Privacy Policy

Introduction

The ESG Institute Limited ("the Company", "we", "us") protects the personal data entrusted to us and uses it only in accordance with applicable data-protection legislation. This Policy explains how we collect, use, disclose, store and protect personal information across our operations: training and certification, consultancy and research services, accreditation, community management, free online tools, events and awards, and this website. It also sets out the rights available to the people whose data we hold.

Legal Framework

The Company is established in the Isle of Man and is subject to the Data Protection Act 2018 (Isle of Man), which gives effect to the Applied GDPR. Where we process personal data in the European Economic Area or transfer data to the EEA, we comply with the EU GDPR. We also observe relevant sectoral regulations, including the Telecommunications (Security) Act 2021 (IoM) for electronic communications, and any guidance issued by the Isle of Man Information Commissioner. The ESG Institute is registered with the Isle of Man Information Commissioner as a data controller, registration number R857425. The public register is at https://icoregister.powerappsportals.com/

Scope

This Policy applies to all personal data we process about clients, programme participants, certificate holders, members, ambassadors, partners, employees, contractors, suppliers, website visitors, users of our free tools, and any other identifiable individual. It covers processing in any location and by any means, including paper files, electronic systems, portable devices, online tools and community platforms.

Key Definitions

Personal data means any information relating to an identified or identifiable person. Special category data includes information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic or biometric data, health data, and data concerning a person's sex life or sexual orientation. Processing means any operation performed on personal data, such as collection, storage, alteration, disclosure or destruction. A controller decides why and how personal data is processed. A processor handles personal data on a controller's instructions.

Principles of Processing

We process personal data lawfully, fairly and transparently; for specified, explicit and legitimate purposes; only to the extent necessary; accurately; for no longer than necessary; and with appropriate security. These principles guide what we collect and how we handle it.

Lawful Bases

We rely on one or more of the following bases under Article 6 of the Applied GDPR: performance of a contract with the person, or steps taken at their request before a contract; compliance with a legal obligation; legitimate interests pursued by the Company or a third party, balanced against the rights of the individual; consent; protection of vital interests; or a task carried out in the public interest.

We process special category data only where an additional condition in Article 9 applies, such as explicit consent or employment-law obligations. Our services do not require special category data, and we ask you not to enter it into our forms, tools or the Terra assistant.

For marketing, we rely on consent where required. Where a professional relationship exists and the message is relevant to the recipient's role or interests, we rely on legitimate interest. Each section below names the basis for that activity.

Collection and Use of Personal Data

We collect personal data directly from individuals, for example when they register for a course, sign up to a membership plan, join our global network in Circle.so, request information, use one of our free tools, register for an event, nominate for an award, apply for accreditation or certification, apply for employment, or join a mailing list. We also collect data from third parties such as employers, referees, partners and ambassadors, and from publicly available sources.

The data we collect typically includes name, contact details, role, organisation, payment information, course and certificate records, and community profile information. We use it to deliver our services, manage relationships, run the website and community platform, comply with legal duties, improve our offerings and, where permitted, send relevant communications about our programmes, services, partnerships and opportunities. We do not sell personal data.

The table below summarises each service. Sections that follow give detail on the services that need it.

Global Report Library

The Global Report Library lists sustainability and integrated reports published by companies and other organisations. You can search and filter the library without registering. When you ask to open the first report link, we ask for your name and email address.

We collect them to give you access, to keep a record of who has registered, and to protect the library from automated copying. Our basis is our legitimate interest in understanding who uses the library and in protecting the work involved in compiling it.

After you register, your browser holds a temporary access token. We count how many report links the token opens, to detect and stop bulk copying. We do not record which individual reports you open.

The registration form has an optional box, unticked by default. If you tick it, we also send you new reports and updates from The ESG Institute. Our basis for those emails is your consent. You can withdraw it at any time through the unsubscribe link in any email or by writing to the address under Contact Details. Withdrawing consent does not affect your access to the library.

