Data Processing Agreement

This DPA governs the processing of personal data carried out by ESGora on behalf of the Customer in connection with the services provided through the ESGora platform.

The Customer determines the purposes and means of the processing of the data incorporated into the platform and acts as the Controller.

ESGora processes such data solely for the purpose of providing the contracted services and acts as a Processor pursuant to Article 28 of Regulation (EU) 2016/679, GDPR.

This Data Processing Agreement forms an integral part of the ESGora Terms and Conditions.

Terms used in this DPA shall have the meaning assigned to them under the GDPR.

Personal Data means any information relating to an identified or identifiable natural person.

Processing means any operation or set of operations performed on Personal Data.

Personal Data Breach means any security incident leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data.

This DPA shall remain in force for as long as ESGora processes Personal Data on behalf of the Customer.

Termination of the main agreement shall automatically terminate this DPA, without prejudice to any legally required retention obligations.

ESGora provides SaaS services related to the management, preparation, analysis and generation of sustainability and corporate reporting information.

ESGora shall process Personal Data solely for the purpose of providing access to the platform, managing users and authentication, storing information associated with organizations and reports, generating reports and deliverables, providing technical support, maintaining the security, availability and operation of the service, performing analytics, benchmarking and artificial intelligence functionalities requested by the Customer, and complying with applicable legal obligations.

ESGora shall not sell Personal Data or use it for its own commercial purposes in a manner incompatible with the provision of the service.

Categories of Data Subjects may include employees and authorized users of the Customer, representatives and business contacts of the Customer, and other individuals whose data may be incorporated into the platform by the Customer.

Categories of Personal Data may include identification data such as first and last name, email address, professional position or job title, and user identifiers; and corporate data such as company or organization information, ESG reporting information, data contained in VSME reports, documentation and deliverables generated by the Customer.

Personal Data shall be processed for the duration of the contractual relationship and for any additional period necessary to comply with applicable legal or contractual obligations.

ESGora is not designed for the systematic processing of special categories of personal data under Article 9 GDPR. The Customer undertakes not to intentionally upload special categories of personal data unless it has a valid legal basis and has informed ESGora in advance.

ESGora shall process Personal Data only in accordance with the documented instructions of the Customer, through the contracted functionalities, and as necessary to comply with applicable legal obligations.

If ESGora considers that an instruction infringes the GDPR or any other applicable data protection law, it shall inform the Customer without undue delay.

ESGora shall not be required to comply with instructions that it reasonably considers manifestly unlawful or contrary to applicable law.

ESGora shall ensure that all persons authorized to process Personal Data are subject to confidentiality obligations, have access only where necessary for the provision of the service, and receive appropriate instructions or training regarding security and data protection.

Confidentiality obligations shall survive the termination of the contractual relationship.

ESGora shall implement appropriate technical and organizational measures taking into account the state of the art, implementation costs, the nature of the data, and the risks to the rights and freedoms of natural persons.

Such measures include, among others, TLS encryption for communications, user authentication, role-based access controls, logical segregation between organizations, reasonable backup procedures, infrastructure monitoring, security-related activity logging, vulnerability management and security updates, and protection of the cloud infrastructure used by ESGora.

ESGora may update these measures where necessary to maintain an appropriate level of security.

The Customer expressly authorizes ESGora to engage sub-processors necessary for the provision of the service.

Current sub-processors include Supabase for database, storage and authentication; Stripe for billing and payment processing; OpenAI for artificial intelligence functionalities; Vercel for frontend infrastructure; Render for backend infrastructure; and Resend for transactional email services.

ESGora may engage additional sub-processors where reasonably necessary for the provision of the service.

ESGora shall impose on such sub-processors data protection obligations substantially equivalent to those set out in this DPA.

An updated list of sub-processors may be published within ESGora's legal documentation.

If the Customer has reasonable data protection-related objections regarding a new sub-processor, it may notify ESGora within a reasonable period following publication of the update. The parties shall act in good faith to evaluate reasonable alternatives where feasible.

Where a provider processes Personal Data outside the European Economic Area, ESGora shall ensure that a valid legal transfer mechanism is in place.

Such mechanisms may include adequacy decisions issued by the European Commission, Standard Contractual Clauses, SCCs, or any other transfer mechanism permitted under the GDPR.

Taking into account the nature of the processing and the information available to ESGora, ESGora shall provide reasonable assistance to the Customer in responding to data subject rights requests, complying with security-related obligations, conducting data protection impact assessments where required, and cooperating with supervisory authorities where necessary.

If ESGora directly receives a request from a data subject relating to Personal Data processed on behalf of the Customer, it shall forward the request to the Customer without undue delay and shall not respond directly unless legally required to do so.

The Customer shall remain responsible for handling such requests.

ESGora shall notify the Customer of any Personal Data Breach affecting Personal Data processed on behalf of the Customer without undue delay after becoming aware of it.

Where possible, the notification shall include a description of the incident, categories of affected data, potential consequences, measures taken or proposed, and reasonably available information to assist the Customer in complying with the GDPR.

ESGora shall make available to the Customer reasonable information necessary to demonstrate compliance with this DPA.

Audits may be conducted where reasonably necessary to verify compliance with the obligations set out in this DPA, provided that there is a reasonable data protection-related justification, reasonable prior notice is provided, the audit does not compromise the security, confidentiality or continuity of the service, confidential information relating to other customers is protected, and extraordinary costs arising from the audit are borne by the Customer.

Upon termination of the service, data shall remain available for a maximum operational period of ninety (90) days to facilitate retrieval.

After such period, the data shall be deleted or anonymized unless retention is required by law.

Data necessary to comply with tax, accounting, regulatory or legal defense obligations may be retained for the legally required retention periods.

Each party shall remain responsible for its own obligations under applicable data protection laws.

Nothing in this DPA shall expand ESGora's liability beyond the limitations set out in the ESGora Terms and Conditions, except where otherwise required by applicable law.

This DPA shall be governed by Regulation (EU) 2016/679, GDPR, Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights, and any other applicable European Union or Spanish legislation.

In the event of any conflict between this DPA and the ESGora Terms and Conditions concerning the processing of Personal Data, this DPA shall prevail with respect to such matters.

To the extent that any provision of this DPA conflicts with a mandatory obligation under the GDPR or any other applicable data protection law, such legal obligation shall prevail and the relevant provision shall be interpreted to the extent necessary to ensure compliance with applicable law.