Privacy Policy

1. Who We Are

Citable ESG Orgs. (the “Platform”) is a B2B directory of ESG, sustainability-minded and impact-driven organisations, accessible at citableesg.com.

The Platform is operated by:

• The Ethical Agency (Pty) Ltd, a company incorporated in the Republic of South Africa (registration number 2019/495067/07, registered address Spaces, Dock Road Junction, Corner Stanley & Dock, V&A Waterfront, Cape Town, South Africa, 8001). This entity is the data controller for all personal data processed by the Platform.
• The Ethical Agency Ltd, a company incorporated in England and Wales (company number 16093694, registered address First Floor Office, 3 Hornton Place, London, W8 4LZ). This entity has two distinct data-protection roles:
  • Data processor for payment-rail data processed on behalf of The Ethical Agency (Pty) Ltd (the controller), under a written Data Processing Agreement. This is the entity’s role for platform billing operations.
  • Independent data controller for statutory tax and accounting records that UK law (HMRC, the Value Added Tax Act 1994, and the Companies Act 2006) requires the entity to maintain. This processing relies on a separate lawful basis – Article 6(1)(c) UK GDPR (legal obligation) – and is siloed from the SA controller’s marketing and platform processing. The two roles do not overlap and the data flows are separate.

How Data Flows Between the Two Entities

Card-payment transactions and billing data are received by The Ethical Agency Ltd (UK) as the merchant of record via Stripe. A subset of transaction metadata – customer name, billing country, plan, amount, currency, invoice reference, subscription identifier (excluding raw card data, which is held only by Stripe in tokenised form) – is made available to The Ethical Agency (Pty) Ltd (SA) as the data controller for the purposes of consolidated financial reporting, VAT and corporate tax compliance, customer support, and audit. This data flow is governed by the same internal DPA referenced above and uses the UK International Data Transfer Addendum (UK Addendum to the EU SCCs) for any restricted transfer between the two entities.

References below to “we”, “us”, or “our” mean The Ethical Agency (Pty) Ltd unless context indicates otherwise.

2. How to Contact Us

Information Officer (POPIA) and primary privacy contact:
Brett Jefferson
Email: hello@citableesg.com

You can use this address for any question about how we process your personal data, to exercise the rights described in §11, or to request a copy of this policy in another format.

For UK-specific or EU-specific data-protection enquiries, the same contact applies.

3. The Personal Data We Collect

We collect personal data in five main contexts:

3.1 When You Create an Account or Claim a Profile

3.2 When You List or Claim an Organisation

3.3 When You Make a Payment

Card payment data is processed by The Ethical Agency Ltd (UK) as merchant of record, and by Stripe Payments UK Ltd as payment processor. We never store raw card numbers.

3.4 When You Receive a Claim Invitation (Corpus Seeding Programme)

If your organisation appears in a public ESG dataset (such as the B Lab CC-BY-SA dataset on data.world), we may pre-populate a profile for it on the Platform and send a one-time email invitation to claim that profile.

The lawful basis is Article 6(1)(f) UK GDPR / POPIA §11(1)(f) – legitimate interests of the controller. You can opt out at any time using the unsubscribe link in any email or by emailing hello@citableesg.com.

3.5 When You Visit the Platform

4. Why We Process This Data and on What Lawful Basis

Under UK GDPR / EU GDPR Article 6 and POPIA §11, we rely on the following lawful bases:

5. Who We Share Your Data With

We share data only with the third parties listed below, each of whom processes data on our behalf as a sub-processor. Each is bound by a written data-processing agreement.

The full Technical and Organisational Measures (TOMs) for each integration are documented in the corresponding DPA and are available on request.

We do not sell personal data to anyone. We do not share personal data for advertising-network targeting. We do not share personal data with parties outside this list except where required by law (e.g. response to a valid court order or regulatory request) or with your specific consent.

The current sub-processor list reflects integrations as at the date of this policy. We will update this list in advance of any material change. Subscribers may register for change notifications by emailing hello@citableesg.com.

6. International Data Transfers

Your data may be transferred and processed outside your country of residence – principally between South Africa, the United Kingdom, the European Union, and the United States.

Where your data leaves the UK or EU, we ensure adequate protection by relying on:

• Adequacy decisions issued by the UK Government or the European Commission, where one applies
• UK International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (UK SCCs / UK Addendum) for transfers from the UK
• EU Standard Contractual Clauses for transfers from the EU

For transfers to or from South Africa, we comply with POPIA §72, which permits cross-border transfers of personal information only where:

• the recipient is subject to a law, binding corporate rules, or binding agreement that provides an adequate level of protection that is substantially similar to POPIA, OR
• the data subject consents to the transfer, OR
• the transfer is necessary for the performance of a contract between the data subject and the responsible party (or in the data subject’s interest), OR
• it is necessary for a public-interest reason set out in §72.

