Privacy Policy & Credential Data Protection

1. Data Controller Information

The Edinburgh International Accreditation Council (EIAC) operates as the official data controller responsible for personal information processed through the official registry portal (edinac.org) and associated institutional verification APIs.

2. Categories of Information Processed

We process data under two distinct operational mandates:

• Academic Credential Verification: Student name, awarded degree title, conferral year, academic honors, issuing accredited institution, and cryptographic hash verification logs. This information is processed exclusively under legitimate public interest and statutory verification mandates requested by employers, embassies, and academic institutions.
• Institutional Review & Accreditation Dossiers: University leadership records, legal charters, faculty credentials, curriculum documentation, and administrative contact information submitted during institutional accreditation audits.
• Technical & Verification Audit Logs: Timestamped query codes, IP hashes (anonymized), and TLS security records generated during QR code verification scans to detect and prevent forged academic credentials.

3. Legal Basis for Processing (UK GDPR Art. 6)

EIAC processes your data strictly under the following lawful bases:

• Public Interest & Accreditation Charter: Maintenance of an immutable, fraud-resistant public registry of authentic higher education credentials.
• Contractual Performance: Providing institutional accreditation audits, inspection reporting, and accredited directory listings under signed institutional charters.
• Legal Obligation: Co-operation with UK and international judicial authorities, consulates, and ministry verification inquiries.

4. Cryptographic Registry & Data Retention

To uphold lifelong academic credential validity, issued certificate hashes and verification records are permanently archived in accordance with international higher education registrar standards. If an institution’s accreditation status changes or a qualification is legitimately revoked, the public registry record is updated transparently with official gazette reference notes.

5. Your Statutory Rights

Under the Data Protection Act 2018 and UK GDPR, individuals possess the right to:

6. Inquiries & Data Officer Contact

For privacy inquiries, registry verifications, or data subject requests, please contact our Data Governance Officer at: