Privacy Policy
Understand the information used in your ESG workspace, how sharing works, and what to consider before uploading evidence.
Operator details and policy commitments are awaiting confirmation. This draft is provided for review and is not a final privacy notice or service agreement.
Who this notice covers
This draft describes ESG Hero accounts, company workspaces and supplier response workflows. The final notice must identify the service operator and explain its responsibilities alongside those of the company managing your workspace.
Your company decides which records it submits and which people may work with them. Ask your workspace administrator about your company’s own handling of employee, supplier and other personal information.
Information in the service
Account information includes your name, email address, authentication information and an optional profile photo. Workspace records can include company details, reporting periods, supplier contact details, activity data, evidence files, review decisions and audit history.
Uploaded bills, policies, spreadsheets and reports may contain personal information. Remove unnecessary names, identification numbers, payroll details and other sensitive information before uploading. Use aggregate workforce figures where individual records are not needed.
How information supports your work
Information supports sign-in, company membership, document extraction, ESG record keeping, evidence review, supplier requests, controlled sharing and report preparation. Workflow and audit records help users trace changes and approvals.
A final notice must also describe operational logging, communications, analytics and any other processing used by the deployed service, including which information is required and what happens if it is not provided.
Document processing and AI
Depending on the enabled workflow, document content and relevant workspace context may be sent to external document-processing or AI services to extract information, answer questions or prepare drafts. Review suggested values against the source before approving them.
The final notice must name the active providers and explain their purposes, processing locations, retention and training terms. This draft makes no promise that all processing stays in one country or that provider data is never retained or used for training.
Retention and deletion
Private documents and evidence support retention schedules and legal holds. A deletion request may be scheduled for the end of an applicable retention period; a legal hold can prevent deletion. Removing a record from a workflow does not necessarily erase the stored object immediately.
The final policy must specify retention for accounts, evidence, audit history, logs, backups and external providers, including how requests and exceptions are handled.
Questions and personal-data requests
For workspace corrections or access questions, start with your company administrator. For operator-level questions, use the privacy contact on the Contact Us page when it is available. Do not send private evidence or identity documents in an initial message.
Before this policy takes effect, the operator must confirm the applicable request rights, verification process, complaint route, contact details, effective date and any required language versions.