Privacy Policy
Version 2026.1. Last updated:
This is a courtesy translation. In case of discrepancy, the Portuguese version prevails.
Who we are and to whom this policy applies
ESGreen Avaliação e Monitoramento ESG Ltda. (“ESGreen”, “we”), registered under CNPJ (Brazilian company registration number) no. 48.184.229/0001-50, headquartered at Av. Presidente Juscelino Kubitschek, 1327, 4th and 8th floors, Vila Nova Conceição, São Paulo/SP, CEP 04543-011, is the controller of the personal data processed through this website.
This policy applies to:
- the esgreen.com.br website and its pages;
- the campaign pages at materiais.esgreen.com.br, run on RD Station;
- emails you send to the @esgreen.com.br addresses published on the website.
It does not apply to the ESGreen Platform (painel.esgreen.com.br and API), which has its own policy and contracts. Section 5 explains how we process data from public sources on the platform.
This policy follows the LGPD (Law No. 13,709/2018, Brazil's General Data Protection Law) and the Brazilian Internet Civil Framework (Marco Civil da Internet, Law No. 12,965/2014).
Data protection officer
ESGreen's data protection officer (DPO) is Maurício Rodrigues da Silva, who can be reached at dpo@esgreen.com.br.
Contact the data protection officer to exercise your rights, ask questions about this policy or report an incident involving personal data.
What data we process, for what purpose and on what legal basis
| Context | Data | Purpose | Legal basis (LGPD) |
|---|---|---|---|
| Contact, demo or pre-assessment form | Name, corporate email, institution, job title (optional), institution type, subject, CNPJ (optional), message (optional) | Respond to the request, schedule the conversation, present the platform, prepare the pre-assessment and send a commercial proposal | Consent (Art. 7, I) |
| Consent record | Consent text, version of this policy, date and time, sent in the request email | Prove that consent was obtained (Art. 8, § 2) | Compliance with a legal obligation (Art. 7, II, and Art. 8, § 2) and regular exercise of rights (Art. 7, VI) |
| Content by email, when you request it | Email, name | Send ESGreen Research content | Consent (Art. 7, I) |
| Form protection and website security | IP address, used only during submission to limit attempts and for the anti-bot check, without being attached to the request or the report; source page; anti-bot check result | Prevent automated submissions, fraud and abuse | Legitimate interest (Art. 7, IX) |
| Website access logs, except on the Whistleblower channel pages | IP address, date and time, page accessed | Mandatory retention of application access logs | Compliance with a legal obligation (Art. 7, II; Marco Civil, Art. 15) |
| Usage statistics (Google Analytics 4), only with consent | Pages visited, time on page, traffic source, device and browser type, approximate location | Understand how the website is used and improve pages and content | Consent (Art. 7, I) |
| Marketing (RD Station), only with consent | Browser identifier, pages visited, traffic source and, if you have already submitted a form to us, the association of these visits with your contact record | Link visits to contact requests and personalize communications | Consent (Art. 7, I) |
| Embedded videos (YouTube) | Browsing data processed by Google from the moment you click play | Display the video | Consent (Art. 7, I), expressed by clicking play |
| Accessibility feature (Perto Digital), on every page | Page address, count of views and of the accessibility features used, device type (computer or mobile) and technical connection data, such as the IP address; when you turn on the text simplifier or image alt text, also the page's text or image addresses. Does not include your name, email or other registration data | Provide accessibility features (profiles, text and color adjustments, text reader, Brazilian Sign Language – Libras) and measure use of the feature | Legitimate interest (Art. 7, IX) |
| Whistleblower channel | Report content; identification and contact details only if you choose to provide them | Receive and investigate reported conduct | Legitimate interest (Art. 7, IX) and compliance with a legal obligation, where applicable (Art. 7, II) |
| Data subject requests | Name, contact details and information needed to confirm identity | Fulfill the request and record the response | Compliance with a legal obligation (Art. 7, II) |
| Emails sent directly to @esgreen.com.br addresses, without using the form | Name, email and message content | Reply to the message | Preliminary procedures relating to a contract, for commercial requests (Art. 7, V), or legitimate interest, in other cases (Art. 7, IX) |
| Résumés | Résumé and application data | Recruitment processes | Preliminary procedures relating to a contract (Art. 7, V) and, for future recruitment processes, consent (Art. 7, I) |
| Website admin area (internal use) | Name, corporate email, account identifier and access role of ESGreen employees; authorship of each content version | Control access and keep an audit trail of changes to published content | Legitimate interest (Art. 7, IX) |
Contact form
Fields marked as required are necessary to respond to your request. Without them, we cannot assist you. Job title, CNPJ and message are optional.
