Privacy Policy

1. Who we are and our role

Greenio is operated by Clasio UK Ltd, registered in England and Wales (company number 14759860).

For UK GDPR and EU GDPR purposes, Greenio is the Data Controller. For India's DPDPA 2023, Greenio is the Data Fiduciary. Where you use the Supplier Emissions feature, Greenio acts as a Data Processor on your behalf in respect of personal data in supplier submissions.

2. Data we collect

We do not collect payment card details directly. We do not sell your data. We do not use your data to train AI models without explicit consent.

3. How we use your data

• Providing, maintaining, and improving the Greenio platform
• Generating carbon accounting reports and regulatory filings (BRSR, SECR, CSRD, CCTS MRV Reports) on your behalf
• Processing supplier emissions requests and managing Scope 3 data collection
• Sending service communications, billing receipts, and supplier request emails
• Sending automated reminders for outstanding supplier data requests
• Anonymised benchmarking - no individual data shared
• Complying with legal obligations and preventing fraud

4. Legal basis for processing

• Contract performance: delivering the service you subscribed to
• Consent: optional communications; withdraw at any time
• Legitimate interests: platform security, fraud prevention, anonymised analytics
• Legal obligation: where required by applicable law

5. Data storage and security

Your data is stored on Supabase (PostgreSQL) servers in the European Union (eu-west region). Application hosting is via Vercel. Supplier-uploaded files are stored in a private Supabase Storage bucket accessible only via time-limited signed URLs.

We use TLS encryption in transit, AES-256 at rest, row-level security for data isolation, and role-based access controls. In the event of a breach likely to risk your rights, we will notify you and the relevant authority within 72 hours (UK/EU GDPR) or as required by applicable law.

6. International data transfers

• UK ↔ EU: Covered by mutual adequacy decisions between the UK and EU
• UK/EU → India: Transfers made under Standard Contractual Clauses or equivalent safeguards
• Supabase and Vercel: Both have executed Data Processing Agreements covering international transfers

7. Data sharing

We share data only with: Supabase (database and storage), Vercel (hosting), payment processors (billing only), professional advisors (confidentiality bound), regulatory authorities (where required by law - BEE, MoEFCC, SEBI, ICO, national DPAs), and suppliers (your organisation name and contact when you send a request).

All sub-processors are bound by data processing agreements.

8. Supplier data handling

Supplier contacts receive your organisation name and a tokenised link. Supplier submissions are stored securely and accessible only to your organisation. Supplier contacts may contact hello@greenio.co to query data usage. UK/EU supplier contacts retain full GDPR rights in respect of personal data in their submissions.

9. Data retention

We retain account and emissions data for as long as your account is active, plus 7 years after closure (statutory record-keeping requirements). Upon closure, data is available for export for 30 days before deletion.

10. Your rights (universal)

• Access: request a copy of your personal data
• Correction: request correction of inaccurate data
• Erasure: request deletion, subject to legal retention
• Data portability: CSV export available directly in the platform
• Withdraw consent: at any time without affecting prior processing

Email hello@greenio.co to exercise any right. We respond within 30 days.

11. Cookies

We use only essential session cookies required for authentication. No advertising cookies, cross-site tracking, or third-party analytics cookies. No cookie consent banner is required as we only use strictly necessary cookies.

12. Changes to this policy

Material changes will be notified by email or in-platform notice at least 14 days before taking effect. Continued use constitutes acceptance.

13. Contact