Privacy Policy

Bsustain is a sustainability reporting platform operated by ONE BEST, Lda., a company registered in Portugal with NIPC 514694602 and registered office at Rua do Paraíso, n.º 192, 4000-375 Porto. We provide tools to help small and medium-sized enterprises prepare and generate sustainability reports under the European Union Voluntary Standard (VS).

For questions regarding this Privacy Policy, contact us at: info@bsustain.eu

We collect the following categories of personal data:

• Account data: name, email address, company name, role, upon registration.
• Company data: organisational and operational information you enter into the platform to generate sustainability reports (e.g. workforce figures, environmental data, financial indicators, certifications, policies).
• Usage data: log data, IP address, browser type, pages visited, and timestamps — collected automatically when you use the platform.
• Analytics data: aggregated and anonymised data on platform usage, collected via Google Analytics with consent under Google Consent Mode V2.

We use the data we collect to:

• Provide, operate, and maintain the platform.
• Generate sustainability reports on your behalf using the information you provide.
• Improve the platform and develop new features.
• Communicate with you regarding your account or our services.
• Use anonymised and aggregated data for benchmarking, sectoral analysis, research, and publications on enterprise sustainability — only with your explicit consent through the in-account toggle "Contribute to European sustainability study". You may withdraw this consent at any time.
• Comply with legal obligations.

We process your personal data on the following legal bases under the GDPR:

• Contract performance (Art. 6(1)(b) GDPR): processing necessary to provide the services you have signed up for.
• Legitimate interests (Art. 6(1)(f) GDPR): to improve and secure our platform, defend our rights, and ensure operational continuity.
• Legal obligation (Art. 6(1)(c) GDPR): where required by applicable law (e.g. tax obligations).
• Consent (Art. 6(1)(a) GDPR): for non-essential cookies, analytics, and use of anonymised data for research and benchmarking.

We share certain data with trusted third-party service providers who help us operate the platform. All personal data is hosted within the European Union:

• Neon — application database. Location: Frankfurt, Germany.
• Render — backend / API hosting. Location: Frankfurt, Germany.
• Vercel — frontend hosting. Location: Paris, France.
• AWS S3 — sustainability report storage. Location: Stockholm, Sweden.
• Anthropic — AI text generation and document processing (Claude models). Location: USA, under EU Standard Contractual Clauses. Data submitted via the API is not used to train Anthropic's models, in accordance with their Data Processing Addendum (anthropic.com/legal/dpa).
• Stripe — payment processing. Location: USA / EU under Standard Contractual Clauses.
• Google Analytics — anonymised usage analytics, with consent under Google Consent Mode V2.

We do not sell your personal data to third parties.

We retain your personal data as follows:

• Active account data: throughout the period your account is active.
• Account data after closure: 12 months from closure date, then automatically deleted, unless retention is required by law.
• Generated reports: 5 years from the last active subscription year.
• Billing data: 10 years (Portuguese tax obligation).
• System logs: 12 months.
• Anonymised aggregated data (with consent): retained without time limit for research and benchmarking purposes; cannot be linked back to your company.

Under the GDPR, you have the following rights regarding your personal data:

• Right of access to your data.
• Right to rectification of inaccurate data.
• Right to erasure ("right to be forgotten"), subject to legal retention requirements.
• Right to restriction of processing.
• Right to data portability.
• Right to object to processing based on legitimate interests.
• Right to withdraw consent at any time, without affecting the lawfulness of prior processing.
• Right not to be subject to automated decisions with significant effects.

To exercise any of these rights, contact us at info@bsustain.eu. We will respond within 30 days. You also have the right to lodge a complaint with the Portuguese data protection authority (CNPD) at www.cnpd.pt.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure, including:

• Encryption in transit (HTTPS / TLS 1.3) and at rest (AES-256).
• Multi-factor authentication for administrative access.
• Role-based access control internally.
• Encrypted automatic backups.
• Periodic security audits.
• Personal data breach notification procedure within 72 hours, in accordance with the GDPR.

The Platform and the website bsustain.eu use the following categories of cookies:

• Strictly necessary cookies: required for platform operation (session authentication, language preferences, cookie consent state). These do not require consent.
• Analytics cookies: collected via Google Analytics with consent under Google Consent Mode V2 to understand aggregated usage and improve the platform. These require explicit consent.

On your first visit, a cookie consent banner is displayed where you can accept all, reject non-essential, or customise your selection by category. You may review or change your selection at any time via the "Cookies" link in the website footer.

Cookie retention period:

• Session cookies: deleted upon closing the browser.
• Persistent cookies: maximum retention period of 12 months.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by displaying a notice on the platform. The date at the top of this page indicates when it was last revised.