Privacy Policy

This Privacy Policy describes how VERYPYME SERVICIOS DIGITALES, S.L. ("VeryPyme") processes the personal data of the people who visit its website, use its ESG sustainability and compliance platform or otherwise interact with it, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data and guarantee of digital rights (LOPDGDD). The use of cookies is governed by the Cookie Policy and the processing VeryPyme carries out on behalf of its business customers by the Data Processing Agreement (DPA).

1. Data controller

The controller of the personal data described in this policy, except where VeryPyme acts as a processor (sections 8 and 14), is:

• VERYPYME SERVICIOS DIGITALES, S.L.
• Tax ID (NIF): B25998022
• Registered address: Av. Talgo, 83 – 28023 Madrid (Madrid), Spain
• Contact email for data protection matters: soporte@verypyme.com

VeryPyme is not required to appoint a data protection officer and has not appointed one. Any question about this policy may be sent to the email address above.

2. Scope

This policy applies to VeryPyme's public website (in Spanish and English), to the client area of the platform, to the application programming interface (API) made available to certain customers, to the electronic communications VeryPyme sends in connection with the service and to the handling of support requests.

It applies to website visitors, registered users, the people acting on behalf of customer organisations (representatives, administrators and team members), the contact persons of suppliers invited to the platform and any other person whose personal data VeryPyme processes in the context of the service.

Where VeryPyme processes personal data on behalf of a customer organisation, this policy is supplemented by the Data Processing Agreement (DPA), which prevails over it with respect to that processing.

3. Personal data processed

Depending on your relationship with VeryPyme, we may process the following categories of personal data:

• Account and identification data: email address, user identifier, name and, if you sign in with your Google account, the name and profile picture that Google communicates or, if you sign in with your Microsoft account, the name and email address that Microsoft communicates. Passwords are managed by Google's authentication service (Firebase Authentication); VeryPyme has no access to them.
• Organisation data: company name, tax ID, website, telephone, name and email of the contact person, address, economic activity and sites with their geographic location.
• Team data: email address, display name and role of each member of an organisation, as well as the invitations sent.
• Billing and payment data: name or company name, tax or VAT number, billing address, email, amounts, payment references and status of transactions. Card details are entered directly in Stripe's forms and VeryPyme neither receives nor stores them.
• Contractual records: acceptances of the Terms and Conditions, the Data Processing Agreement and the applicable particular conditions, with identification of the document, version, language, digital fingerprint (hash) of the accepted text, email of the accepting person and server-recorded date; order confirmations.
• Technical and browsing data: IP address, browser and device type, pages visited, technical server logs and, only if you accept analytics cookies, cookie identifiers.
• Content uploaded by customer organisations: documents, evidence, certificates, questionnaire answers, figures, comments, free-text fields, action plans, value chain data (name of the supplier company and email of its contact person) and the information that the platform's features extract or generate from that content. This content may include personal data of third parties (employees, suppliers, customers or other people). It is processed under the conditions of sections 8 and 14.
• Ratings and comments: score and comments you voluntarily submit about the platform.

VeryPyme does not request special categories of data (Article 9 GDPR). Please do not upload data of that nature, or third-party data, to the platform unless it is necessary for the purpose of the service and you have an appropriate legal basis to do so.

4. Source of the data

Personal data come from the following sources:

• From you, when you create an account, complete your organisation's details, purchase a service, use the platform's features or contact support.
• From the customer organisation you belong to, when its representative invites you as a team member or uploads information in which you appear.
• From other companies using the platform, when a company enters a supplier's contact details to invite it, or when a supplier decides to share sustainability information with it through its express consent on the platform.
• From Google, when you choose to sign in with your Google account (name, email and profile picture).
• From Microsoft, when you choose to sign in with your Microsoft account (name and email).
• From Stripe, which communicates to us the outcome and references of payment transactions.
• From your browser and device, automatically while browsing.

5. Purposes of processing

VeryPyme processes personal data for the following purposes:

• To create and manage your user account, authenticate you and maintain your session.
• To manage customer organisations, their teams, roles and permissions, and supplier invitations.
• To provide the platform's features: ESG assessment, carbon footprint, climate risks, action plans, reports, certificates, value chain and sharing of information with other companies when you so decide.
• To manage purchases, billing and collection of payment for the services, and to comply with accounting and tax obligations.
• To keep evidence of contractual acceptances and confirmed orders.
• To send you operational and transactional communications required for the service (invitations, access activations, purchase confirmations, in-platform notices).
• To handle your support requests and the exercise of your rights.
• To ensure the security of the platform, prevent unauthorised use and resolve incidents.
• To measure the use of the website and the platform through analytics, only if you accept analytics cookies.
• To improve the platform based on the ratings and comments you send us.
• To comply with applicable legal obligations and respond to requests from competent authorities.