We store registrations in a restricted Google Sheet on our Google Workspace account. The sheet records your name, email, the time of registration, your marketing choice and the version of this notice you accepted.

The report links lead to documents that the publishing organisations host on their own websites. We do not host or control those documents. Once you leave our site, the publisher's own privacy policy applies.

Free Online Tools

We offer free tools: the Sustainability Health Check, the ESG Regulatory Navigator, the Carbon Footprint Calculator and the ESG Reporting Challenge. They work as follows.

• Sustainability Health Check. You answer questions about your organisation's sustainability practice and receive a personalised report. We store your answers and results in a Google Sheet, together with one or more of these details you provide: your name, company name, email address and country. We use them to deliver the report and, where you agree, to follow up with relevant information.
• ESG Regulatory Navigator. You choose jurisdictions and topics to find reporting, due-diligence and anti-greenwashing rules. We store the selections you make, together with one or more of these details you provide: your name, company name, email address and country. We use them to improve the tool and, where you agree, to follow up with relevant information.
• Carbon Footprint Calculator. You enter activity data to estimate emissions and can download your result as a PDF. We store one or more of these details you provide: your name, company name, email address and country.
• ESG Reporting Challenge. The simulation runs in your browser. We do not collect or store your decisions or scores. The page loads fonts from Google Fonts, which receives your IP address for that purpose.

Please do not enter personal data about other people into these tools. The results are educational and are not legal, compliance or investment advice.

Terra, Our AI Assistant

Terra is an AI assistant on our website that answers questions about our programmes and tools. When you use Terra, the text you type is sent to our service provider on Google Apps Script, which passes it to Anthropic, the provider of the AI model behind Terra, so that a reply can be generated. Anthropic acts as our processor and handles the content under its commercial terms. We keep a log of Terra conversations so we can improve the assistant and deal with complaints, for the period in the retention table.

Terra does not make decisions that produce legal or similarly significant effects about you. Please do not type sensitive personal data, such as health details or identity numbers. Terra may be unavailable or give wrong answers, so check important information with us.

Courses and the Learning Platform

We deliver courses through Teachable. When you enrol, Teachable collects your name, email address, billing details and learning activity, such as progress and assessment results, and shares them with us. Teachable's payment partners process card and other payments. We do not see or store full card numbers. Teachable acts as a processor for course delivery and as a controller for some of its own purposes, described in Teachable's privacy policy. We use your details to deliver the course, support you, issue your certificate and keep the financial records the law requires.

Certificates and Verification

When you complete a programme, we issue a certificate showing your name, the programme, the issue date, any expiry date and a unique code. We record these details in a certificate register held in Google Sheets and Google Drive.

Anyone with the code can check a certificate on our verification page. After a security check, the page shows the holder's name, the programme, the dates and whether the certificate is valid or expired. We publish only those details. We provide this service so employers, clients and regulators can rely on our certificates. Certificate holders who want an entry corrected or removed should write to us, and we will balance the request against the need to keep the register accurate.

Ambassador and Referral Programme

Ambassadors, largely alumni, refer learners and earn commission. We collect the ambassador's name, contact details and referral link activity through Teachable's affiliate tools, and we collect the details of people referred through our referral form: their name, contact details and the programme of interest. We use these details to attribute referrals, pay commission and respond to the person referred. Ambassadors must have the referred person's agreement before sharing their details with us. We store form submissions in a Google Sheet.

Events, International ESG Day and Awards

For events, International ESG Day activities and the Sustainable Future Awards, we collect registrant, nominee, sponsor and partner details, including name, organisation, role, contact details, activity descriptions, nomination content and logos. We use them to run the event, issue participation certificates, assess nominations and announce winners. We publish names, organisations and logos only where the person or organisation agrees. Global Partner sign-ups are paid by subscription through PayPal, which processes the payment and shares confirmation details with us. We store registrations in Google Sheets and uploaded logos in Google Drive.

