- WINDA

Data Privacy Policy
Data Privacy Notice
At Global Wind Organisation (“GWO”, “we”, “us”, “our”) we care about the protection of your personal data. By law, we must also inform you about how we process and share personal data about you.

GDPR Statements
GWO has designed its data privacy policy to be in compliance with the European Union General Data Protection Regulations (“GDPR”). For information on our policies in relation to this, please view our GDPR data protection procedures and architecture.
GWO is the data controller for all data that GWO administrates/registers on WINDA and on its website as described in this policy.

A guide to data protection in WINDA
WINDA is designed to enable employers and duty-holders to verify current and valid training records of Course Participants/Technicians. All Course Participant records belong the Course Participant.

To enable this verification, the Course Participant must communicate his/her WINDA ID to the GWO Certified Training Provider and allow upload of a training record upon completion of training. Further, he/she must communicate his/her WINDA ID to those persons (legal entities) he/she wishes to enable to verify training (e.g. an employer).

In searches to verify a Course Participant’s training, the result will by default show only:

Course Participant name and nationality

Course Participant valid training and dates

GWO Certified Training provider delivering said training

No other Course Participant's personal data is shared in any way unless you perform a search yourself (see below). Course Participants are able to access a search history of all searches that includes their WINDA ID and may access the name and email address of users that have performed said searches. Course Participants are able to block other users from searching their records by entering the email addresses of any user they wish to block.

In this privacy notice, we describe the processing, including the use and disclosure of your personal data relating to your registration in the WINDA database (winda.globalwindsafety.org) as a Course Participant user, an Organisation user, a Training Provider user, a Certification Body user, or as an Auditor user and on our website globalwind-safety.org.

We use cookies only to enhance the user experience of the site. Read more about our cookies below.

Our general policy for collected data is to store only necessary data, at as low a privacy level as possible, and share only what is necessary to ensure efficient operations of globalwindsafety.org and of WINDA on winda.globalwindsafety.org.

Read more about what we collect and what we share for each of the user types below.

Course Participant users’ personal data in WINDA
When registering as a Course Participant user of WINDA, you agree to the WINDA Terms and Conditions, which allows certified Training Providers to upload training records to your profile, and allows all registered users to verify your training records by entering your WINDA ID provided to them by you.

By registering as a Course Participant user of the WINDA database, the following personal data is collected and processed:

•   Your private email address or work email-address
•   Your full name as written in your passport
•   Your nationality
•   Your full GWO training history as uploaded by GWO certified Training Providers
•   Your WINDA ID, which is generated upon registration. All of the above data is associated with this WINDA ID. The WINDA ID is your unique identification number

GWO’s legal basis for processing the personal data as listed above is in order to perform the agreement (the agreed WINDA Terms and Condi-tions) with you, cf. GDPR Article 6(1)(b).

WINDA is designed to allow you to enable employers and duty-holders to verify your current and valid training records. To do so, they must also register as users in WINDA, and you must communicate your WINDA ID to them. When you attend a GWO certified training course, you must provide your WINDA ID after passing a Training Module if you wish your training to be accepted as GWO training by employers. When registering for the course you must also bring and show a government-issued ID such as your driver's license or your passport together with your WINDA ID. The information on your government-issued ID is processed by the Training Provider to verify your identity only and is not shared with GWO. We do not register personal information such as your social security number, passport number, gender, or birth date in the WINDA database.

Your GWO training may be verified through a search by anyone to who you have communicated your WINDA ID (e.g. an employer).
GWO will at all times maintain an audit trail to be able to document which users have performed a verification search against your WINDA ID. There are no restrictions on who may register as users. If in possession of your WINDA ID, a search result in WINDA will only provide these personal data:

• Your full name as you have entered it (as stated in your passport)
• All current and valid training records that have been uploaded to your WINDA ID, including completion dates of training (expiry dates of validity), name and site of training provider

GWO’s legal basis for processing the personal data as listed above is our legitimate interest in generating an audit trail to be able to document which users have performed a verification search against your WINDA ID, cf. GDPR Article 6(1)(f).

If you perform a search against another person’s WINDA ID, the Course Participant whose training records you have searched will be able to see your name and the email address associated with your WINDA ID.

Likewise, you will be able to access a search history, that includes the name and email address of any WINDA user that have verified your training records through a search in WINDA. You have the ability to block individual users from verifying your records. If you do not perform a search against a WINDA ID, your associated email address is never shared with anyone outside of the GWO secretariat. Your email address is used for purposes of notifying you of changes to your profile, changes to the Terms & Conditions, password retrieval or safety-related information from GWO.

Your expired training history can only be viewed in WINDA by yourself and the GWO secretariat.

All your search results in WINDA are logged and may be retrieved by GWO Audit and Compliance committee or the Secretariat. All searches you have performed against a specific WINDA ID are visible to the Course Participant user associated with this specific WINDA ID. Subject to a legal request, authorities may also gain access to the search log.

