Your company and privacy

The General Data Protection Regulation (GDPR) is European legislation that came into force on 25 May 2018. The GDPR is designed to protect the privacy rights of individuals within the European Economic Area (EEA), and imposes strict rules on businesses, organizations, and public authorities that process personal data.

SustainCheck is a company that provides sustainability scores, compliance information, payment information, and risk management solutions to businesses. These services help companies make informed decisions, reduce sustainability and compliance risks, and strengthen their business relationships.

Sustainability, compliance, and payment information is crucial for a healthy and sustainable economy. Without this information, companies cannot properly assess their risks, which could mean that:

• fewer risks are taken, leaving a lot of business potential unused and holding back the economy
• far too much risk is taken instead, leading to bankruptcies, unsustainable practices, or even a crisis
• climate risks and the economy’s impact end up being underestimated

This information enables companies to make balanced decisions, so they can limit risk or generate positive outcomes.

No. Your data and your sustainability or compliance report are purchased by our customers through a secured platform. It is not freely accessible to the public.

Personal data is any information relating to an identified or identifiable natural person. A person is identifiable if they can be identified, directly or indirectly, for example by a name, an identification number, location data, or an online identifier such as a personal IP address.

Sustainability and compliance information is information about companies and their business activities in areas such as the environment, society, good governance, corporate social responsibility, ESG, payment behavior, and compliance. This information is collected, analyzed, and used by companies, financial institutions, investors, and other stakeholders to gain insight into a company's sustainability performance, reliability, and financial health.

Elements of sustainability and compliance information:

• Financial data (annual accounts, creditworthiness score, ...)
• Company profile (company name, legal form, address details, directors, shareholders, ...)
• Sustainability data (for example environmental permits, public energy consumption, certifications, social and governance indicators)
• Payment behavior (information on how consistently a company pays its bills on time)
• Sector and market information: market trends (data on the sector a company operates in), competitive analysis (comparison with other companies in the same industry), and regulatory policy (data on how applicable legislation affects a sector)

If you've set up a company, such as a sole proprietorship, your data will also be included in our database. This is your company data as you registered it with the Crossroads Bank for Enterprises. A sustainability and compliance report is then also created for your company.

Your company also matters in economic transactions. For example, when you apply with an energy provider, connect your phone with a network operator, apply for a loan at a bank, or purchase office supplies, these suppliers are also likely to use sustainability, compliance, or payment information before entering into a business relationship with you. That is why it is important that your company can be found, to avoid any doubts about your business relationship, which can, for example, lead to the best payment terms.

Sustainability, compliance, and risk information is relevant for everyone. Whether you run a sole proprietorship, a public limited company, or a private limited company, this information supports you as an entrepreneur. Informing yourself well about your business partner in advance also limits sustainability, compliance, and financial risk for you, and helps your company grow in a healthy, sustainable way. You can also request a report from us about your business partners. We are happy to help, and can advise you where needed.

SustainCheck develops sustainability scores and provides compliance, payment, and risk information to businesses. To achieve this, we use publicly available scientific research and public data sources, which we cross-reference and enrich into a reliable and transparent sustainability score. SustainCheck does not generate this underlying data itself: we rely on existing sources, whether or not publicly accessible, and on data from contractual business partners.

SustainCheck BV can be reached at:

• Sint-Baafsplein 10, 9000 Ghent, Belgium
• Email: hello@sustaincheck.eu
• For questions about the processing of your personal data: wave@sustaincheck.eu
• Company number: 1025.089.862
• VAT number: BE 1025.089.862

The data comes from public sources such as trade registers (for example the KBO, the NBB, and the Belgian Official Gazette), public registers (insolvency, guardianship and administration, among others), and judicial rulings, as well as from SustainCheck’s contractual business partners. Information on payment behavior and sustainability is provided by SustainCheck’s business partners. SustainCheck uses the same raw data to power all of its sustainability, compliance, and risk management products.

We also process personal data when we receive information from contractual business partners who can rely on consent to share data. You can withdraw your consent at any time at the source. This has no retroactive effect, but once you have withdrawn your consent, we may no longer process your data.

In addition, verifiable information that you, as a data subject, choose to provide, may be used to update your organization’s sustainability and compliance information.

SustainCheck processes a number of data categories in order to process company information. These are listed below on a non-exhaustive basis.

• Data on individuals acting on behalf of a company, for example name, first name, date of birth, place of birth, address, previous addresses, company addresses, email addresses, and phone numbers of the company
• Due diligence information, for example information indicating a possible link to a criminal offense, a politically exposed person (PEP), inclusion on a sanctions list, or negative media coverage linked to a name identical to, or closely resembling, the name of a company director
• Information on the company's debts and payment behavior
• Sustainability data, including environmental, social, and governance indicators, and financial information

Special categories of personal data within the meaning of Article 9 GDPR, such as ethnic origin, health data, or data on political or religious beliefs, are not processed, and are not taken into account when calculating sustainability or risk scores.