The website does not store the data submitted. It is sent by email to the sales team, together with the record of your consent, and is recorded in RD Station, the tool the sales team uses to follow up on the request.
You may withdraw your consent at any time by emailing dpo@esgreen.com.br. Withdrawal does not affect processing carried out before it.
CNPJ provided for pre-assessment
The CNPJ you provide may belong to another company: a client, a supplier or a business partner. We use the number only to prepare the requested pre-assessment, based on public sources. When the CNPJ identifies a natural person, such as an individual microentrepreneur, we process the data based on legitimate interest (Art. 7, IX), limited to that purpose.
Sensitive data
We do not ask for sensitive personal data in the contact forms. Do not include it in the message field.
In the Whistleblower channel, sensitive data is processed only when essential to investigate the reported facts, in the cases provided for in Art. 11 of the LGPD.
Whistleblower channel
Reports may be anonymous. The website does not store the report: it is sent by email directly to the compliance team's mailbox. The website also does not record the reporting person's IP address and does not load analytics or marketing tools on the channel page. Reports are read only by the people responsible for the investigation in the compliance team.
If a person named in a report requests access to their data, the request is fulfilled without revealing the identity of the reporting person or any information that would allow the reporting person to be identified, within the limits of the law.
Recruitment
Applications submitted through LinkedIn are governed, at the initial stage, by LinkedIn's privacy policy. Résumés sent to rh@esgreen.com.br are used in ESGreen's recruitment processes. Do not send sensitive data that is not necessary for the position.
Automated decisions
The website does not make automated decisions about you. Contact requests are read and answered by people.
Public-source data on the ESGreen Platform
The ESGreen Platform organizes public, regulatory and global-database information on companies, properties and operations. Some of these sources contain data on individuals, such as company partners and directors and politically exposed persons. This processing is governed by the platform's policy and by the contracts with clients, which define the roles of controller and processor.
If you have found data about you that seems incorrect, or want to exercise a right over this data, write to dpo@esgreen.com.br. More information on the Trust page.
Who we share data with
We share personal data only with suppliers that provide services to ESGreen (processors), to the extent necessary for each service, and with authorities when required by law.
| Provider | Service | When | Processing location |
|---|---|---|---|
| Cloud provider | Website hosting, content storage, technical monitoring | Always | Brazil |
| SendGrid (Twilio) | Sending the emails that deliver contact requests to the sales team and Whistleblower channel reports to the compliance team | When you submit a form | United States |
| Corporate email provider | ESGreen corporate email, which receives contact requests and reports | When you submit a form, when you write to an @esgreen.com.br address or when the team replies | Depending on the provider's infrastructure, which may include countries outside Brazil |
| Corporate identity provider | Employee authentication in the admin area | Employees only | Depending on the provider's infrastructure, which may include countries outside Brazil |
| RD Station | Contact management, marketing automation and visit tracking | Contact requests submitted through the form; visit tracking only with consent | Depending on the provider's infrastructure, which may include countries outside Brazil |
| Cloudflare (Turnstile) | Anti-bot verification on forms | On pages with forms | United States and other countries in the Cloudflare network |
| Google (Google Analytics 4) | Audience statistics | Only with consent | United States |
| Google (YouTube) | Video playback, loaded from youtube-nocookie.com | Only when you click to play | United States |
| Perto Digital | Accessibility plugin (accessibility button on every page) | Always available; data sent when the page opens and when you use the features | United States and other countries in the Cloudflare network |
We may also share data:
- with public authorities, to comply with a legal obligation or court order;
- to exercise rights in judicial, administrative or arbitration proceedings;
- in a corporate transaction, such as a merger or acquisition, provided that the safeguards of this policy are maintained.
We do not sell the personal data collected on this website.
International transfer
Some suppliers process or may process data outside Brazil, as shown in the table in Section 6. In these cases, the transfer complies with Art. 33 of the LGPD and the International Data Transfer Regulation of the ANPD (Brazil's National Data Protection Authority), approved by ANPD Resolution CD/ANPD No. 19/2024, through the mechanisms provided for in that Regulation, such as contractual clauses that require the supplier to ensure a level of data protection compatible with Brazilian law.
