Data Privacy Policy

The Global Wind Organisation (GWO) cares about the protection of personal data. By law, GWO must also share publicly about which personal data we process, why and how. This Data Privacy Policy document addresses this.

GDPR

GWO has designed its data privacy policy to be compliant with the European Union General Data Protection Regulations ("GDPR").

GWO is the data controller for all data that is registered, collected, stored and processed on WINDA, as described in this policy.

For details on security controls implemented in relation to WINDA, please view Information Security.

GWO's legal basis for processing the personal data as described in this policy is to deliver the services described in WINDA Terms and Conditions and fulfil obligations to maintain compliance with the GWO Requirements for Training and GWO Requirements for Certification, cf. GDPR Article 6(1)(b). 

GWO may use a User's email address for the purposes of notifying about changes to WINDA, various WINDA system notifications (e.g. finance processes, records expiry), changes to User profiles, changes to WINDA Terms and Conditions, password retrieval, changes to the GWO Requirements for Training and/or the GWO Requirements for Certification, or information from GWO relating to GWO training and HSE.

Subject to a legal request, authorities may also gain access to any data collected and stored.

Read more about what we collect, store and share for each of the User types below.

WINDA Training Records Processing

WINDA is designed to enable employers and duty holders to view Course Participants' current and valid Training Records. All Course Participant Training Records belong to the Course Participant.

To facilitate the registration of Training Records, the Course Participant must communicate their WINDA ID to the GWO-certified Training Provider when enrolling in training and allow the GWO-certified Training Provider to upload a Training Record to WINDA upon completion of training.

To facilitate the lookup of Training Records, the Course Participant must communicate their WINDA ID to the relevant parties whom they wish to allow to search for their training history (e.g. an employer) in WINDA.

In searches to view a Course Participants Training Record, the result will show:

Course Participant name and nationality 

Course Participant valid and current Training Records, including dates and versions

GWO-certified Training Provider who registered these Training Records

WINDA Privacy Settings

In WINDA, under Privacy Settings, the Course Participant has access to a history of all searches relating to their WINDA ID. Here the Course Participants can define their profile to be either Public (Allow all except the blocked Training Providers and Organisations) or Private (Block all except the allowed Training Providers and Organisations). If not defined by the Course Participant specifically, their profile will default be set to Public with no blocked Training Providers or Organisations.

Data processing Per User Type

GWO's approach to data processing is described below, including the use and disclosure of your personal data relating to your registration in WINDA per each User type.

Course Participant

When registering as a Course Participant in WINDA, the Course Participant agrees to WINDA Terms and Conditions, which allows GWO-certified Training Providers to upload Training Records to their profile and allows Training Providers and Organisations to view Training Records as defined in their Privacy Settings.

By registering as a Course Participant in WINDA, the following personal data is collected and processed:

  1. Full name
  2. Private email address (preferred) or work email address
  3. Nationality
  4. Training Records as uploaded by GWO-certified Training Providers

The User will be associated with a WINDA ID, which is a unique ID generated upon registration.

All of the above data is associated with the WINDA ID.

Organisation User

When registering as an Organisation User of WINDA, the Organisation User agrees to WINDA Terms and Conditions, which allows Course Participants who have provided the Organisation User with their WINDA ID to search and view Training Records.

By registering as an Organisation User in WINDA, the following personal data is collected and processed:

  1. Job title
  2. Full name
  3. Work email address
  4. Work phone number
  5. The name of the Organisation that the Organisation User represents
  6. The postal address of the Organisation that the Organisation User represents

Course Participants can access a search history of all searches that include their WINDA ID and may also access the name of the Organisation User that has performed these searches. Course Participants can block Organisation Users from viewing their Training Records. Search history may be retrieved by GWO for information analysis purposes.

Training Provider Contacts

A Training Provider is obligated to create and maintain three Training Provider Contacts as follows:

  1. Training Provider Main Contact, this contact information is shared on the GWO Training Provider list and map (publicly available on WINDA and www.globalwindsafety.org), unless the Training Provider chooses to be hidden from the list (setting in the Training Provider Profile).
  2. Training Provider Admin Contact, this contact information is used, at minimum, for the following purposes: administrative, governance, compliance, complaints, incidents or any other formal dialogue GWO may need to conduct with the Training Provider, as well as information about changes to WINDA, Training Provider profile, Audits, changes to the Terms and Conditions, changes to the GWO Requirements for Training and/or GWO Requirements for Certification, or information from GWO relating to GWO governance, compliance, training and HSE.
  3. Training Provider Invoice Contact, this contact information is used to send GWO-issued quotations, invoices, credit notes and payment reminders and general payment information by email.

These three contacts are registered for the sole purpose outlined above and will not have any login privileges on WINDA.

The email addresses for one or any of the contacts may overlap with each other, as well as with Training Provider Admin or Training Provider User, but this is not necessary.

Training Provider Users

When they create a Training Provider profile, the Certification Body will also create an initial Training Provider Admin User. This User will have the ability to log in to WINDA and create more Training Provider Admin Users as well as Training Provider Users, as needed by the Training Provider.

The Training Provider Admin or Training Provider User registered agrees to WINDA Terms and Conditions, which allows them to perform the functions needed and provided by WINDA for the Training Provider operation to be compliant with the GWO Requirements for Training and GWO Requirements for Certification.

In registering as a Training Provider Admin or Training Provider User in WINDA, the following personal data is collected and processed:

  1. Full name
  2. Work email address

All personal data of contacts and Training Provider Admins and Training Provider Users may be shared with Certification Bodies and/or Auditors in connection with the conduction of audits in alignment with the GWO Requirements for Certification.

