particular service;
- messages, institution replies, recipient instructions, approvals and delivery records;
- file and security data, such as file type, size and hash, malware-scan result, login and access events, IP address and browser/security information;
- billing, invoice and payment-provider references when payments become available. IQVS will not store full card numbers or CVCs; and
- information supplied by a B2B customer about an applicant, but only where the customer has authority and we have given the applicant appropriate privacy information.
We may receive information from you, an organisation acting for you, an issuing institution, a recipient you nominate, authentication and technical providers, or public official sources used to confirm an institution or route. We keep applicant-provided records separate from institution-provided evidence.
Some documents can reveal sensitive information. We will not intentionally accept special-category information, criminal-offence information or biometric identification data until the exact service has an approved legal condition and safeguards. DBS intake is closed.
Why we use it and our lawful bases
| Purpose | Lawful basis |
|---|---|
| Answer an enquiry, prepare a quote, create and deliver an individual service | Contract, including steps you ask us to take before a contract |
| Operate accounts, protect files and systems, prevent misuse, keep an approval trail and defend legal claims | Our legitimate interests in secure, accountable service delivery, balanced against your rights |
| Handle an applicant introduced by an organisation, contact an institution and verify evidence | Contract where it applies; otherwise our legitimate interests and those of the authorised requester, with separate authority for disclosure |
| Keep invoices, tax records and respond to data-protection or other legal duties | Legal obligation |
| Send optional electronic marketing | Consent, which you can withdraw at any time |
If a service needs special-category or criminal-offence information, we also need the additional condition required by the Data Protection Act 2018 and UK GDPR. We will identify it before collecting that information. We do not currently process DBS applications.
Who we share information with
We use only the minimum information needed for each task. Depending on the service, recipients may include:
- our managed website host and authorised IQVS staff;
- Google services used for private document storage, email and optional Google sign-in;
- widdix GmbH's attachmentAV EU service, which temporarily scans uploaded bytes for malware. Its listed infrastructure sub-processor is Amazon Web Services EMEA SARL;
- an issuing institution or official source asked to confirm a qualification;
- a translator or reviewer assigned under confidentiality and access controls;
- a recipient you authorise, after we verify the current delivery route and scope;
- payment and accounting providers when those services are connected; and
- courts, regulators, law-enforcement bodies, insurers or professional advisers where disclosure is necessary and lawful.
We do not sell personal information. A clean malware result means that known malware was not detected; it does not prove that a document is genuine.
International transfers
An institution or recipient may be outside the UK, and some technology providers may use international infrastructure or support. Before making a restricted transfer, we identify the recipient and purpose and use the applicable UK adequacy regulations, an approved safeguard such as the UK International Data Transfer Agreement or UK Addendum, or a specific lawful exception where the law permits it. We also assess whether extra safeguards are needed. You may contact us for information about the safeguard used for your case.
How long we keep information
We keep information only for a defined purpose and review it when the period ends. Key periods are:
- ordinary enquiries: 12 months after the last contact;
- inactive accounts: review after 24 months;
- abandoned drafts: 90 days after the last activity;
- identity-document copies: normally 90 days after a case ends;
- applicant qualification or translation source files: normally 12 months after the case ends;
- released reports or translations, authority/approval records, authenticated findings and substantive case evidence: 6 years;
- invoices and VAT/accounting records: at least 6 years where the law requires it;
- general security logs: 12 months; and
- DBS certificate information, if that service is later approved: normally no longer than 6 months.
We may keep a record longer during a dispute, legal hold or regulatory requirement, and record the reason. We delete or anonymise information earlier when it is no longer needed. Provider scan copies are deleted after scanning according to the attachmentAV EU service statement. Our full retention schedule controls the detailed rule for each record.
Security
We use access controls, encrypted connections, private document storage, encrypted credentials, malware scanning, file hash/type/size checks, short-lived authorised downloads, audit records and human approval. Staff access is limited to work they are authorised to perform. No internet service is completely risk-free, so we also maintain incident, backup and recovery controls.
Automated tools and decisions
Tools may help staff check completeness, organise evidence or prepare a draft. A person must approve correspondence, authenticity findings, qualification comparisons, translations and released reports. We do not make a legal or similarly significant decision about you solely by automated processing.
Your rights
Depending on the purpose and lawful basis, you may ask us to:
- give you a copy of your personal information;
- correct inaccurate or incomplete information;
- delete information;
- restrict how we use it;
- provide information in a portable format;
- stop processing based on legitimate interests; or
- withdraw consent without affecting earlier lawful processing.
The right to object to processing based on legitimate interests is brought to your attention separately: you can object at any time by emailing privacy@iqvs.co.uk with “Data protection objection” in the subject line.
We may need proportionate information to confirm your identity before acting. Some rights have legal limits; if a request cannot be fulfilled in full, we will explain why.
Complaints
Please email privacy@iqvs.co.uk so we can investigate. We will acknowledge a data-protection complaint within 30 days, make appropriate enquiries without undue delay, keep you informed and tell you the outcome. You also have the right to complain to the UK Information Commissioner's Office: https://ico.org.uk/make-a-complaint/data-protection-complaints/data-protection-complaints/
Cookies
We use strictly necessary cookies for security, login, preferences and core site functions. We will not use non-essential analytics, advertising or session-recording cookies unless we explain them and obtain any consent required by law. Choosing Google sign-in or an external map link takes you to that provider, which applies its own notice and cookies.
Changes to this notice
We review this notice before new processing starts and at least annually. We will show the new effective date and bring material changes to the attention of affected users.