We do not share any other types of personal data.

Organisational users’ personal data in WINDA
When registering as an Organisation user of WINDA, you agree to the WINDA Terms and Conditions, which allows you to search the WINDA database for valid training records, if you have been provided with a WINDA ID by a trained Course Participant. By registering as an Organisation user of the WINDA database, the following personal data is collected and processed:

•   Your job title
•   Your full name as written in your passport
•   Your work email-address
•   Your work phone number
•   The name of the organisation that employs you
•   The address of your employer

GWO’s legal basis for processing the personal data as listed above is in order to perform the agreement (the agreed WINDA Terms and Conditions) with you, cf. GDPR Article 6(1)(b).

Course Participants are able to access a search history of all searches that includes their WINDA ID and may access the name and email address of users that have performed said searches. Course Participants are able to block other users from searching their records by entering the email addresses of any user they wish to block.

Except as described above, your email address is never shared with anyone outside of the GWO secretariat. Your email address is used for purposes of notifying you of changes to your profile, changes to the Terms & Conditions, password retrieval, or safety-related information from GWO.

We do not share any other types of data.

Training Provider users’ personal data in WINDA
When your Certification Body creates a Training Provider user for you in WINDA, you will be asked to agree to the WINDA Terms & Conditions, that allow you to upload training records on trained Course Participants and purchase credits as well as searching the WINDA database for valid training records, if you have been provided with a WINDA ID by a Course Participant.

By registering as a Training Provider user in the WINDA database, the following personal data is collected and processed:

•   Your full name as written in your passport
•   Your work email-address
•   Name, telephone number, and address of the Training Provider

GWO’s legal basis for processing the personal data as listed above is in order to perform the agreement (the agreed WINDA Terms and Conditions) with you, cf. GDPR Article 6(1)(a) and (b).

We may ask third parties, such as Certification Bodies, to verify the information you provide to us as part of the GWO registration and/or audit procedures.

Your work email address is primarily used for purposes of notifying you of changes to, your profile, changes to the Terms & Conditions, password retrieval, and safety-related information from GWO. We may use your email address to request further information from you or provide you with HSE relevant information.

Your uploads of training records are saved for statistical purposes as well as ensuring an accurate credit balance and maintain an audit trail.

All your search results in WINDA are logged and may be retrieved by GWO Audit and Compliance Committee, the Secretariat, or the person whose WINDA ID you have searched. All searches you have performed against a specific WINDA ID are visible to the Course Participant user associated with this specific WINDA ID. Subject to a legal request, authorities may also gain access to the search log.

We also keep an audit trail of users that you have created and removed from the account as well as the access level that you have provided them.

The training records that you upload into WINDA are visible to anyone that has registered for a profile in WINDA and performs a search against the specific WINDA ID(S). The search results include the Course Participant’s name, valid training records, Training completion dates, and expiry and the location and company name of the Training Provider that uploaded the training.

Certification Body users’ personal data in WINDA
When registering as a Certification Body user in WINDA, you agree to the WINDA Terms & Conditions. As a Certification Body user, you can create Auditor users and you gain full WINDA functionality when you have created an Auditor user and this auditor was approved by GWO, holds a valid certificate, and meets the minimum auditor requirements set by GWO. Full WINDA functionality means that you can also create Training Provider users and provide certificates and audits for their training providers. You can also create additional logins for the Certification Body.

When registering as a Certification Body user in the WINDA database, we will collect and process the following personal data about you:

•   First Name(s)
•   Surname
•   Work email address
•   Organization name
•   Website
•   Street address 1
•   Street address 2
•   City
•   Postal code
•   Country
•   Region
•   ISO document (attached as pdf)
•   ISO certificate number

GWO’s legal basis for processing the personal data as listed above is in order to perform the agreement (the agreed WINDA Terms and Conditions) with you, cf. GDPR Article 6(1)(b).

The audit records that you upload to WINDA are visible to GWO database administrators, Auditors that you have created in WINDA, and Training Providers for whom you provided specific audits. The search results include certificate document, audit report document, Training Providers WINDA ID, Training Providers company name, audit completion date, Auditors, which were part of the audit.

Auditor users’ personal data in WINDA
When your Certification Body creates an Auditor user for you, you will be asked to agree to the WINDA Terms & Conditions. As an Audi-tor user, you gain full WINDA functionality when you have been approved by GWO, hold a valid certificate, and meet the minimum auditor requirements set by GWO. Full WINDA functionality means that you can also create Training Provider users and provide certificates and audits for their training providers.

