Privacy Policy

1. Personal Information We Collect

When you interact with our Website, we may collect personal information that you voluntarily provide to us, such as when you submit a contact form, request a demo, enquire about our services, subscribe to updates, participate in an event or webinar, or otherwise communicate with us. This may include your name, email address, phone number, company name, job title, department, and any other information you choose to provide.

If you register for, attend, or participate in our events, demonstrations, or webinars, we may collect additional information such as your professional details, organization, location, interests, and communication preferences.

In addition, certain information may be collected automatically through your browser or device when you access our Website. This may include your IP address, browser type, device details, operating system, pages visited, time spent on the Website, and information collected through cookies and similar technologies. These technologies may help us understand how our Website is used, improve performance, and enhance the user experience. You may manage cookies through your browser settings; however, disabling certain cookies may affect Website functionality.

When organizations use SustainStep, information submitted to the platform may include ESG data, environmental performance records, greenhouse gas emissions, energy consumption, water usage, waste management information, workforce and social data, governance disclosures, supplier and customer details, value-chain information, invoices, utility bills, spreadsheets, and supporting documents. Such information may contain personal information depending on the content uploaded by the customer or its authorized users.

We may also receive professional or business contact information from publicly available sources or authorized third-party sources to support legitimate business communications and understand the needs of prospective customers, subject to applicable law.

2. How We Use Your Information

We use the personal information collected through our Website and business interactions for the purposes for which it was provided and for other lawful business purposes. These purposes may include responding to enquiries, arranging product demonstrations, providing information about SustainStep, communicating with prospective and existing customers, managing event participation, and improving our Website and Services.

We may use information to understand user preferences, evaluate Website performance, analyse visitor interactions, troubleshoot technical issues, maintain system security, and improve our products and services.

Within SustainStep, information may be processed to support ESG data collection, organization, validation, dashboards, calculations, and reporting workflows. Depending on the features used, this may include assisting with reporting aligned with frameworks such as BRSR, GRI, CDP, and other supported ESG reporting requirements.

Where available, automated or AI-assisted features may process uploaded documents, invoices, utility bills, spreadsheets, and other records to extract or organize relevant information. Such outputs may require review and verification by authorized users before being relied upon.

Where permitted by law, we may also use business contact information to send product updates, service announcements, event invitations, and relevant marketing communications. You may opt out of marketing communications at any time.

We will not use personal information for purposes incompatible with those described in this Privacy Policy unless you have provided the necessary consent or the processing is otherwise permitted by applicable law.

3. Sharing of Personal Information

Sithafal Technologies does not sell or rent personal information to third parties for their independent marketing purposes.

We may share personal information with authorized service providers who assist us in operating, hosting, maintaining, securing, or improving our Website and Services. Such providers may support technical infrastructure, communications, analytics, customer support, document processing, or AI-assisted functionality. Where required, appropriate contractual and security measures will be used to protect information.

For SustainStep customers, information submitted to an organization's platform account may be accessible to that organization's authorized administrators, employees, or other users according to the permissions and roles configured by the organization.

Where customers use SustainStep to collect ESG information from suppliers, customers, or other value-chain partners, relevant information may be shared with the requesting organization and its authorized users for ESG management, assessment, and reporting purposes.

We may disclose personal information at your direction, with your consent, or where authorized by the relevant organization and permitted by applicable law.

We may also disclose information when required by law, legal process, regulatory request, or competent authority, or where reasonably necessary to protect our rights, security, property, or the rights and safety of others.

If Sithafal Technologies undergoes a merger, acquisition, restructuring, financing, or similar business transaction, relevant information may be transferred as part of that transaction, subject to applicable legal requirements and appropriate safeguards.

4. International Transfers

Sithafal Technologies is based in India. Depending on the hosting infrastructure, technology services, and service providers used to operate our Website and Services, personal information may be processed or stored in India or other countries.

Where personal information is transferred across borders, we will take steps required by applicable data protection laws and relevant contractual arrangements to ensure that such transfers are handled appropriately.

For individuals located in the European Union, United Kingdom, European Economic Area, or other jurisdictions with specific privacy requirements, applicable rights and obligations will depend on the relevant law and the circumstances of processing.

Where required, we will rely on legally recognized transfer mechanisms or other appropriate safeguards for international transfers. Any applicable customer agreement or Data Processing Agreement may provide additional information about data transfers associated with the SustainStep platform.

5. Data Retention

We retain personal information only for as long as reasonably necessary to fulfil the purposes for which it was collected, provide our Services, respond to enquiries, maintain business records, comply with legal or regulatory obligations, resolve disputes, and enforce our agreements.

Information submitted through our Website may be retained for a reasonable period to support follow-up communications and business operations, unless deletion is requested or a longer retention period is required or permitted by law.

