Privacy notice

The short version

• The EcoMetrics platform and its data are hosted in the EU, in Frankfurt.
• We collect what we need to run your account and to email you about it. We don't sell personal data and we don't run advertising trackers.
• The website uses Google Analytics only if you accept it in the cookie banner. If you don't, it sets no cookies at all.
• Product news and our newsletter are sent only if you ask for them, and you can stop them with one click.
• The ESG and HR data your organisation puts into the platform belongs to your organisation. We process it on its instructions, under a separate data processing agreement.

1. Who we are

EcoMetrics BiH ("EcoMetrics", "we"), Maglajska 1, 71000 Sarajevo, Bosnia and Herzegovina. EcoMetrics BiH is not yet a registered company. Until it is, its founders are responsible for the personal data described in this notice, and Lejla Nezirović is the contact for it. We will update this section with the company's registered details once it is registered.

Privacy questions and requests: hello@ecometricsbih.com.

We are established outside the EU and offer our services to people in the EU. We have not yet appointed a representative in the EU under Article 27 GDPR, or a data protection officer. Until we do, please write to us directly at the address above. We will name both here once they are in place.

2. What this notice covers, and what it doesn't

This notice covers personal data we decide about ourselves: visitors to ecometricsbih.com, people who hold an account on app.ecometricsbih.com, people who receive our emails, and people who write to us.

It does not cover the data an organisation uploads to the platform: its ESG figures, documents, and any data about its employees. For that data the organisation is the controller and we are its processor, acting only on its instructions under our data processing agreement. If you are an employee and want to know what your employer holds about you, or to exercise your rights over it, contact your employer. If you contact us, we will pass your request on to them.

3. What we collect, why, and for how long

Visiting the website

Our web host keeps standard server logs of each request: IP address, date and time, the page requested, the referring page and your browser's user-agent string. They are used to deliver the site and keep it secure.

Legal basis: our legitimate interest in operating a secure website (Art. 6(1)(f) GDPR). Our host, IONOS, anonymises the IP addresses in these logs. Kept for: at most 8 weeks.

Analytics, only if you accept. When you first visit, a banner asks whether we may use Google Analytics. Until you click Accept, nothing from Google is loaded. If you accept, Google Analytics sets cookies and records which pages you view, how you arrived (for example from a search or one of our emails), your approximate location (country or city), and your device and browser type. We use this only to see which pages are useful. Google signals and advertising features are switched off, so it is not used to show you ads.

Legal basis: your consent (Art. 6(1)(a) GDPR, and the ePrivacy rules on cookies). Change your mind at any time with Cookie settings at the bottom of every page. Declining deletes the analytics cookies. Kept for: cookies 13 months; analytics data in Google Analytics 2 months.

We don't use any advertising tools. The site also remembers your light/dark choice, language and cookie choice in your browser's local storage (see section 8). That never leaves your device.

Writing to us

If you email us, we receive your address, your name if you give it, and whatever you write. We use it to answer you.

Legal basis: steps you asked us to take before a contract (Art. 6(1)(b)), or our legitimate interest in answering enquiries (Art. 6(1)(f)). Kept for: as long as the conversation is active, then 24 months, unless it becomes part of a customer relationship.

Your EcoMetrics account

When you create an account we collect your email address, your organisation's name and country, your language, and whether you agreed to receive product news. You can add a display name later. Your password is handled by our identity service (Amazon Cognito) and stored only in hashed form. We never see it. We also record your role in your organisation and an audit trail of significant actions taken in the account.

Legal basis: performing our contract with you (Art. 6(1)(b)). The audit trail is also our legitimate interest in security and accountability (Art. 6(1)(f)). Kept for: while the account exists. When an account is closed, we delete it within 30 days, apart from records we must keep by law (for example invoices) and backups, which expire within 14 days.

Security and operations

When you use the app, our infrastructure records your IP address and request details in access and application logs. We use them to protect the service against abuse (for example rate limiting and blocking attacks) and to fix faults.

Legal basis: our legitimate interest in a secure, working service (Art. 6(1)(f)). Kept for: 90 days.

Emails about your account

After you sign up we send a short series of emails that help you get started: a welcome, reminders if you haven't uploaded or approved anything yet, and a request for feedback. To send the right one, our email service knows your email address, organisation name, country, language and plan, and the dates of your first upload, first approved figure and first CBAM good. It never receives your ESG figures or documents.

Legal basis: our legitimate interest in helping customers use the service they signed up for (Art. 6(1)(f)). Every one of these emails has an unsubscribe link, and using it stops them. Essential messages about your account (for example security or billing notices) are sent regardless, as part of the contract. Kept for: while the account exists.