Accreditation and Certification

When an organisation applies for accreditation or certification, such as Certified Sustainable Business certification, trainer accreditation or training institution accreditation, we collect the applicant's contact details and the supporting documents that show it meets the criteria. These may include the names and qualifications of individual trainers or staff. We use them to assess the application, issue the accreditation or certification and keep a record of the decision. Where we publish a register of certified or accredited bodies, it lists the organisation name and status.

Business Outreach

We contact professionals about our programmes where the programme is relevant to their role. We compile names, job titles, organisations and professional email addresses from public sources, such as company websites and public filings, of directors and senior officers. This is business-to-business marketing and relies on our legitimate interest. We check each address before sending, send in limited volumes, and keep a do-not-contact list so that nobody who objects hears from us again. Every message says who we are, where we found your details, and how to opt out or object. You can object at any time by replying or writing to the address under Contact Details. We do not buy contact lists.

Community Platform (Circle.so) Data Processing

The ESG Institute operates a members community on Circle.so. Circle acts as a data processor on our behalf under a data processing agreement.

When you join our community, you create a profile and account with Circle.so. Circle collects and processes data about your account activity, including login patterns, posts, comments, interactions and engagement. Circle also collects technical data such as device identifiers, browser information, mouse movements, scrolling, keystrokes and other browsing behaviour to improve the platform experience. Circle processes certain profile information you choose to share (name, photo, bio, expertise areas, location). The ESG Institute retains responsibility for how member data is used, but Circle may also process data according to its own terms. For full details of Circle's data handling, please refer to Circle's Privacy Policy at https://circle.so/privacy. If you are located in the European Economic Area, UK or Switzerland, please also review Circle's EU Privacy Policy at https://circle.so/eu-privacy

Member Profile Data and Visibility

The information you include on your profile (photo, bio, expertise, location, social links) is visible to other community members by default, unless you restrict visibility through your privacy settings. You control what information you display on your profile. The ESG Institute does not share member profile information with external parties without your consent, except where required by law.

Direct Messaging and Communication

Members may send private messages to each other within Circle.so. Both the ESG Institute and Circle may receive and process the content of messages you send and receive, including message content and metadata such as when messages were sent or received. The ESG Institute does not routinely access or monitor private messages, but reserves the right to do so if necessary to enforce community guidelines, investigate complaints, or comply with legal obligations. Circle may access messages as part of its platform operations and security practices. Circle retains messages in accordance with its data retention policies. For questions about how Circle handles message data, please refer to Circle's Privacy Policy at https://circle.so/privacy.

Content Moderation and Member Posts

Posts, comments and content shared in the community are subject to our Community Guidelines. The ESG Institute, through designated staff and community volunteers, reviews and moderates content to ensure compliance with these guidelines. Content that violates our guidelines may be removed, flagged or reported. Moderation actions maintain a respectful, professional and safe community environment. Members retain ownership of their content but grant the ESG Institute the right to remove or modify content that breaches community standards.

Networking and Data Connections

Members connect with each other within the community, share expertise, and may exchange contact details or form professional relationships. The ESG Institute facilitates these connections but is not responsible for how members use each other's personal data after they have shared it directly. Members are responsible for respecting one another's data and privacy. Members should resolve any disputes over data use directly between themselves.

Cookies and Analytics on Circle.so

Circle.so uses cookies and analytics tools to collect information about member engagement, including pages visited, features used, time spent in the community and interaction patterns. This data helps the ESG Institute understand how members use the platform and improve the community experience. Analytics data is treated confidentially and is not shared with external parties. You can control cookie preferences through your browser settings or Circle's cookie-management tool.

AI and Automated Features

Circle may offer AI-powered features to help community owners and members create and interact with content. These features are provided through Circle and operate using AI models built by trusted third-party providers. Your personal data may be used to generate responses and enhance your community experience. Your data will not be used to train, fine-tune, or improve external AI models. Providers retain data processed by AI features only for the limited period necessary to provide the feature and monitor for misuse. If you have concerns about AI-powered features, please contact us under Contact Details.