For SustainStep platform customers, the retention and deletion of ESG data, uploaded documents, account information, and related records may be governed by the applicable customer agreement or Data Processing Agreement.

We may retain certain information for longer periods where necessary for legal compliance, security, audit, fraud prevention, dispute resolution, or other legitimate and lawful purposes. When information is no longer required, we will take appropriate steps to delete, anonymize, or securely dispose of it, subject to applicable obligations and backup or archival processes.

6. Your Rights

Depending on the laws applicable to your jurisdiction, you may have rights concerning your personal information, including the right to request access to information, correction of inaccurate or incomplete information, deletion where applicable, withdrawal of consent, or the ability to raise a grievance regarding its processing.

Additional rights may be available under certain privacy laws, including rights to object to or restrict certain processing activities, request data portability, or lodge a complaint with a relevant data protection authority.

If your personal information is processed through a SustainStep account managed by your employer or another organization, you may need to contact that organization first. We will assist with privacy requests as appropriate to our role and applicable legal obligations.

To submit a privacy request or raise a concern, you may contact us using the details provided in the Contact Information section below. We may take reasonable steps to verify your identity or authority before responding.

We will handle valid requests and grievances in accordance with the timelines and requirements prescribed by applicable law. Where required, we will provide information about the status or outcome of a request.

If you unsubscribe from marketing communications, we may retain limited information necessary to record and respect your communication preferences.

7. Security

We take reasonable steps to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure. Depending on the nature of the information and the Services involved, these measures may include access restrictions, user permissions, authentication mechanisms, and appropriate technical and organizational safeguards.

Although we work to protect information, no method of transmission over the internet or electronic storage is completely secure. We therefore cannot guarantee absolute security.

Where access to restricted areas of the Website or SustainStep platform is provided, users are responsible for maintaining the confidentiality of their login credentials and promptly reporting suspected unauthorized access or security incidents.

Users should exercise caution when sharing confidential information and should not upload personal or sensitive information unless they are authorized to do so and the information is relevant to the intended purpose.

If you receive an unsolicited or suspicious communication claiming to originate from Sithafal Technologies or SustainStep, please verify its authenticity before sharing information or clicking links.

8. Links to External Websites

Our Website may contain links to third-party websites, applications, or services. We are not responsible for the privacy practices, content, security, or data handling practices of external websites that we do not control.

Third-party websites may use their own cookies, pixels, analytics tools, or other tracking technologies. Such activities are governed by the privacy policies and terms of the respective third parties and are not controlled by this Privacy Policy.

We encourage you to review the privacy policies of third-party websites before providing personal information or using their services. Accessing external websites is at your own discretion and subject to their applicable terms.

9. Children’s Privacy

Our Website and Services are intended primarily for business and professional use and are not directed toward children.

We do not knowingly seek to collect personal information from children in circumstances where such collection is prohibited by applicable law. If you believe that a child has provided personal information through our Website in violation of applicable requirements, please contact us so that we can review the matter and take appropriate action.

Where we become aware that personal information has been collected inappropriately from a child, we will take reasonable steps to address the situation in accordance with applicable law.

10. SaaS Platform Users

Please note that this Privacy Policy primarily describes our Website and related business interactions. For organizations using the SustainStep SaaS platform, the processing of customer data may also be governed by a separate Data Processing Agreement (DPA), subscription agreement, or other applicable customer contract.

Depending on the circumstances and applicable law, Sithafal Technologies may act as a data processor or equivalent service provider when processing customer data on behalf of an organization. In such cases, we will process the relevant data in accordance with applicable contractual obligations and lawful instructions from the customer.

The SustainStep platform may enable customers to collect and manage ESG information, including environmental, social, governance, emissions, water, waste, workforce, supplier, customer, and other value-chain data. Customers are responsible for ensuring that they have the necessary authority and lawful basis to provide personal information through the platform.

Certain platform features may use automated or AI-assisted processes to extract, organize, or analyse information from uploaded documents. Users should review the resulting information for accuracy and completeness before using it in reports or disclosures.

Access to the platform may require user authentication. Users are responsible for maintaining the confidentiality of their credentials and promptly notifying their organization or the appropriate support contact if they suspect unauthorized access.

11. Contact Information

If you have any questions about this Privacy Policy, wish to exercise your data rights, or want to raise a privacy-related concern, you may contact us using the details below.

You may contact us at the above email address for privacy-related enquiries and requests. We will review such enquiries and respond in accordance with applicable legal requirements.

Individuals may also have the right to lodge a complaint with a relevant data protection authority, where such a right is provided under applicable law.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our business practices, technology, Website, Services, or applicable legal requirements. When we update this Policy, we will revise the Effective Date at the top of this page.

For material changes, we may provide additional notice through our Website or other appropriate communication channels where required by applicable law.

We encourage you to review this Privacy Policy periodically to remain informed about how we collect, use, disclose, and protect personal information.