ESGora Privacy Policy

In accordance with Regulation (EU) 2016/679, General Data Protection Regulation or GDPR, and other applicable data protection legislation, users are informed that the controller responsible for the processing of personal data is José Salmerón Corbellini, trade name ESGora, Tax Identification Number (NIF) 75784704A.

Contact email: admin@esgora.eu.

Country of establishment: Spain.

This Privacy Policy describes how ESGora collects, uses, stores, and protects personal data processed through the ESGora platform, a SaaS service intended for the preparation, management, and generation of sustainability reports in accordance with the EFRAG VSME standard.

ESGora may process identification and contact data, including first name and surname(s), email address, tax identification number or equivalent identifiers where applicable, and information relating to the organization or company to which the user belongs.

ESGora may process platform usage data, including information relating to access to and use of the platform, user configuration settings, and technical information necessary for the provision of the service.

ESGora may process data contained in reports, including information entered by users for the preparation of VSME reports and data associated with deliverables, reports, and documents generated through the platform.

ESGora may process billing data necessary for payment processing, subscription management, and compliance with legal and tax obligations.

ESGora is not designed to process special categories of personal data within the meaning of Article 9 GDPR. Users must refrain from entering such information into the platform.

Personal data may be processed to create and manage user accounts, enable access to and use of the platform, manage organizations, reports and deliverables, and generate documentation and reports requested by the user.

Personal data may be processed to manage subscriptions, payments and invoicing, and to maintain the contractual relationship with customers and users.

Personal data may be processed to respond to inquiries, requests and incidents, and to provide technical and functional support.

Personal data may be processed to ensure the security of the platform, detect misuse, unauthorized access or fraudulent activities, and analyze and improve the performance and operation of the service.

Personal data may be processed to comply with applicable legal, regulatory, tax and administrative obligations.

The performance of a contract, under Article 6(1)(b) GDPR, legitimizes processing necessary to provide the contracted services and manage the relationship with users.

Compliance with legal obligations, under Article 6(1)(c) GDPR, legitimizes processing necessary to comply with tax, accounting, regulatory or other legal obligations.

Legitimate interests, under Article 6(1)(f) GDPR, legitimize processing related to platform security, fraud prevention, service improvement, technical support, and protection of the legitimate interests of ESGora and its customers.

For the provision of its services, ESGora may engage specialized service providers acting as data processors.

These may include Supabase for infrastructure and databases, Vercel for frontend hosting and deployment, Render for backend infrastructure, Stripe for payment processing, OpenAI for artificial intelligence services, and Resend for email delivery services.

These providers may access personal data only to the extent necessary to provide the contracted services and under appropriate contractual obligations relating to confidentiality and data protection.

Some service providers used by ESGora may process data outside the European Economic Area.

Where this occurs, ESGora shall implement the safeguards required by the GDPR, including adequacy decisions adopted by the European Commission, Standard Contractual Clauses approved by the European Commission, or other legally valid safeguards.

Personal data shall be retained for as long as necessary to fulfil the purposes for which it was collected.

As a general rule, account data shall be retained for as long as the account remains active.

Reports and deliverables shall be retained for as long as necessary to provide the service or until the user requests their deletion, unless a legal obligation requires otherwise.

Data necessary to comply with tax, accounting, regulatory or legal obligations may be retained for the periods required by applicable legislation.

When the data is no longer necessary, it shall be securely deleted or anonymized.

Users may request the cancellation of their account at any time.

Such cancellation shall not affect processing activities that must be maintained for the purposes of complying with legal obligations, resolving disputes, defending legal claims, or ensuring the security and traceability of the service.

Data subjects may exercise the rights of access, rectification, erasure, objection, restriction of processing, data portability, and the right not to be subject to automated decision-making where applicable.

To exercise these rights, data subjects may contact admin@esgora.eu.

The request must allow the reasonable identification of the requester.

ESGora implements appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, loss, and accidental or unlawful destruction.

The measures adopted are reviewed periodically in accordance with the state of the art and the risks associated with the processing.

ESGora’s services are intended for organizations, businesses and professionals.

They are not intended for minors, and ESGora does not knowingly collect personal data relating to minors.

ESGora may amend this Privacy Policy whenever necessary to adapt it to legal, regulatory, technical or business developments.

The version in force at any given time shall be the version published on the ESGora platform or website.

If you consider that the processing of your personal data infringes applicable data protection legislation, you may lodge a complaint with the competent supervisory authority.

In Spain, the competent authority is the Spanish Data Protection Agency (AEPD).

Without prejudice to the foregoing, users are encouraged to contact ESGora first in order to attempt to resolve any issue relating to data protection.