Privacy policy
Last updated 9 October 2026
This policy explains what personal information ESGListings collects, why, how long we keep it, and your rights. We collect as little as we can and we don’t sell personal information or use advertising trackers.
Who we are
ESGListings is run by ESG Listings, Grand Southern Trunk Road, Chrompet, Chennai - 600044, India. We are the controller of the personal information described here. Contact us about privacy at list@esglistings.com.
What we collect and why
| Who | What we collect | Why | How long we keep it |
|---|---|---|---|
| Everyone who visits | IP address and basic request details; a session cookie (see our cookie notice) | To run the site securely, keep you signed in, and stop abuse (rate limits and bot checks) | Rate-limit records: 1 day. Server logs: as set by our hosting provider |
| People who contact a provider | Name, work email, company and phone (optional), your message, IP address | To send your enquiry to the provider you chose and to stop spam | 24 months, then deleted |
| Reviewers | Name, work email, job title, role, company size, industry, company name (optional), your ratings and review, IP address | To confirm you’re a real person, check the review follows our guidelines, and publish it | Published reviews: while the listing exists, unless you ask us to remove yours. Rejected reviews: 12 months |
| Companies with an account | Name, work email, password (stored only as a secure hash), listing details, logo and screenshots | To create and manage your listing, send you enquiries and service emails | While your account is open. Rejected listings: 12 months |
| Companies that buy Sponsored | Plan, payment amounts and dates, Razorpay payment and subscription references. Card, UPI and bank details go to Razorpay, not to us | To provide the plan you bought, keep accounts and meet tax law | 8 years after the payment, as tax law requires |
| Buyers who use “Get matched” | Name, work email, company and job title (optional), what you’re looking for, your note, IP address | To send you a shortlist and, only if you tick the box, share your request with the providers matched | 24 months, then deleted |
| People who sign up for deadline reminders | Email address and the regions you chose | To email you before ESG reporting deadlines. Unconfirmed sign-ups are deleted after 30 days | Until you unsubscribe (one click in every email) |
| Companies we invite to claim a listing | The business email address we sent the invitation to, and whether the link was used | To invite the company to manage its own listing (our legitimate interest in keeping listings accurate). Every invitation has a one-click opt-out | 24 months; opt-outs are kept so we don’t contact you again |
| People claiming a listing | Name, work email, job title, your message | To check you can manage the listing | 24 months after the claim is decided |
| Anyone who receives a code | Email address and a one-time code (stored only as a secure hash) | To confirm you control the email address | 30 days |
Statistics. We count page views, profile views, website clicks and searches as daily totals so we and listed companies can see what’s useful. We don’t use cookies or store IP addresses for this, and we don’t build profiles of visitors. Search terms are kept for 12 months.
We show reviewers’ names the way they choose (full name, first name and initial, or “Verified reviewer”). We never show reviewers’ email addresses or company names. The “Which rules apply?” checker doesn’t store your answers; they stay in the page address in your browser.
Company listings. We list companies using business information they publish themselves, such as their website. If you represent a listed company, you can claim and correct the listing, or ask us to remove it.
Our legal reasons
Where data protection laws such as the GDPR or UK GDPR apply, we rely on: performing our service for you (accounts, enquiries, reviews you choose to write); our legitimate interests in running a trustworthy directory, keeping reviews genuine and preventing spam and fraud; your consent for optional Google Analytics cookies, which you can withdraw at any time; and legal obligations where they apply.
Who we share it with
- The provider you contact. Your enquiry goes to that company only.
- Our hosting provider, which runs our servers and sends our emails, located in the United States (Austin, Texas).
- Razorpay, which processes payments for Sponsored plans. When you pay, you give your payment details to Razorpay directly, under Razorpay’s privacy policy.
- Google, which runs Google Analytics for us, only if you accept analytics cookies. It tells us how the site is used (pages visited, rough location, device type). See our cookie notice.
- Cloudflare, which runs the Turnstile bot check on some forms and processes technical information such as your IP address to tell people from bots.
- Authorities, if the law requires it.
We don’t sell personal information and we don’t share it with advertisers.
We are based in India and our servers are in the United States (Austin, Texas), so your information is processed in those countries, which may not be where you live. Where data protection laws require it, we use the safeguards those laws allow for moving information between countries, such as standard contractual clauses.
Your rights
You can ask us to show you, correct, export or delete the personal information we hold about you, or object to how we use it. Email list@esglistings.com and we’ll reply within one month. You can also complain to your data protection authority, for example the ICO in the UK or your local authority in the EU.
Security
We use HTTPS throughout, store passwords and codes only as secure hashes, limit repeated attempts, and restrict admin access.
Children
This site is for businesses and professionals. It isn’t meant for anyone under 18.
Changes
If we change this policy we’ll update the date above, and tell account holders by email about important changes.