Privacy policy

The controller of personal data described in this policy is Sustainables s.r.o., Company ID No. 09163328, with its registered office at Svatošových 1013/3, Vysočany, 190 00 Prague 9, registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, File No. 331933 ("we", "us"). We operate the ESG Point platform and this website.

You can contact us about personal data at info@esgpoint.io.

This policy covers the public ESG Point website and communication with us as a prospective client or contact. It does not cover personal data that our clients enter into the ESG Point platform. We process such data on behalf of the client, who acts as the controller, in accordance with the agreement and the data processing agreement (DPA) concluded with that client.

Demo and contact requests. When you submit the "Book a demo" form, we process your first and last name, work e-mail address, company, company size, main interest and any message you add. We use these data to respond to your request, arrange a call or demo and keep in touch about it. The legal basis is your consent given by ticking the checkbox in the form (Art. 6(1)(a) GDPR), and our legitimate interest in handling business enquiries (Art. 6(1)(f) GDPR).

E-mail and phone communication. If you write or call us directly, we process your contact details and the content of the communication to answer you and to keep a record of the correspondence. The legal basis is our legitimate interest in communicating with business contacts and, where the contact leads to a contract, steps taken at your request prior to entering into it (Art. 6(1)(b) GDPR).

Technical data. Our hosting infrastructure automatically records technical data such as the IP address, date and time of the request, requested page and browser type. We use them to operate the website, keep it secure and investigate incidents. The legal basis is our legitimate interest in the security and operation of the website (Art. 6(1)(f) GDPR).

Analytics and advertising. At the date of this policy, the website does not use analytics or advertising tools and does not profile visitors. We do not make decisions about you based solely on automated processing.

Providing the data in the form is voluntary, but without the required fields we cannot respond to your request.

Your data are accessible to our employees and collaborators who need them for the purposes above.

We use carefully selected service providers who process data on our behalf under written agreements, in particular providers of cloud infrastructure and hosting (Microsoft Azure, with the platform and website hosted in the EU), e-mail and communication tools, and IT support. We may also share data with professional advisers and with public authorities where the law requires it.

We do not sell personal data. Our website is hosted in the EU. If any of our providers transfers personal data outside the European Economic Area, we make sure that appropriate safeguards are in place, such as a European Commission adequacy decision or standard contractual clauses.

Data from demo and contact requests are kept for as long as needed to handle your request and the related business communication. After that we delete or anonymise them, unless we have to keep them longer to comply with a legal obligation or to establish, exercise or defend legal claims. If processing is based on your consent, we keep the data until you withdraw it.

Technical logs are kept for a limited period necessary for security and operation of the website.

If an enquiry leads to a contract, the data we need for that contract are then governed by the contract and by the retention periods required by law, for example for accounting.

Under the GDPR you have the right to access your personal data, to have inaccurate data corrected, to have data erased, to restrict processing, to data portability and to object to processing based on legitimate interest.

Where processing is based on consent, you may withdraw your consent at any time by writing to info@esgpoint.io. Withdrawal does not affect the lawfulness of processing carried out before it.

To exercise your rights, contact us at info@esgpoint.io. We will respond without undue delay and in any case within one month.

You also have the right to lodge a complaint with the supervisory authority, which in the Czech Republic is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.gov.cz.

We protect personal data with technical and organisational measures appropriate to the risk, including encryption, access control and EU-based hosting. More information is available on our Security page.

Information about cookies and similar technologies is in our Cookie policy.

We may update this policy, for example when we change the website, introduce new tools or when the law changes. The current version is always published on this page together with the date of the last update.