Privacy Policy

Last updated: 1 November 2026

This policy explains what personal information we collect, why we use it, who we share it with, how long we keep it, and your rights. It covers our website, membership and support, and the Green Tourism Certified certification process, including the GreenCheck portal and the Members Area.

1. Who we are

Green Business UK Ltd (company number SC227139, registered in Scotland) is the certification body and delivery company for the Green Tourism Certified programme. We run Green Tourism membership, support and the website, audit businesses against the Green Tourism Certified standard, make certification decisions and issue certificates. We are the controller responsible for the personal information described in this policy.

In this policy, “we”, “us” and “our” mean Green Business UK Ltd. We are registered with the Information Commissioner’s Office (ICO), registration number ZA190291.

Questions about your data: email enquiries@green-tourism.com, with “Data protection” in the subject line, or write to us at Green Business UK Ltd, Office 111, Perth Creative Exchange, Stormont Street, Perth PH1 5NW.

2. The information we collect

When you contact us or visit our website

• Your name, job title, organisation, email address and phone number, if you make an enquiry or sign up for news.
• Technical information such as your IP address, browser and device type, and the pages you visit. See section 10 on cookies.

When your business joins or applies for certification

• Contact details for the people we deal with, including the owner or senior manager who signs the Code of Conduct and your green coordinator.
• Business details, such as name, address, business scope and number of employees.
• Billing and payment information. Card payments are handled by our payment providers. We do not store full card numbers.
• Evidence you upload to GreenCheck, such as documents, records, photographs and video. Some of this may include information about your staff or other people.
• Audit records, including notes of interviews with your staff. Interviewees are anonymised in audit reports, but their name and role are recorded in GreenCheck.
• Findings, corrective actions, certification decisions, complaints, appeals and correspondence.
• Information from due-diligence checks carried out as part of your certification audit (see section 4).

3. How and why we use your information

Data protection law requires us to have a legal basis for each use. Ours are set out below.

Where we rely on legitimate interests, we have balanced our interests against yours. You can ask us for more detail.

We do not make decisions about you based solely on automated processing. Every certification decision is made by a person.

4. Due-diligence checks

As part of the certification audit, we check that a business is eligible for certification. This includes checks on legal and regulatory compliance, financial integrity, sanctions, human rights and labour standards. These checks may occasionally involve information about allegations, investigations or convictions relating to the business or the people who own or control it.

We only use this kind of information where the law allows it, under the conditions in Schedule 1 of the Data Protection Act 2018. We keep it confidential, limit access to the people who need it to make a decision, and do not keep it longer than necessary.

5. What we make public

When your business is certified, we publish its name, business type and location, with a link to its website, on the public register at www.green-tourism.com/our-members/. If your certification is suspended, the register shows this. If it ends, we remove your business from the register.

We do not publish any information about your business before it is certified. Your evidence and audit records are never published.

6. Who we share your information with

We only share personal information where it is necessary, and we never sell it.

• Green Tourism Certified Ltd, the owner of the Green Tourism Certified standard, may see certification records when it checks the scheme is run correctly or reviews an appeal.
• Accreditation bodies and their assessors, who check our work as a certification body.
• Our auditors, who may be employed by us or contracted to us, and who are bound by confidentiality.
• Service providers who help us run Green Tourism, such as the providers of GreenCheck, our website, email, IT and cloud storage, and payment processing. They act only on our instructions and must keep your information secure.
• Professional advisors, such as our accountants and legal advisor.
• Public authorities and law enforcement, where the law requires it, or where it is necessary to protect our rights or those of others.

7. Transfers outside the UK

Some of our service providers store or process data outside the UK, for example on cloud servers. When this happens, we make sure your information is protected by one of the following:

• the country has been approved by the UK Government as providing adequate protection (this includes the countries of the European Economic Area);
• a contract using the UK’s approved data transfer clauses; or
• for US providers, certification under the UK Extension to the EU–US Data Privacy Framework.

You can ask us for more information about the safeguards we use.

8. How long we keep your information

When we no longer need information, we delete it securely or anonymise it.

9. Keeping your information secure

We use appropriate technical and organisational measures to protect your information, including secure servers, access controls and encryption where appropriate. Only authorised people who need it for their work can access personal information, and they must keep it confidential.

If a personal data breach occurs, we will report it to the ICO within 72 hours where the law requires. If a breach is likely to put you at high risk, we will tell you without undue delay.

10. Cookies

Our website uses cookies and similar technologies. Some are essential for the website to work. Others help us understand how the website is used, and we only use these with your consent. For details, including how to update or withdraw your consent at any time, see our Cookie Policy.

11. Your rights

You have the right to:

• access the personal information we hold about you;
• correct information that is inaccurate or incomplete;
• delete your information, in some circumstances;
• restrict how we use your information, in some circumstances;
• object to our use of your information where we rely on legitimate interests. We will stop unless we have compelling reasons to continue. You can always object to direct marketing, and we will stop straight away;
• data portability: receive information you gave us in a commonly used electronic format, or ask us to send it to another organisation; and
• withdraw consent at any time, where we rely on consent.

Some of these rights only apply in certain circumstances. If we cannot meet your request, we will tell you why.

To make a request, contact us using the details in section 1. You can ask in writing or verbally. We may need to confirm your identity. We will reply within one month, and there is normally no charge.

If you are unhappy with how we have handled your information, please contact us first. You also have the right to complain to the Information Commissioner’s Office at www.ico.org.uk or on 0303 123 1113. If you are based in the EU, you can also complain to your local data protection authority.

12. Other websites

Our website may link to other websites. We are not responsible for their privacy practices, so please read their privacy policies.

13. Changes to this policy

We may update this policy from time to time. The date at the top shows when it was last changed. If we make significant changes that affect members, we will email you before they take effect.

14. How this policy relates to our other documents

This policy forms part of the information we give you under the Green Tourism Certification Terms. For how we handle complaints, see our Complaints Procedure.