Data Sharing and Disclosure

We share personal data with service providers who perform functions on our behalf. They are bound by confidentiality and data-processing terms. The main ones are:

We also disclose data where the law requires, to protect vital interests, or to establish, exercise or defend legal claims. We do not sell personal data. Where an organisation, such as an employer, enrols you on a programme, we share completion and certificate information with that organisation.

International Transfers

Some of our providers, including Google, Teachable, Circle, Squarespace, Anthropic and PayPal, process data outside the Isle of Man, the UK and the EEA, notably in the United States. We make these transfers only where an adequacy decision exists or appropriate safeguards are in place, such as standard contractual clauses or an equivalent mechanism. You can ask us for details of the safeguards for a particular provider.

Security Measures

We implement technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or destruction. These include encryption, access controls, restricted sheets for registrations and leads, signed or validated requests between our systems, secure email, regular penetration testing, staff training and incident-response procedures. All employees and contractors must follow the Company's Information Security Policy and report any suspected data breach immediately to the DPO. Circle.so maintains its own security measures for data processed on its platform.

Data Retention

We keep personal data only as long as necessary to fulfil the purposes for which we collected it, to meet legal, accounting or reporting requirements, or to protect the Company's legitimate interests. When data is no longer required, we delete or anonymise it securely. The periods below are our working schedule.

Data Subject Rights

Under the Applied GDPR, individuals have the right to access their personal data, rectify inaccuracies, erase data in certain circumstances ("the right to be forgotten"), restrict processing, object to processing based on legitimate interests or direct marketing, and obtain data portability. Where we rely on consent, you can withdraw it at any time. We make no decision producing legal or similarly significant effects solely by automated means. Submit requests in writing to the DPO, who will respond within one month, subject to extensions the law permits.

You can object at any time to marketing communications from us, and we will respect your preference promptly. Every marketing email carries an unsubscribe link.

Community members can also manage privacy settings within Circle.so, adjust notification preferences, or request account deletion through their Circle profile settings. For requests about data processed by Circle.so, you may also contact Circle directly at legal@circle.so.

Cookies and Online Tracking

Our website uses essential cookies for core functions and analytics cookies to understand usage. Where we use non-essential cookies, we ask for your consent through a cookie banner. You can change your preferences at any time through your browser settings or the website's cookie-management tool. The Global Report Library stores a temporary access token in your browser so you do not register again on the same device. Circle.so uses cookies as described in its Privacy Policy.

Children

Our programmes and tools are for professionals and are not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, write to us and we will delete it.

Data Breaches

A personal-data breach is any incident that compromises the confidentiality, integrity or availability of personal data. All suspected breaches must be reported to the DPO without delay. Where a breach is likely to result in a risk to individuals' rights and freedoms, the DPO will notify the Isle of Man Information Commissioner within seventy-two hours and, where required, tell affected individuals promptly. This includes breaches affecting data processed on Circle.so. If Circle experiences a breach affecting your information, Circle will notify affected individuals under applicable data protection law and its own procedures. The ESG Institute will coordinate with Circle to ensure appropriate notification to affected members.

Contact Details

Send questions, requests or complaints about this Policy or our data processing to:

Data Protection Officer
The ESG Institute Limited
21 Keeill Pharick Park
Email: team@the-esg-institute.org (Subject: Data Protection Enquiry)

You also have the right to complain to the Information Commissioner, PO Box 69, Douglas, Isle of Man, IM99 1EQ (www.inforights.im) if you believe your data-protection rights have been infringed.

Review

We review this Policy every two years, or sooner if the law or our operations change significantly. We update the date below and, for material changes affecting registrations, the version recorded with each registration.

Latest update: 22 October 2026. Policy version: privacy-2026-10-22.

This Policy is non-contractual and the Company may amend it at its discretion.