Privacy Notice

ESG Sentinel is operated by [OWNER: registered legal name of the company], [OWNER: registered office address] (“we”, “us”). For the personal data described here we decide why and how it is processed, which makes us the Data Fiduciary under India’s Digital Personal Data Protection Act, 2023 (DPDP Act).

It covers personal data we collect through esgsentinel.com, including:

• the contact and demo request forms, and future resource, event and webinar forms;
• emails we send in reply to your enquiry, and marketing emails if you opt in;
• basic information about visits to the website.

It does not cover the ESG Sentinel software platform used by our customers, which has its own terms and data processing agreements.

• Details you give us: first and last name, work email, phone number, company, job title (optional), your areas of interest and your message.
• Your choices: whether you agreed to marketing emails, which version of this notice you saw, and when — so we can show we respected your choice.
• How you found us: the campaign tags in the link you followed (for example “utm_source=linkedin”), the first page you visited and the website that referred you. These describe campaigns, not you personally.
• Technical data: the pages you visit, device type and browser, and your IP address. We never store your IP address in readable form: it is kept as a one-way fingerprint (used to stop duplicate counting and abuse) and in encrypted form that only our administrators can view for security purposes.
• Bot-protection data: a small puzzle your browser solves automatically to show it is not an automated bot. It does not use cookies or track you, and no third party is involved.

We do not ask for or want sensitive information. Please do not include financial, health or other sensitive details in your message.

• To respond to your enquiry — reply to you, arrange a demo, send a resource you asked for, and keep a record of our conversation. You give consent for this when you submit the form; it covers this purpose only.
• To send marketing emails — only if you separately ticked the marketing box (see section 5).
• To keep the website safe — detect bots, prevent spam and abuse, and limit repeated submissions.
• To understand what works — count visits and enquiries per page and campaign, in aggregate, so we can improve our content.
• To meet legal obligations — for example keeping records that the law requires, or responding to lawful requests from authorities.

We do not make decisions about you that have legal or similarly significant effects based solely on automated processing.

The marketing checkbox on our forms is unticked by default. We send occasional emails about ESG reporting insights, events and product updates only if you tick it. Leaving it unticked never affects our reply to your enquiry.

You can withdraw at any time, as easily as you gave consent: use the unsubscribe link in any marketing email, or write to [OWNER: privacy contact email, e.g. privacy@esgsentinel.com]. We stop marketing to you immediately for new emails and keep a record of your withdrawal so you are not added again by mistake.

We never sell or rent personal data. We share it only with:

• Service providers who process it for us under contract and our instructions — for example our email delivery provider (Zoho ZeptoMail), our hosting and database infrastructure, and, when introduced, our marketing-email platform and meeting-booking tool. They may not use your data for their own purposes.
• Authorities, when the law requires it.
• A successor business, if ESG Sentinel is reorganised or sold, under the same protections.

Your data is stored on servers located in [OWNER: where the servers are located, e.g. India]. Some service providers may process data outside India; where they do, we use providers that protect it to a standard consistent with this notice and we follow any restrictions the Government of India notifies under the DPDP Act.

• Enquiries and contact details: for as long as needed to deal with your enquiry and any resulting business relationship, then no longer than 24 months after our last interaction, unless you ask us to delete them sooner.
• Consent records: for as long as we rely on the consent and for the period afterwards in which we may need to show it was given or withdrawn.
• Visit data: up to 12 months, then deleted or reduced to aggregate counts.
• Marketing list: until you unsubscribe; we keep only a minimal suppression record so we never email you again.

Where the law requires us to keep something longer, we keep it only for that legal purpose.

Under the DPDP Act you can:

• Access a summary of the personal data we hold about you and how we process it, and the identities of those we have shared it with;
• Correct, complete or update data that is inaccurate or incomplete;
• Erase data we no longer need, or that you withdraw consent for (unless the law requires us to keep it);
• Withdraw consent at any time, as easily as you gave it — this does not affect processing that happened before;
• Have your grievance addressed by us first, and then complain to the Data Protection Board of India if you are not satisfied;
• Nominate another person to exercise these rights for you in the event of your death or incapacity.

To use any of these rights, email [OWNER: privacy contact email, e.g. privacy@esgsentinel.com] from the address you used with us (or tell us how to verify you). We respond within [OWNER: response time, e.g. 30 days]. There is no charge.

• Data is encrypted in transit (HTTPS) and access is restricted to authorised staff, by role.
• Staff sign-in to our admin console requires two-factor authentication, and every access-related change is recorded in an audit log that cannot be edited.
• IP addresses are stored only as fingerprints and in encrypted form; logs are designed not to contain names, email addresses or other personal details.
• If a personal data breach occurs, we will inform the Data Protection Board of India and affected people as the law requires.

We do not use advertising or cross-site tracking cookies. Our bot protection uses no cookies. We may use privacy-friendly analytics that count visits without identifying you; if that ever changes we will update this notice and ask for consent where required. Our admin console uses strictly necessary sign-in cookies for staff only.

Our website and services are intended for businesses and professionals. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.

We will update this notice when our practices change. The version and effective date are shown at the top; each consent we record notes the version you saw. If a change materially affects how we use data you have already given us, we will tell you and ask for consent again where required.

Questions or requests: [OWNER: privacy contact email, e.g. privacy@esgsentinel.com].

Grievance Officer: [OWNER: Grievance Officer name and designation], [OWNER: Grievance Officer email], [OWNER: registered office address].

You can also reach us through the contact page.