Find facilities
41,454 certified facilities worldwide46,358 certifications tracked134 countries coveredLEED · GOTS · OEKO-TEX® · WRAP11,952 certificates currently valid4,592 renewals due in 90 days4,253 multi-certified companies
Legal·Effective 8 Oct 2026·Last updated 8 Oct 2026

Privacy Policy

What personal data we process, why, on what legal basis under the EU and UK GDPR, and the rights you have.

1. Controller

The controller for personal data processed through Integrity Thread is NOVOTECHY LLC, a Florida limited liability company (Florida document number L26000520485), 10861 Sakonnet River Drive, Unit 204, Tampa, FL 33615, USA. For anything about your data, contact info@integritythread.com.

This policy is written to meet the EU General Data Protection Regulation (GDPR) and, for people in the UK, the UK GDPR and the Data Protection Act 2018. “GDPR” below means both; article numbers are the same in each.

We have not appointed a data protection officer, because the law does not require one for our processing. info@integritythread.com is the contact for all privacy questions.

For privacy requests, complaints or inquiries, contact:

NOVOTECHY LLC

10861 Sakonnet River Drive, Unit 204

Tampa, Florida 33615

United States

Email: info@integritythread.com

2. Business contacts listed in the directory

Some company records include a contact person’s name, business email address or phone number, as published in the public registries of GOTS, OEKO-TEX®, WRAP or USGBC.

  • Source: the public certification registries. We do not buy contact lists.
  • Purpose: to let buyers reach the right person at a certified supplier for genuine business enquiries.
  • Legal basis: our legitimate interest and that of buyers in supply-chain due diligence and business contact (GDPR Art. 6(1)(f)). We limit the impact on you: contact details are masked on the site, only part of the name and email is shown, and phone numbers are never published.
  • Retention: for as long as the record appears in the registry, and removed at the next sync after it disappears.
  • Your choices: you may object at any time, and we will stop showing your details (Art. 21). You may also ask for access, correction or erasure.
  • We do not use these contact details to send marketing ourselves, and our Terms forbid users from using them for unsolicited bulk messages.

Because these details come from the registries and not from you, this section is our notice to you under Art. 14 GDPR.

3. Visitors

When you visit the site, our hosting provider processes technical data needed to deliver pages and keep the service secure: IP address, browser type, requested pages and time. These server logs are kept for up to 14 days. Legal basis: legitimate interest in operating and securing the site (Art. 6(1)(f)).

Fonts and all other files are served from our own servers. Your browser does not contact Google or any other third party for fonts, analytics or advertising when you use the site.

4. Cookies and data stored in your browser

We use no advertising, analytics or tracking cookies. We only store what is strictly necessary to provide the service you ask for, so under the EU ePrivacy rules and the UK PECR no consent banner is needed. If we ever add optional cookies, we will ask for your consent first.

  • Sign-in cookies (authjs.session-token, authjs.csrf-token, authjs.callback-url; names may start with __Secure- or __Host-): keep you signed in and protect forms against cross-site attacks. Set only when you sign in or use the sign-in form; the session cookie lasts up to 30 days, the others until you close the browser.
  • Local storage it.theme: your light or dark appearance.
  • Local storage it.shortlist.v1, it.notes, it.searches: your watchlist, notes and saved searches while you are not signed in.
  • Local storage it.user, it.plan: sign-in state and plan in the demo mode used when accounts are switched off.

Local storage stays on your device and is not sent to us. You can delete cookies and local storage at any time in your browser settings; you will then be signed out.

5. Account holders

If you create an account we process your name, email address and password, plus the watchlist, notes, saved searches, compare list and alert settings you create. Your password is stored only as a salted scrypt hash, never in readable form. Legal basis: performance of our contract with you (Art. 6(1)(b)).

We keep this data while your account is open. To close your account, write to info@integritythread.com from the email address of the account; we delete the account data within 30 days, and it disappears from our backups when they expire 7 days later. We keep data longer only where the law requires it (for example invoices).

