Privacy notice

Controller and contact

VSME Report is responsible for the personal data processed through this service.

Contact us through the feedback form in the reporting tool.

What we process and why

A report may contain company identifiers, operating data, workforce information and sustainability metrics. We process the report data you submit to generate and validate the files you request. The legal basis is performance of the service at your request. We process optional feedback, contact details and technical error information to support users, protect the service and improve the product based on our legitimate interests.

Browser drafts

Your editable draft is stored in local storage in your browser. It is not uploaded while you fill in the questionnaire. You can clear it from the report overview, or download a portable backup and restore it later. Anyone who can access your browser profile or a downloaded backup may be able to read the draft.

Generated files

Export data is processed to create and validate the requested XBRL, JSON and PDF files. Production exports are returned directly to your browser and are not placed in public object storage or retained by the export service after the request completes.

Reports by email

If you choose to email your report, we send your email address and generated PDF to Resend for delivery. We store your email, company name, report language, request date, delivery status and research follow-up choice for 90 days. Our delivery records do not store the PDF or report answers. Resend processes email content under its service and retention terms. Research follow-ups are optional and require a separate checkbox; you can withdraw permission by contacting us. Requesting a report does not subscribe you to marketing emails.

Feedback and diagnostics

Feedback and automatically reported client errors are stored privately for beta support and product improvement. They are deleted after 90 days. You may include an optional email address for a reply and a rating of the reporting process. A separate, optional checkbox lets you agree to research follow-ups. You can withdraw that permission by contacting us. Avoid putting confidential report data in a feedback message.

Service providers and international transfers

We use infrastructure providers for hosting, report processing, database storage and optional product analytics. They process data only to provide those services under their contractual terms. Some providers may process data outside the European Economic Area; when required, those transfers rely on an adequacy decision or appropriate contractual safeguards. We do not sell report data or use it for advertising.

Cookies and analytics

The anonymous release does not require an account or sign-in cookie. Product analytics are loaded only when the deployment explicitly enables them. Workflow events record fixed categories such as the reporting step, export format and feedback entry point. These events do not include company names, identifiers, report answers, email addresses or feedback messages. The service does not use advertising cookies.

Your rights

Depending on the circumstances, you may request access, correction, deletion, restriction or portability of your personal data, or object to processing based on legitimate interests. You may also complain to your local data-protection authority. Use the contact method above for a request; we may need to verify your identity.