Data Use Policy
Full transparency on how Ventrace handles your organisation's data — from raw emissions records to AI-processed compliance insights.
Core principles: You own your data. We process it only on your instruction. We never sell it, never use it to train AI models without explicit consent, and never share it with other tenants. Your ESG data stays within your dedicated workspace.
1. Overview
Ventrace operates as a multi-tenant ESG compliance platform. Depending on the type of data involved, Ventrace acts in one of two legal roles under data protection law:
- Data Controller: For data we collect directly from you to operate your account — account registration, billing contacts, usage analytics, support communications.
- Data Processor: For data your organisation submits to the platform as part of your ESG workflow — emissions records, facility data, supply chain information, compliance documents, and ESG reports. You remain the controller of this data; we process it on your instructions.
This policy provides detail on both roles. Our Privacy Policy governs controller data in full. Our Terms of Service and Data Processing Agreement (DPA) govern processor data.
2. Data We Control (Account & Operational Data)
As controller, we collect and use the following categories of data for stated purposes:
| Data Category | Examples | Purpose | Legal Basis |
|---|---|---|---|
| Identity & Account Data | Name, work email, job title, company name | Account creation, authentication, access control | Contract (Art. 6(1)(b)) |
| Billing Data | Billing contact email, company address, invoice history | Invoice generation, payment reconciliation, tax compliance | Contract + Legal Obligation (Art. 6(1)(b)(c)) |
| Usage & Technical Data | IP address, page views, feature interactions, error logs, session duration | Platform reliability, security monitoring, product improvement | Legitimate Interests (Art. 6(1)(f)) |
| Support Communications | Email threads, chat transcripts, bug reports | Customer support, issue resolution, quality assurance | Contract (Art. 6(1)(b)) |
| Marketing Data | Email preferences, campaign interactions | Sending product updates and ESG regulatory bulletins (existing customers) | Legitimate Interests / Consent (Art. 6(1)(f)(a)) |
3. Data We Process on Your Behalf (ESG & Operational Data)
As processor, we handle the data your organisation uploads, generates, or derives through the Ventrace platform. You control this data; we act on your instructions.
3.1 Categories of ESG Data Processed
| Data Type | Examples | Platform Module |
|---|---|---|
| Emissions Data | Scope 1/2/3 CO₂e records, activity data, energy consumption, emission factors | Emissions Tracker, Carbon Analytics |
| Facility Data | Site names, addresses, floor area, energy meters, asset inventory | Facilities Management |
| Supply Chain Data | Supplier names, countries, tier classification, ESG scores, risk flags | Supplier Network, Supply Chain Intelligence |
| Compliance Data | Framework mappings (GRI, TCFD, CSRD, ISO 14001), gap analysis results, evidence files | Compliance Hub, Governance |
| Documents & Evidence | PDFs, spreadsheets, certificates, audit reports, policy documents | Evidence Vault, Knowledge Base |
| Workflow & Task Data | Approval chains, assignees, deadlines, completion records, comments | Workflow Automation |
| Supplier Questionnaire Data | Supplier ESG self-assessments, supporting evidence, verification status | Supplier Questionnaires |
3.2 Permitted Processing Activities
We process ESG data only for the following purposes, strictly as instructed by your organisation:
- Storage and retrieval within your tenant workspace
- Calculation and aggregation of emissions metrics and ESG scores
- Generating compliance gap analyses against selected reporting frameworks
- Producing AI-assisted insights, summaries, and recommendations (see Section 4)
- Facilitating supplier questionnaire distribution and response collection
- Generating exportable reports in your chosen formats
- Enabling role-based access for your authorised users
- Maintaining audit logs of all data modifications within your workspace
4. AI & Automated Processing
4.1 How We Use AI
Ventrace uses large language models (LLMs) to power several features including the AI Compliance Assistant, gap analysis automation, emissions anomaly detection, and document extraction from uploaded evidence files. When you use these features, relevant data from your workspace is sent to the AI model for processing.
4.2 Zero Training Guarantee
Your ESG data is never used to train, fine-tune, or evaluate AI models — whether operated by Ventrace or our AI subprocessors. We have contractual zero-retention and no-training commitments with all AI providers we work with. This means:
- Data sent to AI APIs is processed in real time and not stored by the AI provider
- No customer data contributes to improving the underlying model weights
- AI conversation history is stored only in your Ventrace workspace, under your control
4.3 AI Subprocessors
We use the following AI providers under strict data processing agreements. All use zero-retention API configurations:
- Anthropic, PBC — Claude models for compliance analysis and document understanding
- OpenAI, LLC — GPT models for supplementary AI features
For the full subprocessor list, see ventracehq.com/subprocessors.
4.4 Human Oversight
All AI outputs — including gap analysis results, compliance recommendations, and emissions anomaly flags — are presented for review by your authorised users. AI-generated outputs do not trigger any automated actions without human confirmation. Ventrace does not make automated decisions with legal or significant effects on individuals.
