Privacy Policy
We are committed to protecting your personal data and being transparent about how we use it. This policy explains what data Ventrace collects, why, and how you can exercise your rights.
Summary: Ventrace acts as both a data controller (for account and usage data) and a data processor (for ESG and emissions data your organisation uploads). You own your organisation's data. We process it on your instruction. We never sell personal data.
1. Data Controller
Ventrace Inc. ("Ventrace", "we", "us", "our") is the data controller for personal data collected when you create an account, visit our website, or contact us. Our registered address is made available on request.
For ESG, emissions, supplier, and operational data that your organisation uploads to the Ventrace platform, your organisation is the data controller and Ventrace acts as a data processor under a Data Processing Agreement (DPA) incorporated into our Terms of Service.
To contact us regarding privacy matters: privacy@ventracehq.com
2. Data We Collect
2.1 Account & Identity Data
When you register or manage an account: full name, work email address, job title, company name, country, password (hashed, never stored in plain text).
2.2 Usage & Technical Data
IP address, browser type and version, device type, operating system, pages visited, time on page, referring URLs, session duration, feature interactions, error logs. This data is collected automatically via server logs and analytics tooling.
2.3 Platform Content Data
Emissions records, facility data, supplier information, compliance documents, evidence files, questionnaire responses, and AI conversation history — all submitted by your organisation's users. This data belongs to your organisation.
2.4 Communications Data
Messages sent to our support team, demo requests, contact form submissions, and responses to surveys or research invitations.
2.5 Billing Data
Billing contact name and email, company address for invoicing. Payment card data is processed directly by our payment processor (Stripe) and never stored on Ventrace servers.
2.6 SSO / Authentication Data
If you sign in via a third-party identity provider (Google, Microsoft, Okta), we receive the scoped profile data your organisation's SSO policy permits (typically name, email, and group membership).
3. How We Use Your Data
| Purpose | Data Used |
|---|---|
| Providing and operating the Ventrace platform | Account data, platform content data |
| Authentication and access control | Account data, SSO data |
| Billing and payment processing | Billing data |
| Customer support | Account data, communications data, usage data |
| Product improvement and analytics | Usage and technical data (aggregated/anonymised) |
| Security monitoring and fraud prevention | Usage and technical data |
| Sending transactional emails (receipts, alerts) | Account data |
| Marketing communications (with consent or legitimate interest) | Account data, communications data |
| Compliance with legal obligations | All categories as required |
4. Legal Basis for Processing (GDPR Article 6)
Where GDPR applies, we rely on the following legal bases:
- Contract (Art. 6(1)(b)): Processing necessary to provide the Ventrace service you've signed up for — account management, platform operation, billing.
- Legitimate Interests (Art. 6(1)(f)): Security monitoring, fraud prevention, product improvement analytics, and marketing to existing customers. We balance our interests against your rights and freedoms.
- Consent (Art. 6(1)(a)): Marketing communications to prospects, optional analytics cookies. You may withdraw consent at any time.
- Legal Obligation (Art. 6(1)(c)): Compliance with applicable laws (tax records, law enforcement requests with legal authority).
For special category data (if applicable), we rely on Art. 9(2)(a) (explicit consent) or Art. 9(2)(j) (scientific/statistical research with safeguards).
5. Data Sharing & Subprocessors
We do not sell, rent, or trade personal data. We share data only in the following circumstances:
- Service Providers (Subprocessors): Cloud infrastructure (AWS), database services, email delivery, payment processing, error monitoring, and analytics tools. All subprocessors are bound by data processing agreements. See our full Subprocessors List.
- Your Organisation: Account administrators within your tenant can access user data within their organisation's workspace.
- Legal Requirements: We may disclose data in response to valid legal process (court order, subpoena, regulatory request) after reviewing its legality. We will notify you unless prohibited by law.
- Business Transfers: In a merger, acquisition, or sale of assets, personal data may be transferred to the acquiring entity under equivalent protections.
- Your Consent: With your explicit consent for any other purpose.
6. International Data Transfers
Ventrace primarily processes data in the European Economic Area (EEA) and the United Kingdom. Where data is transferred outside these regions (for example, to US-based service providers), we ensure appropriate safeguards are in place:
- EU Standard Contractual Clauses (SCCs) approved by the European Commission
- UK International Data Transfer Agreements (IDTAs) for UK transfers
- Adequacy decisions where applicable
You may request a copy of the relevant transfer mechanism by contacting privacy@ventracehq.com.
7. Data Retention
| Data Category | Retention Period |
|---|---|
| Account data (active) | Duration of account + 30 days post-termination |
| Account data (deleted) | Purged within 90 days of deletion request |
| Platform content data | Duration of subscription; exportable on request; purged within 90 days of contract end |
| Billing records | 7 years (legal/tax obligation) |
| Security and audit logs | 24 months |
| Marketing data (with consent) | Until consent withdrawn or 3 years of inactivity |
| Support communications | 3 years from ticket close |
| Anonymised analytics | Indefinitely (no personal data) |
8. Your Rights Under GDPR
If you are in the EEA, UK, or Switzerland, you have the following rights. We respond to all valid requests within 30 days:
- Right of Access (Art. 15): Request a copy of the personal data we hold about you.
- Right to Rectification (Art. 16): Correct inaccurate or incomplete data.
- Right to Erasure / "Right to be Forgotten" (Art. 17): Request deletion of your personal data, subject to legal retention obligations.
- Right to Restriction of Processing (Art. 18): Ask us to pause processing while you contest accuracy or object to use.
- Right to Data Portability (Art. 20): Receive your data in a machine-readable format (JSON or CSV) and transfer it to another provider.
- Right to Object (Art. 21): Object to processing based on legitimate interests or for direct marketing. We will stop unless we can demonstrate compelling grounds.
- Right to Withdraw Consent: Withdraw any consent at any time without affecting the lawfulness of prior processing.
- Right to Lodge a Complaint: If you believe we are mishandling your data, you may file a complaint with your national supervisory authority (in the UK: the ICO at ico.org.uk; in Ireland: the DPC).
To exercise any of these rights, email privacy@ventracehq.com or visit our GDPR Rights Centre. We may need to verify your identity before processing your request.
9. Cookies
We use cookies and similar technologies for authentication, security, and analytics. You can manage your cookie preferences at any time. For full details, see our Cookie Policy.
10. Security
We implement industry-standard technical and organisational measures including:
- Encryption in transit (TLS 1.2+) and at rest (AES-256)
- Row-level tenant data isolation — no cross-tenant data access
- Role-based access controls with audit logging
- Regular penetration testing and vulnerability assessments
- Access controls, audit logging and incident response procedures
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and affected individuals without undue delay.
11. Children's Privacy
Ventrace is a B2B enterprise platform not directed at children under 16. We do not knowingly collect data from minors. If you believe a minor has submitted data without parental consent, contact us and we will delete it promptly.
12. Policy Changes
We may update this policy periodically. Material changes will be communicated by email or in-platform notification at least 30 days before they take effect. The "Last Updated" date at the top reflects the most recent revision. Continued use of the platform after the effective date constitutes acceptance of the revised policy.
13. Contact Us & Data Protection Officer
For all privacy enquiries, subject access requests, or to reach our Data Protection Officer:
- Email: privacy@ventracehq.com
- Data subject requests portal: ventracehq.com/gdpr
- Post: Ventrace Inc., Privacy Team, [Registered Address]
We aim to acknowledge all requests within 3 business days and resolve them within 30 calendar days. For complex requests, we may extend this by a further 60 days with notice.