Privacy notice
What we collect, why, who sees it and how long we keep it. Written to be read. Last updated 12 October 2026.
Who we are
The Accreditation Desk is a trading name of TAD Compliance Ltd, a company registered in England and Wales, company number 17464090, registered office 82A James Carter Road, Mildenhall, Suffolk IP28 7DE, United Kingdom. We hold the information described here and we are registered with the UK Information Commissioner's Office, registration C1992037. Because we offer this service to businesses in New Zealand, we also work to the information privacy principles of the New Zealand Privacy Act 2020 when we handle information about people in New Zealand. For anything about your data, email enquiries@accreditationdesk.co.nz.
What we collect and why
When you enquire. Your name, company, email, phone number, which scheme you are working towards and anything you choose to tell us. We use it to reply and to quote. We collect it because you have asked us to take steps before entering a contract.
When you become a client. The company information, insurance certificates, training records, inspection and toolbox records, incident register and details of named people that SiteWise, a Tōtika member scheme or a main contractor asks for. This often includes personal information about your workers, such as names, job titles, qualifications and licence numbers. We use it only to write your documents and to prepare your submission, and for SiteWise to complete and submit your assessment when you have approved it. You remain responsible for your workers' information and we act on your instructions. We ask you not to send workers' health monitoring results or other medical information; the schemes want to see that monitoring happens, not the results, and we remove personal details that a submission does not need.
When we write to another business. We sometimes email companies we think we could work with, using contact details they publish. Every email says who we are and how to stop further contact, and we keep a do not contact list so that a no stays a no.
Invoices and accounts. The records the law requires a company to keep.
Who else handles it
We do not sell data and we do not share it for anyone else's marketing. We use a small number of suppliers who process data on our behalf: Netlify (website hosting and the enquiry forms), and Google (Workspace email and file storage, and Google Ads conversion measurement, described under Cookies below). For SiteWise, we complete and submit the assessment from your business's own SiteWise account, using our own user login that you add to the account, and only after you approve it in writing; Site Safe then handles it under its own privacy notice. For Tōtika, the submission is made by your own employee, on your own account, under the member scheme's privacy notice; we do not submit Tōtika assessments ourselves. We are based in the United Kingdom, so information you give us is held outside New Zealand, in the UK and in our suppliers' data centres. Where it is held outside the UK, the transfer is covered by UK adequacy regulations or by the contractual safeguards approved for UK transfers.
How long we keep it
Enquiries that do not become work are deleted within twelve months. Client files are kept while we are working for you and for up to twenty four months after our last piece of work, so that a renewal does not mean starting again. Ask and we will delete them sooner. Invoices and accounting records are kept for six years as UK law requires. Do not contact records are kept for as long as they are needed to honour your request.
Your rights
You can ask for a copy of the information we hold about you, ask us to correct it, delete it or stop using it, and object to our use of it. Email enquiries@accreditationdesk.co.nz and we will reply within one month, usually much sooner. If you are unhappy with how we have handled your information you can complain to the Office of the Privacy Commissioner in New Zealand at privacy.org.nz or to the UK Information Commissioner's Office at ico.org.uk, although we would like the chance to put it right first.