5. Data Flows & International Transfers
Ventrace processes data primarily within the European Economic Area (EEA) and United Kingdom. Some data flows to US-based subprocessors (cloud infrastructure, AI APIs). All such transfers use:
- Standard Contractual Clauses (SCCs) — approved by the European Commission (2021/914/EU)
- UK International Data Transfer Agreements (IDTAs) — for UK-origin data
- Adequacy decisions — where applicable (e.g. transfers to countries with an EU adequacy decision)
Copies of relevant transfer mechanisms are available on request at privacy@ventracehq.com.
Where your organisation requires specific data residency (e.g. EU-only storage), please discuss regional deployment options with our sales team at sales@ventracehq.com.
6. Security Measures
Ventrace implements technical and organisational security measures proportionate to the sensitivity of ESG and personal data processed:
| Control | Detail |
|---|---|
| Encryption in transit | TLS 1.2+ for all data in motion; HSTS enforced |
| Encryption at rest | AES-256 for database storage; S3 server-side encryption for file uploads |
| Tenant isolation | Mandatory tenant scoping enforced at both application layer (every query filters by tenant_id) and database layer (PostgreSQL Row Level Security policies) — no cross-tenant data access is possible |
| Access control | Role-based permissions (Admin, Manager, Analyst, Auditor, Viewer); MFA (TOTP) mandatory for Admin and Owner roles |
| Audit logging | Immutable audit trail for all data read, write, delete, and export events; 24-month retention |
| Penetration testing | Annual third-party pen tests; continuous automated vulnerability scanning |
| Incident response | Documented incident response plan; 72-hour supervisory authority notification for qualifying breaches |
| Subprocessor DPAs | Data processing agreements with all subprocessors; annual review |
7. Retention & Deletion
| Data Type | Retention Period | Deletion Mechanism |
|---|---|---|
| ESG & emissions data | Duration of subscription | Self-service export; purged within 90 days of contract end |
| Uploaded documents | Duration of subscription | Deleted from storage within 90 days of contract end |
| Audit logs | 24 months | Automatic rolling deletion |
| Account data | Account lifetime + 30 days post-termination | Platform self-service or on request |
| Billing records | 7 years (UK financial regulation) | Cannot be deleted early; anonymised after contractual need ends |
| AI conversation history | Until deleted by user or account termination | Self-service deletion per conversation; bulk deletion on request |
| Security logs | 24 months | Automatic rolling deletion |
On contract termination, you have a 30-day data export window during which all your data remains accessible for export. After that window closes, data is securely and irreversibly deleted within 90 days.
8. Tenant Isolation Architecture
Ventrace is a multi-tenant SaaS. Each customer organisation ("tenant") has a fully isolated data workspace. We implement isolation at multiple layers:
- Database: Every row in every table is stamped with a
tenant_id. PostgreSQL Row Level Security (RLS) policies enforce that queries can only return rows matching the authenticated tenant's ID — even if an application bug attempts a cross-tenant query. - API: Every API endpoint validates the tenant JWT token and rejects requests where the token's tenant claim does not match the requested resource's owner.
- File Storage: Uploaded documents are stored in tenant-namespaced paths with access controlled by signed URLs scoped to the tenant.
- AI Context: When data is sent to AI APIs for processing, only data from the requesting tenant's workspace is included in the context. There is no cross-tenant data leakage by design.
- Search Index: Vector embeddings in the knowledge base are indexed per tenant. Semantic search only retrieves documents belonging to the querying tenant.
No employee of Ventrace can access your tenant's data without explicit authorisation from your organisation's administrator, except where strictly required for incident response or legal obligation, in which case access is logged and you are notified.
9. Your Controls as Data Controller
As the controller of your organisation's ESG data, you have full control over it through the Ventrace platform:
- Export at any time: Export all your data in JSON or CSV format from account settings. No artificial restrictions or export fees.
- Delete at any time: Delete individual records, datasets, or your entire workspace from account settings.
- Access control: Manage which users can see, edit, or export data using role-based permissions and audit logs.
- Data processing instructions: Configure which AI features are enabled and which data categories they can access.
- DPA customisation: Enterprise customers can request custom Data Processing Agreement terms. Contact legal@ventracehq.com.
- Data residency: Enterprise and regulated customers can request dedicated regional infrastructure (EU-only, UK-only). Discuss with sales@ventracehq.com.
10. Contact
For questions about how we use your data, to discuss DPA terms, or to report a data security concern:
- Privacy enquiries: privacy@ventracehq.com
- Legal / DPA: legal@ventracehq.com
- Security incidents: security@ventracehq.com
- Sales / enterprise: sales@ventracehq.com
Related policies: Privacy Policy · Terms of Service · Cookie Policy · Subprocessors · GDPR Rights Centre