Privacy notice

1. Who we are

ESG Made Simple Ltd is a company registered in England and Wales (company number [company number]) with its registered office at Unit 16 Spire Green, Harlow, CM19 5TR.

We are the controller of personal data we use to run our website, manage accounts, provide support, bill customers and market our services.

When an organisation uses the platform to record its ESG information (for example activity data, evidence files and staff training records), that organisation is the controller and we act as its processor under the data processing terms in our Terms of Use. If your employer added you to the platform, please contact them about how they use your data.

Contact: privacy@esgmadesimple.com or by post to Unit 16 Spire Green, Harlow, CM19 5TR. ICO registration number: [ICO registration number].

2. The personal data we collect

• Account data: your name, work email address, password (stored only as a secure one-way hash), and if you sign in with Google, your Google account identifier, name and email address.
• Organisation and role data: the organisations you belong to, your role and permissions, whether you are an ESG Champion, and invitations you send or receive.
• Platform content: ESG activity data, evidence files, reports, goals, comments, approvals and the audit log of actions you take. This may include names of colleagues, suppliers or customers if you enter them.
• Learning data: your answers to the optional welcome questions (experience, role and goal), training progress, quiz scores, certificates and nudges sent or received.
• Billing data: billing contact, plan, invoices and payment status. Card details are collected and stored by Stripe; we never see or store full card numbers.
• Integration data: if your organisation connects Xero, the travel and expense transactions you choose to import, and encrypted access tokens.
• Communications: messages you send through our contact form or by email, and records of service emails we send you.
• Usage and device data: pages viewed, referring website or campaign, device type, browser, approximate country, and security logs (including IP addresses used for sign-in protection).

3. How we use personal data and our lawful bases

• To create and run your account and provide the platform – performance of a contract with you or your organisation (Article 6(1)(b)).
• To process ESG data on behalf of customer organisations – on their instructions as processor; the customer determines its own lawful basis.
• To take payments, issue invoices and keep financial records – contract and legal obligation (Article 6(1)(b) and (c)).
• To send service emails such as invitations, password resets, approval alerts, monthly summaries, trial reminders, training nudges and ESG Champion updates – contract and our legitimate interest in running a useful service (Article 6(1)(f)).
• To keep the platform secure, prevent fraud and abuse, and maintain audit trails – legitimate interests and legal obligations.
• To understand how the website and platform are used and improve them, using our own cookie-free analytics – legitimate interests.
• To send marketing about our services to business contacts – legitimate interests, or consent where PECR requires it. You can opt out at any time.
• To comply with law, respond to lawful requests and defend legal claims – legal obligation and legitimate interests.

We do not sell personal data and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

Where we rely on legitimate interests, we have balanced our interests against your rights. You can ask us for details of that assessment.

4. AI features

Some optional features use artificial intelligence (for example creating sign-in page illustrations in our admin area). We do not use customer ESG data or personal data to train AI models.

5. Who we share data with

We share personal data only with service providers who process it for us under written contracts, and only as needed:

• Hosting, database and file storage providers that run the platform [hosting provider and data location].
• Stripe Payments UK Ltd and its group – subscription billing and card payments.
• Resend – delivery of service emails.
• Google – only if you choose Google sign-in.
• Xero – only if your organisation connects it.
• Professional advisers (lawyers, accountants, auditors) and, where required, regulators, law enforcement or courts.
• A buyer or investor, if we sell or restructure our business, under confidentiality obligations.

Inside the platform, data you enter is visible to authorised users of your organisation in line with their roles. Information shared with suppliers or customers through platform features is shared only when your organisation chooses to share it.

The current list of services that process customer data, with their locations and transfer safeguards, is published at esgmadesimple.com/subprocessors. Organisation owners are emailed at least 30 days before a new one is added.

6. International transfers

Some providers may process data outside the UK. When this happens we make sure the transfer is protected, for example by a UK adequacy regulation (including the UK–US Data Bridge for certified US organisations) or the ICO's International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses.

7. How long we keep data

• Account data: for as long as your account is active, then deleted or anonymised within 90 days of closure, unless we need it for one of the purposes below.
• Customer ESG data and evidence: for the length of the subscription. After it ends, we delete or return it within 90 days unless the law requires us to keep it.
• Billing and tax records: 6 years after the end of the financial year they relate to, as required by UK tax law.
• Audit logs: for the life of the organisation's account, because they form part of its record of changes.
• Website analytics: 400 days, then automatically deleted.
• Security logs and backups: up to [backup retention period].

8. Your rights

Under UK GDPR you have the right to:

• be informed about how we use your data (this notice)
• access a copy of your personal data
• have inaccurate data corrected
• have data erased in certain circumstances
• restrict how we use your data in certain circumstances
• data portability for data you gave us, where processing is based on consent or contract and carried out by automated means
• object to processing based on legitimate interests, and to direct marketing at any time
• withdraw consent at any time, where we rely on consent

To use these rights, email privacy@esgmadesimple.com. We will reply within one month (this can be extended by two further months for complex requests, in which case we will tell you why). We may need to confirm your identity first. There is normally no charge.

If the data was entered by your employer or another organisation on the platform, we may pass your request to them, as they control that data.

9. Cookies and similar technologies

We only use cookies and browser storage that are strictly necessary to provide the service you request, so under PECR they do not need your consent:

• access_token and refresh_token – keep you securely signed in (HTTP-only, secure cookies; expire when you sign out or after a set period).
• g_state – protects Google sign-in from forgery (expires after 10 minutes).
• Browser local storage – remembers your selected organisation and choices such as dismissed messages and guidance settings.

Our website analytics do not use cookies or store IP addresses. Visits are counted with a daily anonymous code that resets every day and cannot identify you. Browsers sending a Do Not Track signal are not counted. When you are signed in, page views inside the platform are linked to your account so we can see which features are used.

If we introduce any non-essential cookies in future, we will ask for your consent first.

10. Security

We protect data with encryption in transit (HTTPS), hashed passwords, encrypted integration tokens, role-based access controls, separation between customer organisations, audit logging and rate limiting. No system is completely secure, so please keep your password safe and tell us immediately if you suspect unauthorised access.

If a personal data breach is likely to put your rights at risk, we will notify the ICO within 72 hours and tell affected people without undue delay where required.

11. Children

The platform is a business service and is not intended for anyone under 18. We do not knowingly collect children's data.

12. Complaints

If you have a concern, please contact us first at privacy@esgmadesimple.com. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, telephone 0303 123 1113.

13. Changes to this notice

We may update this notice from time to time. We will show the new date at the top and, for significant changes, tell account holders by email or in the platform.