CORE DATA PROTECTION PRINCIPLES
The ICIA operates permanent administrative offices in London, Geneva, and Hong Kong. We treat personal privacy with the same empirical rigor applied to our gemstone standards, ensuring data processing complies with the key tenets of European and UK data protection frameworks.
Lawfulness & Transparency
Personal data is processed lawfully, fairly, and transparently. We collect identifiable data solely when supported by a legitimate statutory interest, contract execution, or explicit consent.
Purpose & Minimization
We collect only the baseline telemetry required to verify accredited credentials, enforce ADRPS escrow bonds[cite: 1], and record physical gemstone measurements on the IGSTS 3D digital twin ledger[cite: 1, 8].
Security & Integrity
Registry data is secured with AES-256 encryption at rest and TLS 1.3 in transit. Digital signatures from PCAS appraisers and OA-LAB facilities rely on unique cryptographic keys[cite: 2, 5].
DATA COLLECTION & PROCESSING MATRIX
Detailed disclosure of personal and corporate data collected across the ICIA ecosystem, along with statutory legal bases.
| DATA CATEGORY | DATA ELEMENTS COLLECTED | PURPOSE OF PROCESSING | LEGAL BASIS |
|---|---|---|---|
| Accreditation Dossiers | Director names, corporate registrations, business addresses, billing details, and compliance officer contacts. | Vetting CABCS merchants[cite: 1, 3], maintaining the public directory, and administering ADRPS escrow balances[cite: 1, 3]. | GDPR Art. 6(1)(b) (Contract Execution) |
| Appraiser Credentials | Examiner full names, government IDs, FGA/GG diplomas, CPD credits, and cryptographic signing public keys[cite: 2]. | PCAS certification issuance[cite: 2], signatory verification on reports[cite: 2, 5], and anti-impersonation fraud controls. | GDPR Art. 6(1)(b) & (f) (Legitimate Interest) |
| Arbitration Records | Claimant identity, transaction proofs, invoice receipts, test reports, and banking details for restitution wires[cite: 5]. | Adjudicating disputes under OA-COM rules and executing 14-day advance restitution payouts[cite: 5]. | GDPR Art. 6(1)(c) (Legal Obligation) |
| 3D Digital Twin Hash | Volumetric inclusions, facet coordinates, and FTIR curves[cite: 1, 8]. Contains no personal identity data by design. |
Preventing physical substitution and verifying crystal identity on cert.icia.uk[cite: 1, 8].
|
Non-Personal Data (Anonymized Mesh) |
| Web Server Logs | IP address, user-agent string, referrer URL, and timestamp recorded during certificate query lookups. | API rate-limiting, defending against denial-of-service attacks, and ensuring infrastructure stability. | GDPR Art. 6(1)(f) (Network Security) |
YOUR STATUTORY RIGHTS UNDER GDPR
Data subjects residing within the European Economic Area (EEA), the United Kingdom, and Switzerland hold statutory rights regarding their personal data held by the ICIA.
Right of Access
You may request confirmation as to whether your personal data is processed by the ICIA and obtain a copy of all retained records without administrative charge.
Rectification & Erasure
You hold the right to rectify inaccurate records or request deletion of data that is no longer required for statutory, regulatory, or arbitral enforcement purposes.
Data Portability
You may obtain personal accreditation dossiers and examination records in a structured, commonly used, machine-readable JSON format for transfer to another authority.
Right to Object
You may object at any time to data processing carried out under legitimate interest grounds, except where overriding statutory arbitral obligations apply[cite: 5].
CROSS-BORDER TRANSFERS & DATA RETENTION
International Data Transfers (Art. 44–49)
Because the ICIA maintains operational infrastructure across the UK, Switzerland, Hong Kong, and international testing facilities, cross-border transfers of personal data are governed by:
- • Standard Contractual Clauses (SCCs): Approved by the European Commission for transfers to third countries lacking an adequacy decision.
- • UK International Data Transfer Addendum: Compliant with the Information Commissioner’s Office (ICO) mandates.
- • Adequacy Decisions: Applied to transfers within the EEA and the Swiss Federal Data Protection Act (FADP) framework.
Retention Periods & Disciplinary Archives
Data retention aligns strictly with commercial, tax, and statutory arbitration periods:
- • Membership & Escrow Records: Retained for 7 years following contract termination to satisfy financial and audit regulations.
- • Arbitration Case Records: Retained for 10 years following final award issuance pursuant to the 1958 New York Convention[cite: 5].
- • Disciplinary Sanctions (Red Card): Maintained permanently in the public registry to protect trade integrity[cite: 1, 3].
Data Protection Officer (DPO) & Supervisory Recourse
To exercise your statutory data subject rights, submit a Subject Access Request (SAR), or direct inquiries to our Data Protection Officer, contact our dedicated compliance desk. You also maintain the statutory right to lodge a complaint with your competent supervisory authority (e.g., the UK Information Commissioner’s Office, the Swiss FDPIC, or an EU Member State Data Protection Authority).