Where Emvert processes personal data on your behalf, this sets out the subject matter, the security measures, the sub-processors used, and what happens to the data when the agreement ends.
Where you use the platform, you decide what personal data goes into it and why. That makes you the controller and Emvert the processor, and this agreement governs that relationship.
It sits alongside the terms of service and forms part of the same agreement. Where a customer requires their own DPA on their own paper, we will review it — but you will find this one covers the same ground.
| Item | Detail |
|---|---|
|
Subject matter |
Provision of the Emvert sustainability reporting platform |
|
Duration |
The Subscription Term, plus the export and deletion period below |
|
Nature and purpose |
Hosting, storage, processing and display of data you enter, so that you can produce sustainability disclosures |
|
Types of personal data |
Names, work contact details, job roles and activity records of your Authorised Users; any personal data contained in evidence documents you upload |
|
Categories of data subject |
Your employees and contractors; your advisers and assurance providers where you grant them access; contacts at your suppliers where you send them data requests |
The platform is not designed to hold special categories of personal data and should not be used for that purpose.
We process personal data only as necessary to provide the Service and on your documented instructions, unless required otherwise by law — in which case we will tell you before processing, where we are permitted to.
Everyone we authorise to process your data is bound by confidentiality obligations.
The technical and organisational measures set out below, reviewed as the service and the threat picture change.
Engaged only under written terms imposing equivalent obligations, and notified to you in advance of any change so you have a genuine opportunity to object.
Where a data subject exercises a right against you in respect of data in the platform, we will assist you in responding, taking into account the nature of the processing.
Including impact assessments and prior consultation with the Commission, where the nature of the processing requires it.
As set out below.
We will make available the information needed to demonstrate compliance and will allow and contribute to audits, on reasonable notice and subject to confidentiality.
All traffic to the platform uses TLS. Stored data and uploaded evidence documents are encrypted at rest.
Each organisation's data is logically separated. A firm-tier account holds each client in its own workspace, and access is granted per engagement.
Role-based, least-privilege. A site user enters their site's data; a reviewer approves; an auditor reads. Role changes are recorded.
Who viewed, entered, changed or exported what, and when. The same record that supports assurance supports a security investigation.
Regular backups with tested restoration, so that availability and integrity can be restored in a timely manner after an incident.
Background-appropriate hiring, confidentiality obligations, and access granted on the basis of role rather than seniority.
If we become aware of a personal data breach affecting your data, we will notify you without undue delay and in any event within the timeframe stated on your order form.
The notification will describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Where we cannot provide all of that at once, we will provide it in phases as the picture becomes clear rather than delaying the initial notification.
We will not make a public statement identifying you as affected without your agreement, unless we are legally required to.
We use a small number of sub-processors to deliver the platform: hosting and infrastructure, transactional email delivery, and error monitoring. The current list — including what each processes and where — is provided with your order form and on request.
We notify customers in advance of adding or replacing a sub-processor, with enough notice to object. Where you object on reasonable data protection grounds and we cannot offer an alternative, you may terminate the affected part of the Service without penalty.
Where a sub-processor operates outside Nigeria, we rely on the transfer mechanisms permitted under the Nigeria Data Protection Act 2023 and put appropriate contractual protections in place.
On termination or expiry you may export your full dataset — including evidence documents — for the period stated on your order form. That right does not depend on your account being in good standing or on any commercial dispute being resolved.
After that period we delete your data, including from backups on our ordinary backup rotation, except where we are legally required to retain a copy. Where we are, we will tell you what has been retained and why.
On request we will confirm deletion in writing.
Four questions, and you get the year you first file, the framework, and what to collect first.
Plain-language explainers of the FRC and SEC rules, ISSB S1 & S2, and what each asks you to disclose.
What a consultant-led reporting cycle costs against an annual licence, in Naira.