The legal basis for processing personal data is legitimate interest, Art. 6(1)(f) GDPR. As a specialist in sustainability, compliance, and risk information, SustainCheck plays an important role in economic transactions: by providing this information, SustainCheck helps its customers assess sustainability, compliance, and financial risk, comply with applicable laws and regulations, including European sustainability legislation such as the CSRD and CS3D, and create new business opportunities.

SustainCheck's purpose is therefore to help organizations make business decisions based on accurate, reliable, and complete sustainability and compliance information. In doing so, SustainCheck contributes to the certainty, transparency, and sustainability of economic transactions. The purpose of this processing is to enable companies to manage their sustainability and financial risk, protect themselves against fraud, know who they are doing business with, comply with legal and regulatory obligations, and gain better insight into organizations, sectors, and markets.

Information is only provided if the relevant contracting party has a legitimate interest in obtaining it, for example in the context of an intended business transaction or sustainability assessment, and provided there is no overriding interest of the data subject. This is confirmed in SustainCheck's General Terms and Conditions, which every customer must accept and also receives during onboarding on the platform.

The recipients of the data are SustainCheck's customers, who need to assess the sustainability, compliance, or creditworthiness of potential customers or partners before entering into a business relationship with them. We also share data with other external partners, including other providers of company and sustainability information or procurement programs.

We pass on data to third parties who process it on our behalf as processors, always under a data processing agreement that takes data protection legislation into account.

We pass on contact details, such as postal addresses and phone numbers, to partners for marketing purposes, as long as you have not objected to the processing of your data for marketing purposes.

The data is stored and hosted on servers within the European Union.

We retain personal data only for as long as necessary to achieve the purposes described above. We may retain data in archived form for research and development, analysis, or audit purposes, and where applicable, for the establishment, exercise, or defense of legal claims. The criteria for determining the retention period include statutory liability periods, agreed contractual provisions, statutory deadlines, and industry standards.

If personal data were to be provided to customers, partners, or processors outside the European Union or the European Economic Area (EEA), meaning so-called third countries, this always happens in compliance with GDPR requirements: to recipients in countries with an adequate level of data protection (Art. 45 GDPR), or to recipients with whom EU standard contractual clauses (Art. 46(2)(c) GDPR) have been concluded, and only after the required Data Transfer Impact Assessments (DTIAs) have been completed.

In accordance with Art. 15 GDPR, you have the right to obtain information about all data we hold about you.

If you discover outdated or incorrect information about yourself, you have the right, in accordance with Art. 16 GDPR, to have it updated and corrected by us at any time. However, if your data comes from a public register such as the KBO or the NBB, you are advised to have the data corrected at the source instead. This is because SustainCheck's databases are updated automatically, so any change SustainCheck makes is overwritten by the information from the register.

Furthermore, in accordance with Art. 17 GDPR, you also have the right to have your personal data erased, provided we do not have an overriding legitimate interest in continuing to process it.

Under the conditions of Art. 18 GDPR, you have the right to restrict the processing of your personal data.

In accordance with Art. 21(1) GDPR, you have the right, on grounds relating to your particular situation, to object at any time to the processing of your personal data.

If you object, we will no longer process your personal data, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms.

In addition, under Art. 21(2) GDPR, you can also object to the use of your data for direct marketing purposes. In that case, we will no longer use your personal data for marketing or advertising purposes.

You can send any requests regarding your rights as a data subject to wave@sustaincheck.eu.

In principle, we do not make automated decisions within the meaning of Art. 22 GDPR about whether to enter into a business relationship, or on what terms. We only support our customers with information to help them make their own decisions. The assessment of a person's or company's sustainability, compliance, and creditworthiness for a specific transaction is carried out exclusively by SustainCheck's customers.

You can file a complaint through the contact details listed under "How can I contact SustainCheck?" above.

You also have the right to contact the Belgian supervisory authority, the Data Protection Authority (Gegevensbeschermingsautoriteit), at Drukpersstraat 35, 1000 Brussels.

You don't have to provide data if we ask for it. However, if you don't provide information, that information will also not be taken into account when determining scores.

The information we provide often includes sustainability and risk assessments, known as scores, where information and assessments are used to estimate a company's sustainability performance, compliance, financial health, and likelihood of default. Scores are based on the information we hold about the company in question.

The following non-exhaustive categories of data may be used for the score:

• data on the size of the organization
• company type and sector
• age of a company
• number of employees
• payment behavior
• accounting information, for example balance sheet, profitability overviews, debts
• sustainability indicators, for example environmental permits, certifications, published sustainability reports
• compliance and sanctions data
• company links
• address-related data
• information collected from SustainCheck's contractual partners