6. Legal bases

• Performance of a contract or pre-contractual measures (Article 6(1)(b) GDPR): management of the account, the organisation and the team, provision of the purchased features, purchasing, billing and transactional communications.
• Compliance with legal obligations (Article 6(1)(c) GDPR): accounting, tax and commercial obligations, retention of contractual records and responses to requests from authorities.
• Legitimate interest (Article 6(1)(f) GDPR): platform security and fraud prevention, management of supplier invitations on behalf of customer companies, handling of support requests and improvement of the service based on the ratings received. You may object to these processing activities as set out in section 18.
• Consent (Article 6(1)(a) GDPR): analytics cookies and, where applicable, commercial communications. You may withdraw your consent at any time without affecting the lawfulness of prior processing.

Where VeryPyme acts as a processor on behalf of a customer organisation, the legal basis for the processing lies with that organisation as controller.

7. Account and organisation management

User accounts are linked to one or more organisations. Within each organisation there are different roles (owner, administrator, member and viewer) with differentiated permissions. People with the owner or administrator role can see the email, display name and role of the other members, invite new people and manage the organisation's contracts.

Invitations to team members and suppliers are sent by email with a single-use access link. Invitations that are not accepted expire after a set period and are recorded as expired.

When a company enters the name and contact email of a supplier on the platform in order to invite it, that company is responsible for having a legal basis to communicate those data. VeryPyme processes those data to send the invitation and manage the relationship between both companies on the platform. The invited supplier decides whether to create an account and what information to share, and may revoke consent to share it at any time; revocation prevents new access, although it does not delete information that the receiving company has already exported beforehand.

Currently, the deletion of a user account or an organisation is handled by request to soporte@verypyme.com, as set out in section 16.

8. Documentation and data provided by customers

The platform allows customer organisations to store documents and evidence (for example certificates, policies, invoices, records or reports) and link them to their assessments and reporting years. The customer organisation retains all rights over that documentation: uploading it to the platform does not transfer its ownership to VeryPyme nor any right of use other than that needed to provide the service.

With respect to the personal data contained in that documentation and in the information the organisation enters in questionnaires, forms, text fields, action plans or the value chain, VeryPyme acts as a processor: it stores and processes them solely to provide the purchased features, following the customer organisation's instructions and under the conditions of the Data Processing Agreement (DPA). The customer organisation is responsible for having a sufficient legal basis to upload third-party data.

The documentation may be analysed by automated systems, including artificial intelligence features, as set out in section 9.

When the organisation deletes a document using the deletion feature available on the platform, the file and its main record are removed. However, the following may remain: the audit records of the deletion itself; the snapshots of closed reporting years or confirmed assessments, which are immutable by design; derived information the organisation has chosen to keep; and data whose retention is required by a legal obligation. Deletion is not available while the document forms part of a closed reporting year or a confirmed assessment. Technical and backup copies that may exist in our providers' infrastructure follow those providers' own cycles.

9. Artificial intelligence and automated processing

Certain platform features use generative artificial intelligence models from the Google Cloud Vertex AI service, configured by VeryPyme in a European Union region (Netherlands). These features are used to extract information from the documents provided, classify them, check the consistency of the declared data, review evidence and propose answers to the sustainability questionnaires.

For this purpose, the full content of the document or the information analysed, together with the answers and clarifications provided by the organisation, is sent to the artificial intelligence service, and the generated results are kept linked to the relevant reporting year. These results are auxiliary: they are presented to the organisation as proposals that it reviews, modifies or confirms. VeryPyme does not make decisions producing legal effects on individuals or similarly significantly affecting them based solely on automated processing.

VeryPyme does not train artificial intelligence models with its customers' data. Google Cloud's use of the data sent to Vertex AI is governed by the Google Cloud contractual terms applicable to that service, under which Google acts as VeryPyme's processor. We do not claim that the information sent is anonymised or that it is deleted immediately in the provider's infrastructure beyond what those terms establish.

When the analysis is performed on content uploaded by a customer organisation, VeryPyme acts as a processor and Google Cloud as a sub-processor, under the terms of the Data Processing Agreement (DPA) and the list of sub-processors.

10. Billing and payments

Payments are processed through Stripe. When you purchase a service, VeryPyme communicates to Stripe your email, name or company name and billing address, together with the amount and an internal reference for the transaction. Card details are entered directly in Stripe's forms.

Stripe processes payment data as an independent controller in order to process transactions, prevent fraud and comply with its own legal obligations, in accordance with its privacy policy. For the other data VeryPyme communicates to it, Stripe acts as a processor.

