STATUTORY COMPLIANCE • GDPR & FADP FRAMEWORK
Personal Information & Data Protection
The institutional covenants, technical safeguards, and statutory rights governing personal data processing across the ICIA Secretary Bureau, accredited laboratory registries, and digital interfaces under UK GDPR and Swiss federal mandates.
DATA FIDUCIARY GOVERNANCE
Privacy Principles & Legal Grounds
The International Crystal Industry Alliance (ICIA) functions as an independent, non-governmental regulatory body. In fulfilling its international metrological mandate, ICIA processes personal data strictly in adherence to the UK Data Protection Act 2018, EU General Data Protection Regulation (Regulation (EU) 2016/679), and Swiss Federal Act on Data Protection (FADP).
Our data governance is anchored by the principle of storage limitation and purposeful necessity. We separate verifiable empirical gemstone ledger data from private identities, ensuring that sensitive personal information is never exposed on public verification registers.
STATUTORY SCOPE OF PROCESSING
Categories of Data Collected
1. Identifiers & Institutional Credentials: Legal name, professional affiliation, OAISS-accredited laboratory node ID, Certification Committee credential records, official email, and corporate billing details collected during accreditation procedures.
2. Specimen Custody & Auditing Records: Chains of physical custody, laboratory submission metadata, and ADRPS arbitration testimonies. Personal identities tied to specimen testing certificates are strictly pseudonymized via non-reversible SHA-256 cryptographic hashes.
3. Telemetry & Technical Security Logs: IP address, browser cryptographic user-agent string, access timestamps, and session tokens utilized solely for perimeter intrusion defense, audit trail verification, and rate-limiting enforcement.
PROHIBITION OF COMMERCIALIZATION
Strict Non-Disclosure Mandate
ICIA never sells, leases, rents, or monetizes personal data with third-party advertising syndicates, auction entities, or commercial brokers. Data disclosures occur exclusively under binding statutory tribunal orders, formal Common Law legal processes, or verified mutual written consent during cross-border arbitration hearings.
ICIA Secretary Bureau — Legal Office
The legal supervisory office responsible for personal data management across global Secretary Bureau hubs and accredited testing nodes.
Ledger Pseudonymization
Public specimen records on cert.icia.uk feature only empirical mineralogical parameters. Personal ownership titles and lab technician identities are ring-fenced behind encrypted off-chain archival nodes.
STATUTORY DATA RIGHTS
Individual Rights Under International Law
Data subjects residing within the United Kingdom, European Economic Area, Switzerland, or participating jurisdictions retain non-negotiable statutory rights over their personal records.
ARTICLE 15
Right of Access
The statutory right to request a verified transcript of all personal information, laboratory submissions, and licensing credentials cataloged under your identity.
ARTICLE 16
Right to Rectification
The right to immediately amend, rectify, or complete inaccurate institutional representations, contact registries, or professional credential details.
ARTICLE 17
Right to Erasure
The right to request the deletion of personal account profiles, subject strictly to immutable Common Law legal custody obligations and statutory anti-fraud requirements.
ARTICLE 20
Data Portability
The right to obtain your individual data ledger transcript in a structured, machine-readable (JSON/CSV) cryptographic file for cross-jurisdictional transfer.
RETENTION SCHEDULE
Archival Limitation Cycles
Administrative inquiries and non-member communications are securely expunged after 24 months. Arbitration records, ADRPS compliance filings, and formal laboratory accreditation charters are preserved under statutory 7-year archives pursuant to UK commercial governance law.
STATUTORY REQUEST DESK
Exercising Your Statutory Rights
To submit a formal Subject Access Request (SAR) or report a potential data protection violation, file directly with the Data Protection Officer at the ICIA Secretary Bureau in London.