When this applies
Where you use the platform, you decide what personal data goes into it and why. That makes you the controller and Emvert the processor, and this agreement governs that relationship.
It sits alongside the terms of service and forms part of the same agreement. Where a customer requires their own DPA on their own paper, we will review it — but you will find this one covers the same ground.
Subject matter, duration and nature of processing
| Item | Detail |
|---|---|
| Subject matter | Provision of the Emvert sustainability reporting platform |
| Duration | The Subscription Term, plus the export and deletion period below |
| Nature and purpose | Hosting, storage, processing and display of data you enter, so that you can produce sustainability disclosures |
| Types of personal data | Names, work contact details, job roles and activity records of your Authorised Users; any personal data contained in evidence documents you upload |
| Categories of data subject | Your employees and contractors; your advisers and assurance providers where you grant them access; contacts at your suppliers where you send them data requests |
The platform is not designed to hold special categories of personal data and should not be used for that purpose.
Our obligations as processor
Process only on your instructions
We process personal data only as necessary to provide the Service and on your documented instructions, unless required otherwise by law — in which case we will tell you before processing, where we are permitted to.
Confidentiality
Everyone we authorise to process your data is bound by confidentiality obligations.
Security
The technical and organisational measures set out below, reviewed as the service and the threat picture change.
Sub-processors
Engaged only under written terms imposing equivalent obligations, and notified to you in advance of any change so you have a genuine opportunity to object.
Assistance with data subject rights
Where a data subject exercises a right against you in respect of data in the platform, we will assist you in responding, taking into account the nature of the processing.
Assistance with your own obligations
Including impact assessments and prior consultation with the Commission, where the nature of the processing requires it.
Deletion or return on termination
As set out below.
Audit
We will make available the information needed to demonstrate compliance and will allow and contribute to audits, on reasonable notice and subject to confidentiality.
Technical and organisational security measures
Encryption
All traffic to the platform uses TLS. Stored data and uploaded evidence documents are encrypted at rest.
Logical separation
Each organisation's data is logically separated. A firm-tier account holds each client in its own workspace, and access is granted per engagement.
Access control
Role-based, least-privilege. A site user enters their site's data; a reviewer approves; an auditor reads. Role changes are recorded.
Logging
Who viewed, entered, changed or exported what, and when. The same record that supports assurance supports a security investigation.
Backup and recovery
Regular backups with tested restoration, so that availability and integrity can be restored in a timely manner after an incident.
Personnel
Background-appropriate hiring, confidentiality obligations, and access granted on the basis of role rather than seniority.
Personal data breach notification
If we become aware of a personal data breach affecting your data, we will notify you without undue delay and in any event within the timeframe stated on your order form.
The notification will describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Where we cannot provide all of that at once, we will provide it in phases as the picture becomes clear rather than delaying the initial notification.
We will not make a public statement identifying you as affected without your agreement, unless we are legally required to.
Sub-processors and international transfers
We use a small number of sub-processors to deliver the platform: hosting and infrastructure, transactional email delivery, and error monitoring. The current list — including what each processes and where — is provided with your order form and on request.
We notify customers in advance of adding or replacing a sub-processor, with enough notice to object. Where you object on reasonable data protection grounds and we cannot offer an alternative, you may terminate the affected part of the Service without penalty.
Where a sub-processor operates outside Nigeria, we rely on the transfer mechanisms permitted under the Nigeria Data Protection Act 2023 and put appropriate contractual protections in place.
Return and deletion of data
On termination or expiry you may export your full dataset — including evidence documents — for the period stated on your order form. That right does not depend on your account being in good standing or on any commercial dispute being resolved.
After that period we delete your data, including from backups on our ordinary backup rotation, except where we are legally required to retain a copy. Where we are, we will tell you what has been retained and why.
On request we will confirm deletion in writing.