For our SA→UK and SA→US transfers, we rely on the substantial-similarity route: the UK GDPR (and Data Protection Act 2018) provides protections substantially similar to POPIA, and the US sub-processors named in §5 are bound by the EU SCCs / UK Addendum + DPAs which establish substantially-similar protections by binding agreement. The Information Officer maintains a written transfer impact assessment for each cross-border flow.

A copy of the relevant transfer mechanism + transfer impact assessment for any specific provider is available on request.

7. How Long We Keep Your Data

If a longer retention period is required by law (e.g. ongoing litigation), we may retain the relevant data for that longer period.

8. How We Keep Your Data Secure

• Encryption in transit (TLS 1.3) and at rest
• Hashed passwords using industry-standard algorithms (we never store raw passwords)
• Card data tokenised by Stripe; raw card numbers are never accessible to us
• Access to production systems restricted to named individuals on the principle of least privilege
• Multi-factor authentication required for production access
• Regular security audits and dependency monitoring
• Sentry-based error monitoring with personal-data scrubbing
• Documented incident-response procedures aligned with UK GDPR Art. 33 (72-hour breach notification) and POPIA §22

If we discover a security breach affecting your personal data, we will notify the relevant supervisory authorities within the legally required timeframes and notify you directly without undue delay where the breach is likely to result in a high risk to your rights and freedoms.

9. Children

The Platform is a B2B service intended for use by adult professionals. It is not directed at children under 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected a child’s data, contact us and we will delete it.

10. Cookies and Similar Technologies

We do not use advertising or tracking cookies. We do not participate in advertising networks.

You can manage your preferences via the cookie banner shown on first visit, or at any time via the “Cookie preferences” link in the footer. See also our Cookie Policy.

11. Your Rights

Under UK GDPR / EU GDPR / POPIA you have the following rights:

• Right of access – request a copy of the personal data we hold about you. Where you make the request by electronic means, we will provide the information in a commonly used electronic format (typically PDF or CSV) unless you ask otherwise. (UK GDPR Art. 15(3))
• Right of rectification – ask us to correct inaccurate or incomplete data
• Right of erasure (“right to be forgotten”) – ask us to delete your personal data, subject to legal retention obligations
• Right of restriction – ask us to stop processing your data temporarily while a query is resolved
• Right of portability – receive your data in a structured, commonly used, machine-readable format (e.g. JSON or CSV)
• Right to object – object to processing based on legitimate interest, including direct marketing and corpus-seeding outreach. For direct-marketing objections under Art. 21(2), we honour the objection without delay
• Right not to be subject to solely automated decision-making with legal or similarly significant effect (UK GDPR Art. 22). Our AI content moderation does not make solely automated decisions – every flag is reviewed by a human before any restriction takes effect, and you can request human review of any moderation outcome
• Right to lodge a complaint with your supervisory authority:
  • South Africa: Information Regulator – inforeg@justice.gov.za / inforegulator.org.za
  • United Kingdom: Information Commissioner’s Office (ICO) – ico.org.uk
  • European Union: the data-protection authority in your member state
  • Canada: Office of the Privacy Commissioner – priv.gc.ca

To exercise any of these rights, email hello@citableesg.com. Under UK GDPR / EU GDPR Art. 12(3), we respond without undue delay and at the latest within one month of receiving the request. Under POPIA we respond as soon as reasonably possible and in any event within the time limits required by §23. Where a request is complex or numerous, the response period may be extended by up to a further two months; we will tell you within the first month if an extension is needed and explain why.

We do not charge for exercising these rights, except where requests are manifestly unfounded, repetitive, or excessive.

12. Changes to This Policy

We may update this policy from time to time. The “Last updated” date at the top reflects the most recent revision. For material changes, we will notify you in advance by email or by a prominent notice on the Platform.

A version history is maintained internally. You may request a previous version by emailing hello@citableesg.com.

13. Specific Notes for Users in Particular Jurisdictions

South African Residents

Our processing is governed by POPIA. The Information Officer is Brett Jefferson, hello@citableesg.com. You have the rights set out in POPIA Chapter 3 in addition to those listed in §11.

EU Residents

Our processing is governed by the GDPR as it applies in your member state, as well as by national implementing legislation. You may also contact your local data-protection authority directly.

UK Residents

Our processing is governed by the UK GDPR and the Data Protection Act 2018. You may also contact the ICO directly.

Canadian Residents

You have rights under PIPEDA and (where applicable) provincial data-protection legislation. CASL governs commercial electronic messages we send you; we comply with CASL §6 and §10(9) including identification, opt-out, and lawful-basis requirements.

US Residents

If you are a California resident, you have rights under the CCPA / CPRA, including the right to know, the right to delete, the right to correct, and the right to opt out of “sale” or “sharing” (we do neither). To exercise these rights, contact hello@citableesg.com.

Related