Privacy Policy

Last updated: 7 July 2026

This Privacy Policy explains how CertGuard ("we", "us", "our") collects, uses, and protects your personal data when you use our website and services at https://certguard.co.uk.

CertGuard is developed and operated by OEMDrive, a UK-based technology company. Our service is available to self-employed professionals and micro businesses worldwide.

1. Who we are

Data controller: OEMDrive
Address: 10 Duncombe Street, Bletchley, Milton Keynes, MK2 2LY
Email: [email protected]
Website: https://oemdrive.co.uk/

2. What data we collect

We collect the following categories of personal data:

• Account information: name, email address, phone number (optional), company name (optional), profession, country, timezone, and password (stored as a secure hash).
• Certificate data: certificate names, types, issuing bodies, certificate numbers, issue and expiry dates, cert holder names (for team tracking), notes, and uploaded documents (PDF, JPG, PNG).
• Subscription and billing: subscription plan, trial dates, payment status, and Stripe customer ID. Payment card details are processed by Stripe and are not stored on our servers.
• Technical data: IP address, browser type, approximate country (from CDN headers where available), and session information for security and service operation.
• Communications: emails we send to you (reminders, onboarding, account notifications) and support correspondence.

3. Lawful bases for processing

We process personal data only where we have a valid legal basis under UK GDPR and EU GDPR:

4. How we use your data

We use your personal data to:

• Provide and maintain the CertGuard service
• Send certification expiry reminders by email (and SMS on eligible plans, when enabled)
• Process subscriptions and payments in your local currency where supported
• Generate compliance pack PDF exports
• Respond to support requests
• Improve our service and fix technical issues
• Comply with legal obligations

Automated decision-making: We do not make decisions based solely on automated processing that produce legal or similarly significant effects.

5. International users and data transfers

CertGuard serves customers globally. Your account country and timezone help us show relevant pricing, send reminders at appropriate times, and route checkout to the correct currency.

Primary data storage is on servers in the UK/EU. Some service providers (such as Stripe, SendGrid, and Twilio) may process data in the United States or other countries. Where data is transferred outside the UK/EEA, we rely on appropriate safeguards such as Standard Contractual Clauses and processor agreements.

6. Data storage and security

Your data is stored on secure servers with encrypted connections (HTTPS), hashed passwords, access controls, and secure file storage for uploaded certificates. Uploaded files are stored outside the public web root.

7. Data sharing and processors

We do not sell your personal data. We share data only with trusted service providers necessary to operate CertGuard:

• Stripe — payment processing and subscription billing (global)
• SendGrid — transactional email delivery
• Twilio — SMS reminders (Growing Business plan, when enabled)
• Hosting providers — server and database infrastructure

All processors are bound by data processing agreements and process data only on our instructions.

8. Data retention

We retain your account data and certificates for as long as your account is active. If you delete your account, we permanently delete your personal data and uploaded files within 30 days, except where we are required to retain data for legal or accounting purposes (for example, payment records).

9. Your rights

If you are in the UK, EEA, or another jurisdiction with similar laws, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data via your account settings
• Delete your account and associated data
• Export your data in a portable format (JSON export in Account → Privacy, plus compliance pack PDF)
• Object to or restrict certain processing
• Withdraw consent where processing is based on consent
• Lodge a complaint with a supervisory authority (e.g. the UK ICO at ico.org.uk, or your local data protection authority)

We respond to privacy requests within one month, as required by UK GDPR. Complex requests may be extended by a further two months where permitted by law.

To exercise your rights, contact [email protected], use Account → Privacy, or delete your account from Account Settings.

10. Cookies and similar technologies

We use essential cookies for login and security. Optional preference and analytics cookies are only used with your consent. Full details, including how to change your choices, are in our Cookie Policy.

11. Other standards and regions

• UK GDPR — primary framework for users in the United Kingdom.
• EU GDPR — equivalent rights for users in the European Economic Area.
• PECR / ePrivacy — cookie consent rules implemented through our cookie banner.
• US state privacy laws — where applicable, we honour rights to know, delete, and opt out of sale/sharing (we do not sell personal data).

12. Children

CertGuard is a business service and is not intended for anyone under 18.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version on this page with a revised date. Continued use of the service after changes constitutes acceptance.

14. Contact and complaints

For privacy questions or requests, email OEMDrive — this is the quickest way to reach us:

[email protected]
10 Duncombe Street, Bletchley, Milton Keynes, MK2 2LY

Registered phone: 0203 8794 650. You may also complain to the UK Information Commissioner's Office (ICO) at ico.org.uk or your local supervisory authority.