VeryPyme keeps an immutable record of each transaction (billing details at the time of purchase, amounts, taxes applied, payment references and confirmed order) in order to issue the invoice, evidence the purchase and comply with accounting and tax obligations.

11. Communications and support

VeryPyme sends operational and transactional communications required for the service (platform invitations, access activations, purchase confirmations and notices within the client area). Emails are sent through the provider Resend. VeryPyme does not keep a copy of the content of the emails sent, only the sending mark associated with each operation.

VeryPyme does not send commercial communications by email without your prior consent, except those relating to services you have already purchased within the limits permitted by law. In any commercial communication you will be able to object to receiving further communications.

Support requests are handled through the email soporte@verypyme.com. The messages you send us are kept while the request is being handled and for as long as liabilities may arise from it.

If you send us a rating or comment about the platform from the client area, we link it to your account so that we can follow up and improve the service.

12. Analytics and cookies

VeryPyme uses Google Analytics 4 to measure the use of the website and the platform in aggregate only if you accept analytics cookies in the notice shown when you enter. If you do not accept them or reject them, the tool is not loaded and no analytics cookies are created. You can change your choice at any time through the "Manage cookies" link in the footer.

Cookies and technologies strictly necessary for the operation of the platform (session, active organisation, language and cookie preference) do not require consent. Full information about the cookies used, their purposes, duration and how to manage them is available in the Cookie Policy.

13. Recipients and providers

VeryPyme does not sell personal data nor disclose them to third parties for their own purposes, except in the following cases:

• Service providers (VeryPyme's processors): cloud infrastructure, authentication, database, storage and artificial intelligence services (Google Cloud); hosting and execution of the application (Vercel); sending of transactional emails (Resend); address geocoding and maps (Geoapify); web analytics subject to consent (Google Analytics). All of them process data following our instructions and under a processing contract in accordance with Article 28 GDPR. Their full identification, location and transfer safeguards are set out in the list of sub-processors.
• Stripe, as an independent controller for payment processing (section 10).
• Other companies using the platform, when an organisation decides to share sustainability information with them (for example, a supplier with the company that invited it to its value chain, or a company with an external information system it has authorised). This disclosure only takes place upon the express decision of the sharing organisation, and the receiving company processes the information as an independent controller.
• Public environmental and climate data services, to which only the geographic coordinates of the sites analysed are sent in order to calculate climate risks, without names or user identifiers.
• Public authorities, courts and tribunals, where there is a legal obligation.

VeryPyme's authorised staff access the data only to the extent necessary to operate the platform, provide support and ensure its security, under a duty of confidentiality.

14. Sub-processors and processing on behalf of customers

Where VeryPyme acts as a processor on behalf of a customer organisation (sections 8 and 9), the providers involved in that processing are sub-processors. VeryPyme maintains a public, versioned list of sub-processors, indicating for each one the service provided, the purpose, the categories of data, the location and, where applicable, the international transfer mechanism.

The conditions of that processing, including VeryPyme's obligations as processor, the general authorisation regime for sub-processors, the information on additions and replacements and the possibility to object, are governed by the Data Processing Agreement (DPA). The DPA is accepted once on behalf of each organisation by a person with the owner or administrator role, who declares to be authorised to do so.

15. International transfers

Some of the providers we use are established outside the European Economic Area or may access data from outside it. In those cases, the transfer relies on one of the mechanisms provided for in Chapter V of the GDPR:

• Google Cloud: the database, file storage and artificial intelligence features are configured in European Union regions (Belgium and the Netherlands). The authentication service is a global Google service. Google may access data from outside the EEA for support or operational purposes; its Cloud Data Processing Addendum incorporates the standard contractual clauses approved by the European Commission for those cases.
• Vercel Inc. (United States): hosting of the application, execution of server functions and technical logs. Vercel is certified under the EU-U.S. Data Privacy Framework (European Commission adequacy decision) and its Data Processing Addendum incorporates the standard contractual clauses.
• Stripe: services for European customers are provided by Stripe Payments Europe, Limited (Ireland); data may be transferred to Stripe, Inc. (United States), certified under the EU-U.S. Data Privacy Framework, and Stripe's Data Processing Agreement incorporates the standard contractual clauses.
• Resend (Plus Five Five, Inc., United States): sending of transactional emails. Resend is certified under the EU-U.S. Data Privacy Framework and its Data Processing Agreement incorporates the standard contractual clauses.
• Google Analytics (only with consent): may involve transfers to the United States under the safeguards Google provides for this service.
• Geoapify: company established in the European Union, with services hosted in European Union data centres.