Course Participants can access a search history of all searches that includes their WINDA ID and may access the name of the Training Provider and Training Provider Admin or Training Provider User that have performed these searches. Course Participants can block Training Providers and Training Provider Admins and/or Training Provider Users from viewing their Training Records. Search history may be retrieved by GWO for information analysis purposes.

Instructor

Instructor is an additional role a Course Participant may have, hence the above conditions regarding Course Participants' personal data in WINDA also applies for Instructors.

In addition, the following applies:

  1. In accordance with the GWO Requirements for Training, Training Providers are required to register the Instructors they use to deliver training and the qualifications of them. Training Providers do that through an Affiliation request to an Instructor's Course Participant profile. If the Instructor does not have a Course Participant profile, one will be created.
  2. The Instructor can accept or reject the Affiliation with the Training Provider at any time. But if rejected or removed, the Instructor is not eligible to deliver training on behalf of the Training Provider. Likewise, the Training Provider can, at any point in time, remove an Affiliation with an Instructor with the same consequence.
  3. Should the Instructor no longer have any Affiliations, the Instructor's Course Participant profile remains untouched, unless handled as described above in the section about Course Participants' personal data in WINDA.

For an Instructor with one or more active Affiliations, the following personal data is collected and processed:

  1. List of the GWO standard training with which the Instructor is Affiliated (qualified to deliver training in)
  2. An Instructor Qualification Assessment Form (IQAF) submitted by the Training Provider in accordance with the GWO Requirements for Training

Certification Body

When registering a Certification Body, an initial Certification Body User is registered in WINDA, the Certification Body User agrees to the WINDA Terms and Conditions. A Certification Body User can create both more Certification Body Users and Auditors (see separate section on Auditors).

Furthermore, once both the Certification Body and Auditor have been registered and approved by GWO, the Certification Body User can create Training Providers and thus their initial Training Provider Admin (see separate section on Training Provider Users).

In registering as a Certification Body User in WINDA, the following personal data is collected and processed:

  1. Full name
  2. Work email address

Auditor

The Auditor agrees to the WINDA Terms and Conditions.

In registering as an Auditor in WINDA, the following personal data is collected and processed:

  1. Full name
  2. Work email address
  3. Phone number
  4. Postal address
  5. ISO/OHSAS documentation or other relevant certification documentation
  6. AQT/ADT Certificate and validity dates

Disclosure of Personal Data to Third Parties

Apart from points described above, GWO does not share personal data with any third party or with companies, organisations or individuals outside GWO, unless you consent to such disclosure or it is required by law, regulators, public authorities, relevant accredited organisations or court orders, or unless it is deemed necessary as part of the establishment, exercise or defence of legal claims, e.g. towards legal representation.

Data processors

We use several data processors who are providing systems and services to us, including the following: 

  1. Microsoft Azure (legal entity residing in Ireland)
  2. Amazon SES (legal entity residing in Luxembourg)
  3. Netcompany (legal entity residing in Denmark)

Data processors act on behalf of GWO and process personal data based on instructions regulated by a written data processing agreement.

Other relevant data processors and data sub-processors within the category of providing necessary support (IT, etc.) to GWO and WINDA to provide the services described in the WINDA Terms and Conditions. 

Transfer of Data to Third Countries Outside the EU/EEA

Outside the normal use of WINDA by Users located outside EU/EEA as described above, GWO does not transfer personal data to any third party outside of EU/EEA. 

Some of our data sub-processors can use support from third countries outside the EU/EEA via a 'view access'. GWO imposes a contractual obligation on the data processors to establish a sufficient legal basis of such data transfers in accordance with GDPR chapter 5.

Deletion of Personal Data

Personal data may be deleted at any given time upon written request from the User to GWO at info@globalwindsafety.org.

Upon such a request, GWO will delete all the personal data described above and deactivate the User's profile.

However, the User profile is not deleted, but deactivated. All activities associated with the User (e.g. WINDA ID, Training Records) will remain but no longer be associated with any personal data. This to enable employers to be able to meet regulatory requirements within this area of operations.

GWO will delete personal data and deactivate Users after a certain period of inactivity as described below, according to User type.

Generally, activity is defined as having a login to WINDA or for a Course Participant having a current and valid Training Record.

Users will be notified in advance before the deletion of personal data and deactivation.

Deleted personal data and deactivated Users cannot be recreated.

Course Participants

Personal data will be deleted and User deactivated after 48 months of inactivity.

Organisation

Personal data will be deleted and User deactivated after 12 months of inactivity.

Training Providers

Personal data will be deleted and User deactivated after 24 months of inactivity.

Certification Body Users

Personal data will be deleted and User deactivated after 24 months of inactivity.

Auditor

Personal data will be deleted and User deactivated after 24 months of inactivity.

Security of Data

Please view Information Security.

Data subject rights

Under the applicable national / EU data protection law, Users are entitled to:

  1. Request access to personal data processed by GWO
  2. Request information about personal data, the purposes for it and its potential recipients
  3. Have personal data rectified or deleted
  4. Object to the processing of personal data as well as the right to data portability

Users also have the right to lodge a complaint with their national data protection authority (the Danish Data Protection Agency) or other public authorities governing the protection of their personal data. 

Furthermore, Users have the right to withdraw their consent. However, our processing, based on their consent up until their withdrawal, will be legal.

The Right to Object

Users have the right to object, on grounds relating to their particular situation, to the processing of personal data where the legal basis for our processing is legitimate interests, as stated above. If they exercise their right to object, GWO may no longer process their personal data unless GWO demonstrates compelling legitimate grounds for the processing which override their interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims. 

If Users need further information about the processing of personal data, and/or they wish to use any of their rights, they may contact GWO at info@globalwindsafety.org.


Published on and valid from 20 January 2026.