Version: 1.4. Read with IQVS’s Privacy Notice. This addendum explains business-account services when enabled; it does not change an existing accepted privacy or authority version.
International Qualification Verification Services (IQVS LTD), company number 17485029, is responsible for the IQVS account, service, security and billing information described here. Our registered office is 4 Bolbury Crescent, Swinton, Manchester, Greater Manchester, United Kingdom, M27 8AX. Contact privacy@iqvs.co.uk for a request, objection or complaint.
Additional information and sources
For a business account we use the organisation's identity and address, named owner's and signatory's identity, role and verified email, membership permissions, invitations, review decisions and agreement/acceptance versions. An invitation records the intended email and its expiry; its one-time secret is not a reusable shared login. The organisation supplies these details and IQVS staff review the proposed authority.
For an introduced applicant we also record the name and email supplied for the invitation, requested service, purpose, destination, intended recipient and actual agency end client where applicable. The applicant claims their own invitation and supplies their own information and documents. We distinguish information supplied by an organisation, an applicant and an authenticated institution. A pending invitation can contain personal information before the person claims it; it is included in our business-record rights-request handling where it belongs to that verified email.
The applicant's access authority identifies the specific organisation and case. Quote authority and the organisation member's payer undertaking record the exact quote, case reference, applicant, amount, terms version and relevant expiry. These are separate from authority to contact a source institution or disclose a report. We retain approval, revocation, current-status and audit records so the actual permission and decisions can be explained.
Monthly billing adds the reviewed legal payer name, billing address and mailbox, finite credit terms, named finance reviewer and owner acceptance, reserved accepted order totals, period/group references and Stripe customer, invoice, payment and reconciliation references. IQVS does not receive full card numbers or CVCs and does not automatically connect the business's bank account. Finance records the actual tax treatment rather than inferring a VAT status.
Why we use the information
We use business-contact and role information to establish and administer an accountable organisation service, secure its named access, validate payment authority and handle service disputes. Our proposed basis for necessary business-contact administration and security is the legitimate interest in providing a secure, properly authorised business service, subject to the required assessment and individuals' rights. This does not treat an employee as personally party to the organisation's contract. An individual applicant's own requested order continues to use the applicable basis described in the base notice. Necessary tax, accounting and information-rights records use the relevant legal obligation where it applies.
We identify the actual lawful basis for source contact, report disclosure and any materially different purpose before that processing begins. Applicant permission records the particular permitted route and information; it is not a claim that consent alone is the lawful basis for all processing. The parties record their actual controller/processor roles and, where necessary, the relevant data protection terms for their purpose. This addendum does not claim that such an assessment or agreement has already been completed for an unnamed organisation.
Visibility, sharing and decisions
Organisation members receive only the case-status or quote/commercial information the applicant has authorised within that member's permissions. The business account does not grant general document, identity or report access. A source institution or recipient receives only the information covered by the separate reviewed authority and current route. An agency identifies the actual end client; the account does not authorise automatic onward sharing to all its customers.
Assigned IQVS staff, finance reviewers and distinct output reviewers access the information needed for their work. The providers and transfer arrangements in the base notice continue to apply: GoDaddy hosting, Google Workspace/private Drive, the assessed malware scanner and IQVS LTD's own Stripe invoicing/payment environment. There is no automatic Xero or other accounting handoff. Introducing a new provider, purpose or transfer requires the appropriate assessment and information before use. Public brand and customer payment activity belong to IQVS LTD.
Tools may organise invitations, status, quote bindings and billing records. People review organisation/signatory identity, agreements, finite credit, invoice release and substantive service output. No business account creates an automated legal-identity, qualification-equivalence or significant eligibility decision. A financial hold pauses the relevant workflow for review rather than proving wrongdoing by an applicant.
Retention, restrictions and requests
The base notice's service, financial, approval, security and rights-request periods continue to apply to the corresponding records. An organisation closure or membership revocation removes access but does not automatically erase a signed agreement, accepted payer undertaking, authority history or invoice evidence. A reviewed retention decision must identify the record category, relevant start/end event and justified legal hold; unnecessary information is deleted or anonymised when appropriate. This addendum does not create an unlimited retention period or claim that all business records are automatically deleted by the portal's individual-case deletion process.
Business records have their own rights-request lookup and export. It includes the individual's member/invitation records, relevant organisation acceptance and financial authority, and applicant-related payer undertakings through their own case association. Other invitees' data and invitation secrets are not included merely because they belong to the same organisation. Business and financial erasure is reviewed separately: records requiring retention are identified for follow-up, and a storage/query failure cannot be reported as successful erasure. Applicant privacy restrictions and access revocations are checked against current authority before case or output processing.
You may contact privacy@iqvs.co.uk for access, correction, deletion, restriction, portability or an objection as described in the base notice. No special form is required. We explain any limitation or justified retention and any applicable request deadline/extension. You may object to legitimate-interest processing, complain to IQVS or complain to the Information Commissioner's Office. Membership removal, withdrawal of permission or a privacy request does not retroactively change an earlier lawful service or automatically extinguish an accepted payment obligation; IQVS considers the actual applicable rights and records separately.