You may request further information about these safeguards at soporte@verypyme.com. The list of sub-processors is kept up to date with the mechanism applicable to each provider.

16. Retention

We keep personal data for as long as necessary for the purpose for which they were collected and, afterwards, blocked for the periods during which liabilities arising from the processing may be claimed or a legal obligation so requires. In particular:

• Account and organisation: while the account is active. The deletion of an account or an organisation is currently handled by request to soporte@verypyme.com; once processed, the data are deleted or blocked in accordance with this section.
• Billing and payments: billing records and transactions are kept for six years from the date of the transaction, in accordance with Article 30 of the Spanish Commercial Code, and in any event for the limitation period of tax obligations (Article 66 of the Spanish General Tax Law).
• Documentation and content provided by the customer organisation: for the duration of the relationship with the organisation and under the terms of the Data Processing Agreement (DPA). Snapshots of closed reporting years and confirmed assessments are kept immutably for as long as the organisation maintains its account, as evidence of the results obtained.
• Contractual acceptance and order records: for the duration of the contractual relationship and, afterwards, for the limitation period of actions arising from the contract (Article 1964 of the Spanish Civil Code) and of data protection infringements (Article 78 of the LOPDGDD).
• Support: while the request is being handled and for as long as liabilities may arise from it.
• Commercial communications: until you withdraw your consent or object.
• Security and technical logs: technical server and access logs are kept for the periods set by our infrastructure providers for the operation and security of the service.
• Technical and backup copies: the copies that may exist in our providers' infrastructure follow those providers' own renewal cycles; VeryPyme does not keep additional backup copies of its own.

Cookies and analytics data are kept for the periods indicated in the Cookie Policy.

17. Security

VeryPyme applies technical and organisational measures appropriate to the risk of the processing to protect personal data against unauthorised access, alteration, loss or disclosure. These include:

• User authentication through Google's identity service (password, email sign-in link, Google account or Microsoft account) and server sessions of limited duration.
• Role-based access control within each organisation and logical separation of each organisation's data, resolved on the server.
• Deny-by-default access rules for the database and file storage, and critical collections (billing, contractual records, purchased access) accessible only from the server.
• Encryption of communications in transit (HTTPS) and encryption at rest provided by our providers' infrastructure.
• Signed, time-limited download links for files; single-use invitation links with expiry.
• Verification of the signature of payment notifications and idempotency controls in payment processing.
• Immutable contractual and billing records.
• Type and size limits on the files that can be uploaded to the platform.

In addition, our infrastructure providers maintain their own security programmes and certifications, which belong to those providers and not to VeryPyme. VeryPyme does not currently hold information security certifications of its own.

18. Rights of data subjects

You may at any time exercise your rights of access, rectification, erasure, restriction of processing, portability and objection, as well as the rights relating to automated decisions where applicable, by sending a request to soporte@verypyme.com or in writing to the address indicated in section 1, identifying the right you are exercising.

As a general rule we do not require you to attach an identity document. VeryPyme may ask you for additional information where reasonably necessary to verify your identity, in particular if the request is received from an email address other than the one linked to your account or there are reasonable doubts about it.

We will respond to your request within one month of receipt, extendable in the cases provided for in Article 12 GDPR. If you consider that the processing does not comply with the law, you have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

If your data have been uploaded to the platform by a customer organisation for which VeryPyme acts as a processor, VeryPyme will forward your request to that organisation, which must resolve it as controller, and will provide it with the assistance set out in the Data Processing Agreement (DPA). You may also contact that organisation directly.

19. Third-party data and minors

If you upload personal data of third parties (employees, suppliers, customers, contact persons or others) to the platform, you warrant that you have a sufficient legal basis to do so, that you have informed those people where required by law and that the data are adequate, relevant and limited to what is necessary for the purpose of the service. VeryPyme cannot verify the existence of that legal basis and processes those data following your instructions.

VeryPyme's services are aimed exclusively at companies and professionals. They are not aimed at minors and we do not knowingly collect data from minors. If you become aware that a minor has provided us with personal data, please let us know at soporte@verypyme.com so that we can delete them.

20. Changes, contact and supervisory authority

This policy is versioned: each version is identified by its date and kept immutably. When we publish a new version, we will update the date shown in the header and, if the change materially affects your rights or the processing we carry out, we will inform you through the platform or by email.

For any question about this policy or about the processing of your personal data, you can write to soporte@verypyme.com or to VERYPYME SERVICIOS DIGITALES, S.L., Av. Talgo, 83 – 28023 Madrid (Madrid), Spain.

The competent supervisory authority is the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es), with which you may lodge a complaint if you consider that your rights have not been properly addressed.