GDPR Rights Centre

1. Overview

The General Data Protection Regulation (GDPR) and the UK GDPR grant individuals a set of rights over their personal data. If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, these rights apply to you in relation to personal data that Ventrace processes as a data controller — primarily account data, contact data, and usage data.

Note: If your personal data was submitted to the Ventrace platform by your employer or another organisation as part of their ESG compliance workflows, Ventrace acts as a data processor for that data. In that case, you should direct your rights request to the organisation that controls your data. See Section 8 for more detail.

2. Your Rights

2.1 Right of Access (Article 15)

You have the right to request a copy of the personal data we hold about you, along with information about how we use it — including the categories of data, the purposes of processing, the retention period, and any third parties we share it with.

2.2 Right to Rectification (Article 16)

If the personal data we hold about you is inaccurate or incomplete, you have the right to ask us to correct it. We may ask you to provide evidence supporting the correction.

2.3 Right to Erasure — "Right to be Forgotten" (Article 17)

You may request deletion of your personal data where:

• The data is no longer necessary for the purpose for which it was collected
• You withdraw consent on which the processing was based, and no other legal basis applies
• You object to the processing and there are no overriding legitimate grounds
• The data has been unlawfully processed
• Deletion is required to comply with a legal obligation

Erasure does not apply where we are required to retain data for legal obligations (e.g. billing records kept for 7 years) or where processing is necessary for the establishment, exercise, or defence of legal claims.

2.4 Right to Restriction of Processing (Article 18)

You may ask us to suspend processing of your data — while still retaining it — in certain circumstances, such as while you contest the accuracy of data or where processing is unlawful but you do not want erasure.

2.5 Right to Data Portability (Article 20)

Where we process your data by automated means based on your consent or a contract, you have the right to receive it in a structured, commonly used, machine-readable format (JSON or CSV). You may also ask us to transmit it directly to another controller where technically feasible.

2.6 Right to Object (Article 21)

You have the right to object to processing based on our legitimate interests or for direct marketing purposes. Where you object to direct marketing, we will stop immediately. For other legitimate-interest processing, we will stop unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

2.7 Rights Related to Automated Decision-Making (Article 22)

You have the right not to be subject to a decision based solely on automated processing — including profiling — that produces legal or similarly significant effects concerning you. Ventrace does not use fully automated decision-making for consequential decisions about individuals. Our AI features provide analysis and recommendations that are always reviewed by a human user before action is taken.

2.8 Right to Withdraw Consent

Where we rely on your consent as the legal basis for processing (e.g. optional analytics cookies, marketing emails), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

3. How to Submit a Request

You can exercise any of the above rights by contacting us through one of the following channels:

• Email: privacy@ventracehq.com — use the subject line that matches your request type
• In-app: Navigate to Account Settings → Privacy → Data Requests, and submit a request form directly from your account
• Post: Ventrace Inc., Privacy Team, [Registered Address]

Please include the following in your request:

• Your full name and the email address associated with your Ventrace account
• The specific right you wish to exercise
• Any relevant details to help us locate the data (e.g. date range, specific feature)

Requests are free of charge. If requests are manifestly unfounded, excessive, or repetitive, we may charge a reasonable administrative fee or refuse to act.

4. Response Timelines

If we cannot fulfil your request (e.g. due to a legal exemption), we will tell you why and inform you of your right to complain to a supervisory authority.

5. Identity Verification

To protect your data, we verify your identity before processing requests. For account holders, this typically means confirming the email address on your account and, for higher-risk requests (erasure, portability), providing an additional piece of verification such as a government-issued ID.

We will not use verification data for any purpose other than verifying your identity, and we delete it promptly once the request is resolved.

If you are submitting a request on behalf of another individual (e.g. as a legal representative or parent), you must provide evidence of your authority to act on their behalf.

6. Exceptions & Limits

Certain data subject rights have limits. We may be unable to fulfil a request where:

• Erasure is prevented by legal retention obligations (e.g. financial records, audit logs)
• The data is required for the establishment, exercise, or defence of legal claims
• Processing is necessary to protect the vital interests of you or another person
• The data relates to third parties whose interests would be adversely affected
• Disclosure would reveal information about another identifiable individual
• The request is manifestly unfounded or excessive

Where we refuse a request, we will explain our reasoning and inform you of your right to complain to a supervisory authority and to seek a judicial remedy.

7. Complaints

If you believe we have not handled your personal data in accordance with applicable data protection law, you have the right to lodge a complaint with the relevant supervisory authority:

• United Kingdom: Information Commissioner's Office (ICO) — ico.org.uk/make-a-complaint — 0303 123 1113
• Ireland: Data Protection Commission (DPC) — dataprotection.ie
• Germany: Your State Data Protection Authority (Landesbeauftragte)
• Other EEA countries: Your national supervisory authority as listed on the EDPB website

We encourage you to contact us first at privacy@ventracehq.com so we can try to resolve your concern directly.

8. Controller vs. Processor — What This Means for You

Ventrace operates in two distinct data roles depending on the context:

If you are an employee whose data appears in your employer's Ventrace workspace (e.g. in a supplier questionnaire or emissions record), your employer is the data controller. You should exercise your GDPR rights directly with them. Ventrace can provide your employer with assistance in responding to your request under our Data Processing Agreement.

9. Contact Our Privacy Team

For all GDPR-related enquiries, subject access requests, or to reach our Data Protection Officer:

• Email: privacy@ventracehq.com
• Response SLA: Acknowledgement within 3 business days
• Post: Ventrace Inc., Privacy Team, [Registered Address]

Our Privacy Policy at ventracehq.com/privacy provides additional information about how we collect and use your personal data.