Legal
Sub-processors
The third-party services ESG Made Simple Ltd uses to process customer data. We give all organisation owners at least 30 days' email notice before adding a new one.
Last updated: 07 Nov 2026
| Service | Purpose | Data involved | Location | Safeguard |
|---|---|---|---|---|
| Emergent | Application hosting, database, file storage and AI image generation | All platform data | [Location to confirm] | [Safeguard to confirm] |
| Optional Google sign-in | Name, email address and Google account ID | USA | UK–US Data Bridge | |
| Resend | Delivery of service emails | Names, email addresses and email content | USA | UK–US Data Bridge / IDTA |
| Stripe | Subscription billing and card payments | Billing contacts, payment and invoice details | UK, EU and USA | UK–US Data Bridge / IDTA |
| Xero | Optional import of travel expenses, if a customer connects it | Expense transactions and access tokens | Global | UK adequacy / IDTA |
Questions or objections: privacy@esgmadesimple.com. See also our Privacy notice and data processing terms.