How long we keep data
| Data | Retention period | After the retention period |
|---|---|---|
| Contact requests and consent records | Not stored on the website. The request email stays with the sales team for as long as necessary to respond and conduct the commercial conversation, for up to 24 months after the last contact. If the conversation results in a contract, the retention periods of the contract and of applicable legal obligations apply | Deletion of the email |
| Contacts in RD Station | While there is a business relationship or until consent is withdrawn, reviewed every 24 months | Deletion or anonymization |
| Content mailing list | Until you unsubscribe | Deletion |
| Google Analytics 4 | 2 months for event data associated with users | Deletion by the provider |
| Data sent to the accessibility feature (Perto Digital) | Set by the provider's policy | Deletion by the provider |
| Website access logs | 6 months from each access | Deletion |
| Whistleblower channel reports | Not stored on the website. The report email remains in the compliance team's mailbox, with restricted access, for as long as necessary for the investigation and, after the case is closed, for up to 5 years | Deletion |
| Data subject requests and responses | 5 years after the response | Deletion |
| Résumés | 3 years after the selection process ends | Deletion |
| Authorship of content versions (admin area) | While the version exists; old versions are deleted after 365 days | Deletion |
We may retain data for longer when required by law or to exercise rights in judicial, administrative or arbitration proceedings.
Contact form
Data submitted through the contact form is not stored on the website: it is forwarded by email to ESGreen's sales team. It is kept for as long as necessary to respond to the request and conduct the commercial conversation, for up to 24 months after the last contact. If the conversation results in a contract, the data becomes subject to the retention periods of the contract and of applicable legal obligations. You may request deletion at any time via dpo@esgreen.com.br.
Whistleblower channel
Reports are not stored on the website: they are sent directly to the compliance team's mailbox, with restricted access. They are kept for as long as necessary for the investigation and, after the case is closed, for up to 5 years, to comply with legal obligations and allow the exercise of rights in legal proceedings. After that period, they are deleted. Identification of the reporting person is optional and exists only if voluntarily provided.
Your rights
You may request from ESGreen, at any time:
- confirmation that we process your data;
- access to the data;
- correction of incomplete, inaccurate or outdated data;
- anonymization, blocking or deletion of unnecessary or excessive data, or data processed in non-compliance with the LGPD;
- portability of the data to another service provider, in accordance with ANPD regulations;
- deletion of data processed based on your consent, except in the cases set out in Art. 16 of the LGPD;
- information about whom we share the data with;
- information about the possibility of not giving consent and the consequences of doing so;
- withdrawal of consent;
- objection to processing carried out under another legal basis, in the event of non-compliance with the LGPD;
- review of decisions made solely on the basis of automated processing.
How to request: write to dpo@esgreen.com.br, stating the right you wish to exercise and a means of contact. We may ask for information to confirm your identity before responding, to protect your data.
Response times: confirmation of processing and access to data are provided immediately, in simplified format, or within 15 days, by means of a complete statement (Art. 19 of the LGPD). Other requests are handled as quickly as possible. If we cannot fulfill a request, we explain why.
ANPD: you may also file a petition with Brazil's National Data Protection Authority (gov.br/anpd).
Cookies
Before you give your consent, the website uses only what is necessary to function and to protect the forms. Analytics and marketing load only after you accept, and you can change your choice at any time under “Cookie preferences” in the footer. The Perto Digital accessibility feature is available on every page, regardless of your choice, and stores your accessibility preferences in the browser's local storage.
Details of each tool, purpose and retention period are in the Cookie Policy.
Security
We adopt technical and administrative measures to protect personal data, including:
- encrypted traffic (HTTPS, TLS 1.2 or higher) and data encrypted at rest;
- cloud hosting and storage in Brazil;
- access to the admin area restricted to employees with a corporate account;
- forms without storage on the website: contact requests and reports are sent by email, without the sender's IP address;
- content versioning and recovery.
No system is immune to incidents. If a security incident occurs that may create a relevant risk or harm to you, we will notify you and the ANPD, pursuant to Art. 48 of the LGPD.
Children and adolescents
The website is intended for professionals and companies and is not directed at children or adolescents. We do not knowingly collect data from anyone under 18.
Links to other websites
The website contains links to third-party websites, such as LinkedIn, Instagram, YouTube and media outlets, and to the ESGreen platform. Each has its own privacy policy.
Changes to this policy
We may update this policy to reflect legal or technical changes or changes to our services. The version and update date appear at the top. Material changes are highlighted on the website before they take effect. Consents given under a previous version remain recorded with the version in force on the date they were given.
Version history
| Version | Date | Change |
|---|---|---|
| 2026.1 | New policy for the restructured website: controller, data protection officer, legal bases by purpose, processors, retention periods and rights. |