When your Certification Body creates an Auditor user for you in the WINDA database, we will collect and process the following personal data about you:

•   First Name(s)
•   Surname
•   Work email address
•   Phone number
•   Street address 1
•   Street address 2
•   City
•   Postal code
•   Country
•   ISO/OHSAS documentation
•   AQT certificate
•   AQT Valid From
•   AQT Valid To

GWO’s legal basis for processing the personal data as listed above is in order to perform the agreement (the agreed WINDA Terms and Conditions) with you, cf. GDPR Article 6(1)(b).

The audit records that you upload to WINDA are visible to GWO database administrators, Auditors that belong to your Certification Body profile in WINDA, and Training Providers for whom you provided specific audits. The search results include certificate document, audit report document, Training Providers WINDA ID, Training Providers company name, audit completion date, Auditors, which were part of the audit.

Purpose of collecting data
GWO will collect and process your personal data for the following purposes:

•   For registration purposes in our WINDA database win-da.globalwindsafety.org
•   In WINDA, your email address is registered for notification purposes concerning changes to your profile or the Terms and Conditions, password retrieval, or safety-related information from GWO
•   To allow Course Participants information on who has viewed their training records and enable the option to block specific users from viewing these records
•   If you sign up for a newsletter, we register your email address for this purpose. We will obtain your consent upon the sign-up process in accordance with GDPR Article 6(1)(a).
•   Regarding Training Provider users’ and Organisation users’ registration, your email address is also registered, so we can request further information from you
•   Audit purposes or defense of legal claims
•   In aggregate and anonymized form to produce statistics, analysis and in other ways related to achieving the goals of the GWO
•   For Certification Body users and Auditor users’ email-address is registered for notification purposes concerning audit approval process and new audit requirements]

We aggregate and pseudonymize (and anonymize to the extent possible) all personal data to the furthest extent possible.

Disclosure of personal data to third parties
GWO only share Course Participants name and valid training history with other registered WINDA users who are in possession of your WINDA ID. If you perform a search against another person’s WINDA ID, the Course Participant whose training records you have searched will be able to see your name and the email address associated with your WINDA user profile.

Apart from the above, GWO does not share your personal data with any third party or with companies, organizations, and individuals outside GWO, unless you consent to such disclosure or it is required by law, regulators, public authorities (in particular supervisory authorities), relevant accredited organisations or court orders or unless necessary as part of the establishment, exercise or defense of legal claims, e.g. towards legal representation.

Data processors
We use a number of data processors who are providing systems and services to us, including the following:

Microsoft Azure (legal entity residing in Ireland)

Netcompany (legal entity residing in Denmark)

Amazon SES (legal entity residing in Luxembourg)

Other relevant data processors and sub-data processors within the category of providing necessary support (IT, etc.) to GWO and WINDA in order to provide you with a sufficient WINDA platform.

Transfer of data to third countries outside the EU/EEA
When you share your WINDA ID with other users, they are able to search and verify your training records from anywhere in the world.

Subject to legal requirements, GWO does not actively transfer personal data to any third party, including third parties outside of EU/EEA.

However, if you share your WINDA ID with other users outside the EU/EEA, and/or if the other user access WINDA from a third country, GWO will theoretically share your training records with that third country in question via a so-called ‘view access’. The legal basis for GWO to be able to share your training record via this ‘view access’ is GDPR Article 49(1)(b).

Some of our sub-data processors have the possibility to use support from third countries outside the EU/EEA via a ‘view access. The legal basis for this ‘view access is the European Commission’s Standard Contractual Clauses.

Storage period and deletion of User accounts
GWO does not want to retain unnecessary data.

Course Participant and organisational user accounts may be deactivated at any given time upon written request from the user to in-fo@globalwindsafety.org. Deactivation means we will delete your WINDA ID. All records of training associated with the WINDA ID will remain in the system, however, the association between your name/email address and these records will be removed.

Training Provider user's accounts may be deactivated at any given time upon written request from the user to info@globalwindsafety.org. De-activation means we will discontinue your users’ rights to upload records. All uploaded records remain in the system, and the association between the Training Provider’s name and the WINDA ID’s to which records were originally uploaded will remain in the system to ensure a complete audit trail.

Certification Body user's accounts may be deactivated at any given time upon written request from the user to info@globalwindsafety.org. Deactivation means we will discontinue your users’ rights to upload audit records, create new Auditor, Certification Body or Training Provider user profiles, administrate Training Providers, Auditors, or your Certification Body users profile. All Auditor users associated with your Certification Body profile will be deactivated as well. All up-loaded records remain in the system, and the association between the Training Provider’s name, certificate document, audit report document, audit completion date to which records were originally uploaded will remain in the system to ensure a complete audit trail.

Auditor user's accounts may be deactivated at any given time upon written request from the user to info@globalwindsafety.org. Deactivation means we will discontinue your users’ rights to upload audit records, create new Training Provider user profiles, administrate Training Providers, or your Auditor users profile. All uploaded records remain in the system, and the association between the Training Provider’s name, Certification Body’s name, certificate document, audit report document, audit completion date to which records were originally up-loaded will remain in the system to ensure a complete audit trail.

