Privacy Policy
How ISO for Dummies and Ascendifye handle your information.
Last updated: October 27, 2026
Who we are
This website, ISO for Dummies, is run by Ascendifye, the company founded by Amber Scapellato. We also offer ISO 27001 internal audit services that you can book through the site. In this policy, "we", "us" and "our" mean Ascendifye. "You" means anyone who visits the site or contacts us through it.
Ascendifye decides how and why the personal information described here is used, so we are responsible for it (in GDPR terms, the "controller").
What we collect
- Booking details. When you book a call or an audit, our scheduling provider collects what you enter, such as your name, email address, company and any notes. We receive these details so we can hold the meeting.
- Messages you send us. If you use the contact form on the Services page, we collect your name, email, the topic you choose and your message. The form is delivered to us by a form-handling provider, which forwards it to us privately by email.
- Partnership enquiries. If you use the form on the Partnerships page, we collect your name, company, email, the type of partnership, your message and, if you give it, your website. The form is delivered to us by a form-handling provider, which forwards it to us privately by email.
- Usage information, only with your OK. If you allow analytics, we may collect things like the pages you visit, roughly where you are (country or region), your device and browser type, and how you arrived. If you say no, we don't collect this.
- Ask the ISO Guide questions. The guide runs inside your browser using this site's own content. Your questions are not sent to us or anyone else.
- Practice progress. Your scores, badges and risk register entries in the practice modules are saved in your own browser. They are not sent to us.
We don't ask for sensitive information (such as health data), and we ask you not to include it in bookings or messages.
How we use it and why we are allowed to
| What we do | Information used | Legal basis |
|---|---|---|
| Set up and hold calls and internal audits you book | Booking details, messages | Taking steps at your request before a contract, or performing a contract |
| Reply to your questions and partnership enquiries | Contact and partnership form details | Our legitimate interest in answering enquiries |
| Understand which pages help people and improve the site | Usage information | Your consent, which you can withdraw at any time |
| Keep business and tax records, and meet legal duties | Booking and billing details | Legal obligation |
| Keep the site secure and working | Essential storage, basic technical data | Legitimate interest |
We do not sell your personal information, and we do not share it for cross-context behavioural advertising.
Cookies and local storage
Cookies and local storage are small pieces of data saved in your browser. This site uses two kinds:
- Essential. These remember your cookie choice and save your practice progress. They are needed for the site to work as you expect, so they are always on. They stay in your browser until you clear them.
- Analytics and embeds (optional). These are only used if you click "Accept all" or turn them on in Preferences. They cover site usage statistics and loading the booking calendar inside the Services page, which comes from our scheduling provider and may set its own cookies.
No optional cookies or tracking scripts are loaded before you choose. You can change your mind at any time with Cookie settings, which is also in the footer of every page. You can also clear or block cookies in your browser settings.
Who we share it with
- Scheduling provider, which runs our booking pages and stores booking details for us.
- Form-handling provider, which receives contact and partnership form submissions and forwards them to us.
- Email and productivity providers we use to talk with you and run the business.
- Analytics provider, only if you have consented.
- Professional advisers and authorities, such as accountants, lawyers or regulators, when needed or required by law.
- A buyer or successor, if the business is ever merged, sold or reorganised. Your information would stay protected by terms like these.
The case study video on this site is hosted on this website itself, not by a third-party video service. The fonts are also served from this website, so loading a page does not send requests to a third-party font service.
How long we keep it
- Booking details, messages and partnership enquiries: up to 3 years after our last contact, unless they become part of an engagement.
- Engagement and billing records: as long as tax and accounting law requires.
- Analytics data: no longer than 26 months, in a form that does not directly identify you.
- Browser storage: until you clear it or change your choice.
[Placeholder: confirm these periods before publishing.]
Your rights
Depending on where you live, you may have the right to:
- see the personal information we hold about you and get a copy;
- have it corrected or deleted;
- object to, or ask us to limit, how we use it;
- receive it in a portable format;
- withdraw consent at any time, without affecting what happened before;
- know what we collect and why, and not be treated differently for using your rights (for California residents);
- complain to your local data protection authority.
To use any of these rights, contact us using the details below. We will reply within the time the law sets, usually one month. We may need to confirm who you are first.
International transfers
Our service providers may store or process information in other countries, including the United States. When information about people in the UK or European Economic Area is moved abroad, we rely on recognised safeguards, such as standard contractual clauses or an adequacy decision.
Security
We use reasonable technical and organisational measures to protect personal information, such as access controls, multi-factor authentication and encrypted connections. No method is perfectly secure, but we work to protect your information and will tell you and the authorities about a breach where the law requires.
Children
This site and our services are meant for businesses and professionals. They are not aimed at children under 16, and we do not knowingly collect their information. If you think a child has shared information with us, contact us and we will delete it.
Links to other websites
The site links to other websites, such as our booking page and LinkedIn. Those sites have their own privacy policies, and we are not responsible for how they handle your information.
Changes to this policy
We may update this policy from time to time. The date at the top shows the latest version. If a change is significant, we will make it clear on the site.
Contact us
Questions or requests about your privacy go to Ascendifye (Amber Scapellato).
Use the contact form and we will reply by email. For partnership enquiries, use the partnerships form.
See also our Terms and Conditions.