We send you emails that are part of the service you asked for, such as certificate alerts for your watchlist. We will not send you marketing emails unless you have agreed to receive them, and every such email will let you unsubscribe.

Where paid subscriptions are offered, billing and payment information is processed by our payment processor and is not stored by Integrity Thread except for limited subscription, transaction and invoicing records needed for accounting and support purposes.

6. Bulk checks, submissions and claims

  • Bulk check: supplier names you paste or upload are matched against the directory on our server and returned to you. They are not stored on our servers.
  • Facility submissions and profile claims: we process the details you provide, including the claimant’s name and business email, to verify the claim and maintain the listing. Legal basis: legitimate interest in keeping the directory accurate, and contract where you request a claimed profile (Art. 6(1)(b) and (f)).
  • Reviews and messages: see the Review & Messaging Policy. Buyers can stay anonymous to suppliers until they choose to reveal their identity.
  • Review, messaging and moderation records may be retained for as long as reasonably necessary for compliance, fraud prevention, dispute resolution, security and enforcement of our policies, including after account closure.

7. Recipients

We use service providers (processors) for hosting (Hetzner Online GmbH, with servers in Helsinki, Finland), email delivery, and, once paid plans launch, payment processing. They act only on our instructions under a data processing agreement (Art. 28). We do not sell or rent personal data, and we do not share it for advertising. We disclose data to authorities only where the law requires it.

Current subprocessors may include payment processors, transactional email providers, hosting providers and cloud infrastructure providers. A current list may be made available on request.

8. Where your data is stored, and international transfers

Our database, backups and website run on servers in the EU (Hetzner Online GmbH, with servers in Helsinki, Finland). NOVOTECHY LLC is based in the United States. When we, or a service provider, access personal data from the United States or another country without an adequacy decision, we protect it with the European Commission’s Standard Contractual Clauses and, for UK data, the UK International Data Transfer Addendum, together with any supplementary measures needed. You can ask us for a copy of these safeguards.

9. Your rights

Under the GDPR you have the right to:

  • access the personal data we hold about you and get a copy (Art. 15);
  • have inaccurate data corrected (Art. 16) and, in the cases the law allows, erased (Art. 17);
  • restrict processing (Art. 18) and receive data you gave us in a portable format (Art. 20);
  • object at any time to processing based on legitimate interests, including the listing of your business contact details (Art. 21);
  • withdraw consent at any time where processing is based on consent, without affecting earlier processing;
  • not be subject to decisions based solely on automated processing that have legal or similarly significant effects on you (Art. 22). We make no such decisions: the coverage score describes a company’s certifications, not a person.

To exercise a right, write to info@integritythread.com. It is free of charge. We may ask you to confirm your identity, and we reply within one month (extendable by two months for complex requests, in which case we tell you why).

You may also complain to a data protection supervisory authority, in particular the data protection authority of the EU or EEA country, or the UK Information Commissioner’s Office (ico.org.uk), where you live or work. We would appreciate the chance to resolve your concern first.

10. Security

Data is transmitted over HTTPS. The database is not reachable from the internet. The public website reads the directory through a read-only database role, and account data is held in a separate part of the database with its own restricted access. Passwords are stored only as salted hashes. Backups are kept for 7 days.

If a personal data breach is likely to put your rights at risk, we report it to the competent supervisory authority within 72 hours of becoming aware of it and, where the risk is high, tell you without undue delay (Art. 33–34).

11. Children

Integrity Thread is a service for businesses and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.

11A. U.S. State Privacy Rights

Residents of California and certain other U.S. states may have privacy rights under applicable law, including rights to access, correct, delete and obtain information regarding personal information we process, subject to applicable exceptions.

Integrity Thread does not sell personal information and does not share personal information for cross-context behavioral advertising.

12. Changes

We will update this policy when our processing changes, and show the date of the latest version at the top of this page.

13. Data Processing Agreement

Enterprise customers who require a Data Processing Agreement may contact us at info@integritythread.com.