Product news, the newsletter and our CBAM guide

We send product news and our monthly newsletter only to people who asked for them: by ticking the box when signing up, by turning it on in Settings → Email preferences, or by subscribing on this website. Website sign-ups are confirmed by email (double opt-in) before anything is sent. If you request our CBAM guide, we send it with three follow-up emails about CBAM over two weeks.

Legal basis: your consent (Art. 6(1)(a)). You can withdraw it at any time, with the link in every email or the switch in Settings. Withdrawing doesn't affect what was sent before. Kept for: until you withdraw. After that we keep only your email address on a suppression list, so that we never email you by mistake again. We also keep a record of when and how you gave consent, for as long as we need to be able to prove it.

Our email service records whether our emails are opened and which links are clicked, so we can tell which topics are useful and stop sending what isn't. We don't use this for advertising, and we don't share it.

Payments

Paid plans are sold through Paddle, which acts as our reseller (Merchant of Record). Paddle collects your payment details, handles tax and issues the invoice, as an independent controller under its own privacy notice. We never receive card details. Paddle tells us your subscription status, plan and billing email so we can switch your plan on. Paddle's checkout is loaded only when you start a payment.

Legal basis: performing our contract (Art. 6(1)(b)) and our legal obligations to keep financial records (Art. 6(1)(c)). Kept for: as long as accounting and tax law requires.

AI features

Reading uploaded documents and answering questions in the AI Copilot use Anthropic's Claude models through Amazon Bedrock, inside AWS's EU regions. Under AWS's terms, the content sent is not used to train models and is not shared with the model provider. That content is customer data (section 2), processed under our data processing agreement.

4. Who handles data for us

We use a small number of providers. Each processes personal data only on our instructions and under a data processing agreement, except where stated.

We may also disclose data where the law requires it, for example to a court or authority with the power to demand it. We do not sell personal data, and we do not share it for advertising.

5. Transfers outside the EU

Data is stored in the EU. Our team works from Bosnia and Herzegovina and accesses it from there to run the service and support you. Bosnia and Herzegovina does not currently have an EU adequacy decision. We limit that access to what is needed to operate and support the service: it is encrypted, restricted to the people who run the platform, and the data itself stays in the EU. We are working on putting formal transfer safeguards in place and will describe them here when we have. Transfers by the providers above rely on the mechanisms listed in section 4.

6. How we protect it

All traffic is encrypted in transit. Data at rest is encrypted with keys held in AWS Key Management Service, and the most sensitive HR data that customers may store uses separate keys of its own. Each organisation's data is isolated at the database level, so one customer's account cannot read another's. Access to production systems is limited to the people who run them, and significant actions are recorded in an audit log.

7. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and get a copy;
• have it corrected if it is wrong;
• have it deleted, where we no longer have a reason to keep it;
• restrict how we use it while a question about it is resolved;
• receive it in a portable, machine-readable form;
• object to processing based on our legitimate interests, and to direct marketing at any time;
• withdraw consent at any time, as easily as you gave it.

Email hello@ecometricsbih.com. We answer within one month, and tell you if we need longer and why. We may ask you to confirm your identity first, so that we don't hand your data to someone else.

You can also complain to a data protection authority, in particular in the EU country where you live, work, or where you think the problem happened. In Bosnia and Herzegovina, the authority is the Personal Data Protection Agency in Bosnia and Herzegovina (Agencija za zaštitu ličnih/osobnih podataka u Bosni i Hercegovini). We'd appreciate the chance to sort it out with you first.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

8. Cookies and local storage

This website sets cookies only if you accept analytics. In that case Google Analytics sets _ga and _ga_1R00WNWGJX, which tell visits apart and expire after 13 months. Choosing Decline, now or later under Cookie settings, deletes them.

Without cookies, the site stores three preferences in your browser's local storage: your light/dark theme (ecometrics_site_theme), your language (ecometrics_site_lang) and your analytics choice (ecometrics_analytics_consent). They stay on your device and you can clear them in your browser settings.

The app stores your sign-in session (esg_token) in local storage, without which you could not stay signed in, plus display preferences such as language, theme and currency. None of these are used to track you. Paddle's checkout, loaded only when you start a payment, may set its own cookies to process the payment securely; see Paddle's notice.

9. Children

EcoMetrics is a business service and is not meant for anyone under 16.

10. Changes to this notice

If we change how we handle personal data, we will update this page and its effective date. If a change matters to you as an account holder, we will tell you by email before it applies.