The different types of user accounts will automatically be deactivated after a certain period depending on the specific type of user profile.

Course Participants
Course Participant user accounts and all data associated with the user type along with the WINDA ID will be deleted after 48 months of inactivity. Activity is defined as either a user login or a training record added to the user profile by a certified Training Provider. Users will automatically be notified in advance of expiry. To prevent the account from expiring log in to the account on a regular basis. GWO will not be able to reactivate expired accounts. Organisation user accounts will be deleted after 12 months of inactivity. Users will automatically be notified in advance of expiry. To prevent the account from expiring log in to the account on a regular basis. GWO will not be able to reactivate expired accounts.

Training Providers
Training Provider users will be deleted after 24 months of inactivity. Users will automatically be notified in advance of expiry. To prevent the account from expiring log in to the account on a regular basis. GWO will not be able to reactivate expired accounts. All users may be deleted (deactivated) by the GWO Secretariat for any reason.

Certification Body users
Certification Body users are archived 24 months after their last activity on WINDA. Activity can be e.g. logging in to WINDA, having active Auditor users on their Organization account, having a valid certificate on WINDA that they have provided for the Training Provider user.

Auditor users
Auditor users are archived 24 months after their last activity on WIN-DA. Activity can be e.g. logging in to WINDA, having an active AQT certificate, having a valid certificate on WINDA that they have provided for the Training Provider user.

Security of the data
All data is transmitted over the public internet and is encrypted via https.

The database is physically hosted on Microsoft Azure located in Nothern Europe. No physical access to data centers is provided to customers.

Web servers are located within a virtual private cloud. A firewall protects the database by only allowing direct access using credentials from a whitelisted IP address. Application level access controls are in place to ensure data security

Your rights
Under the applicable national / EU data protection law, you are entitled to:

•   request access to the personal data
•   request information about your personal data and the purposes and potential recipients of this data
•   have personal data rectified or deleted.
•   object to the processing of your personal data as well as the right to data portability

You also have the right to lodge a complaint with your national data protection authority (the Danish Data Protection Agency) or other public authorities governing the protection of your personal data.

Furthermore, you have the right to withdraw your consent. However, our processing based on your consent up until your withdrawal will be legal.

The right to object
You have the right to object – on grounds relating to your particular situation – to the processing of personal data where the legal basis for our processing is legitimate interests, as stated above. If you exercise your right to object, GWO may no longer process your personal data unless GWO demonstrates compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims.

You also have the right at any time to object to the processing of your personal data for marketing purposes, which includes the right to object to profiling in so far as it relates to direct marketing. If you object to GWO processing for the purpose of direct marketing, your personal data may no longer be processed for this purpose.

If you need further information in regard to the processing of personal data, and/or you wish to use any of your rights, please contact the GWO’s secretariat at info@globalwindsafety.org

This privacy notice is subject to a regular review and might be updated if needed. We will publish any new version on win-da.globalwindsafety.org and on globalwindsafety.org.

Cookie policy

Cookies
In the following sections, you can learn more about cookies and how they are used on the sites.

What is a cookie?
A cookie is a small data file that websites store on your computer in order to recognize it the next time you visit the website. A cookie is a passive file and cannot carry a computer virus or other damaging programs.

Cookies on globalwindsafety.org and winda.globalwindsafety.org
On globalwindsafety.org and winda.globalwindsafety.org we only use cookies to collect and generate statistics about the visitors’ usage of the website. The data is exclusively used for web analysis to enhance the user experience. Confidentiality of all personal data is protected, and information is under no circumstances redistributed to a third party.

Rejection of cookies
You can reject cookies on your computer via the settings in your browser. Please be aware that by rejecting cookies you risk not being able to use all the features of globalwindsafety.org. Rejecting cookies will prevent you from accessing winda.globalwindsafety.org. As a cookie is located at the visitor’s computer, you are at any time able to see, change or delete a cookie.

If you do not wish to receive cookies from globalwindsafety.org and winda.globalwindsafety.org, you can in most newer browsers, under the internet settings, choose the advanced cookie settings and add this domain to the list of websites from where you want to block the cookies. You will not be able to access winda.globalwindsafety.org if you block cookies.

For more information on the rejection or deletion of cookies, please visit www.allaboutcookies.org.

Why do we notify about cookies?
We notify you about cookies because we, like all other Danish websites, are obligated to do so under “The Act on Processing of Personal Data”

Please notice that the English version of the act is translated for Danish Data Protection Agency. The official version is published in "Lovtidende" (Official Journal) on 2 June 2000. Only the Danish version of the text has legal validity.

Questions or objections must be addressed to the Global Wind Organisation's secretariat at info@globalwindsafety.org.