Skip to content

Legal

Privacy Statement

Last updated: July 2026

1. Data Controller

SustainabilityReports.com is operated from the Netherlands. We are the data controller for any personal information collected through this website. Our registration is with the Dutch Chamber of Commerce.

2. What Data We Collect

We collect information you provide directly: name, email address, and organization when you create an account or contact us. We also collect usage data automatically: IP addresses, browser type, pages visited, and timestamps. Download history is tracked for registered users.

3. Why We Use Your Data

We process personal data under GDPR Article 6(1)(b) for contract performance (providing account services) and Article 6(1)(f) for legitimate interests (improving our platform, preventing abuse, and maintaining security). We do not sell personal data to third parties.

4. Data Retention & Deletion

Account information is retained for the duration of your account. When you delete your account, your profile data (name, email address, username) is erased or anonymized immediately. Records we are legally required to keep, such as invoices and order records under the Dutch 7-year bookkeeping obligation, are retained in anonymized form, no longer linked to an identifiable profile. Server logs are retained for 90 days. Email correspondence is retained for up to 5 years for record-keeping purposes.

5. Data Protection

All data is stored on secured servers. We use HTTPS encryption for all data transmission. Access to personal data is restricted to authorized personnel only. We do not transfer data outside the European Economic Area without appropriate safeguards.

6. Your Rights

Under GDPR, you have the right to: access your personal data, correct inaccurate data, request deletion of your data (right to erasure), restrict processing, data portability, and object to processing.

Deleting your account: you can delete your account and personal data yourself at any time. While signed in, open the account menu (your avatar in the top-right corner), choose Manage account → Security → Delete account. Deletion takes effect immediately; see Data Retention & Deletion above for what happens to your data.

To exercise any of these rights by request instead, contact us at [email protected]. We respond to requests within 30 days.

7. Cookies & Analytics

On your first visit we ask for your consent through a cookie banner. Non-essential cookies are only placed after you opt in. We use the following categories:

  • Necessary (always active): authentication and session management (Clerk), security and bot protection (Cloudflare, including Turnstile), and storing your cookie choices themselves. These do not require consent.
  • Analytics (opt-in): Google Analytics with IP anonymization enabled, used to understand website usage. Only loaded after you consent.
  • Marketing (opt-in): Google Tag Manager for campaign measurement. Only loaded after you consent.
  • Functional (opt-in): enhanced features and personalization such as language or region preferences.

You can change or withdraw your consent at any time via Cookie Settings in the page footer, or remove cookies entirely through your browser settings.

8. Changes to This Policy

We may update this privacy statement periodically. Material changes will be communicated via email to registered users. The latest version is always available on this page.