Privacy Policy

    This Privacy Policy explains how Sustainability Measurement Taskforce ("SMT", "we", "us") collects, uses and protects personal data in the context of the VSME Medals program.

    1. Data controller

    Sustainability Measurement Taskforce

    2. Who this Policy covers

    This Policy explains how we collect and use personal data about:

    • visitors to our website(s)
    • individuals at SMEs applying for, or holding, a VSME Medal ("Client SMEs")
    • individuals at accredited partner cabinets who prepare or audit Client SMEs ("Accredited Partners")
    • individuals at institutional, regulatory, and partner organisations we engage with
    • job applicants
    • anyone else who contacts us directly

    It does not separately cover the sustainability content that Client SMEs submit for assessment, except to the extent that content includes personal data.

    3. What data we collect

    Website visitors

    When you browse our website, we may collect: IP address, device and browser information, pages viewed, referring pages, approximate location, and cookie/advertising identifiers.

    Client SMEs (applicants and Medallists)

    When a company applies for, or holds, a VSME Medal, we collect: company identification data (name, legal form, VAT number, registered office, sector, size); the name, work email address, phone number, and job title of the authorised contact person; account credentials and activity logs; documents and evidence submitted for the audit (see "Medal assessment and audit documentation" below); and payment and billing information (see "Payment and billing" below).

    Accredited Partners

    When an organisation is onboarded as an accredited partner, we collect: identification data of the organisation and its contact person (name, professional email address, phone number); accreditation documents (NDA, collaboration agreement, experience references); marketing consent status; and account credentials and activity logs.

    Medal assessment and audit documentation

    Client SMEs submit sustainability information (largely organisation-level ESG data) for evaluation against the VSME standard. This may incidentally include personal data, for example the name and role of the person responsible for an ESG topic, workforce composition figures, or details in supporting documents the SME chooses to upload.

    Payment and billing

    When a medal fee is paid, our payment processor, Stripe, collects payment card or bank details directly; we receive and retain billing name, address, VAT/company number, invoice history, and payment status, but not full card numbers.

    Communications and marketing

    If you contact us, subscribe to updates, or engage with our LinkedIn/advertising content, we collect your name, email address, employer, and the content of your message or engagement.

    4. Purpose and legal basis

    Under Article 6 GDPR, we only process personal data where we have a valid legal basis. For each purpose below, the legal basis is indicated in brackets.

    • Creating and managing platform accounts for Client SMEs and Accredited Partners [performance of a contract, Art. 6(1)(b)].
    • Running the VSME assessment, audit and medal-attribution process, including coordination with Accredited Partners and SMT [performance of a contract, Art. 6(1)(b); legitimate interest in the integrity of the certification scheme, Art. 6(1)(f)].
    • Issuing certificates, QR-coded badges, and public medal/partner registry pages [performance of a contract, Art. 6(1)(b); legitimate interest in public transparency of the certification scheme, Art. 6(1)(f), or consent where the SME opts into a public listing, Art. 6(1)(a)].
    • Processing payments and issuing invoices [performance of a contract, Art. 6(1)(b); legal obligation under Belgian accounting/tax law, Art. 6(1)(c)].
    • Website analytics (e.g. Google Search Console/Analytics) [consent obtained via our cookie banner, Art. 6(1)(a), for anything not strictly necessary; legitimate interest, Art. 6(1)(f), for aggregated, non-intrusive measurement].
    • Advertising and retargeting (e.g. LinkedIn Ads, Google Ads) [consent, Art. 6(1)(a)].
    • Sending newsletters or marketing communications [legitimate interest in keeping existing professional contacts informed about the VSME Medals program, Art. 6(1)(f); see Section 5 for how to opt out at any time under Art. 21].
    • Managing institutional and partnership relationships with contacts at EU institutions, regulators, and partner organisations [legitimate interest in maintaining these professional relationships, Art. 6(1)(f)].
    • Securing our platform and preventing fraud or misuse [legitimate interest, Art. 6(1)(f); legal obligation where applicable, Art. 6(1)(c)].
    • Complying with legal, tax, and regulatory obligations and responding to supervisory authorities [legal obligation, Art. 6(1)(c)].

    Where we rely on legitimate interest, we have weighed our interest against your rights and freedoms and concluded ours does not override yours. You can ask us for details of this balancing test at any time, and you can object to processing based on legitimate interest.

    5. Marketing consent and opt-out

    When registering, partners and candidate companies are informed that their email address will be added to the SMT contact database for operational follow-up and, unless they object, for marketing communications relating to the VSME Medals program.

    Users can opt out of marketing communications at any time by:

    • Unchecking the marketing consent box during registration
    • Clicking the unsubscribe link in any marketing email
    • Contacting us directly at hello@vsme-medals.eu

    Opting out of marketing communications does not affect the operational messages necessary for the management of your VSME Medal file.

    6. Cookies and similar technologies

    Our website uses cookies and similar technologies for essential site functioning, analytics, and advertising (including LinkedIn Insight Tag and Google Ads/Analytics tags). Non-essential cookies are only placed after you give consent through our cookie banner, in line with the Belgian implementation of the ePrivacy Directive (Book XII of the Code of Economic Law) and Article 6(1)(a) GDPR.

    You can withdraw or change your cookie consent at any time through the cookie settings link in the website footer, or through your browser settings.

    7. Sharing of data

    We do not sell personal data. We only share data with the following recipients, where necessary and under appropriate safeguards:

    • Accredited partners: when a company chooses to be accompanied, the partner has access to the data necessary for the accompaniment.
    • Service providers: hosting (Lovable AB), database and authentication services (Supabase via Lovable Cloud), email sending (Resend), contact management (Brevo), and payment processing (Stripe).
    • Competent authorities: when required by law or to defend our rights.

    8. International data transfers

    Some of our service providers (see Section 7) are based outside the European Economic Area, in particular in the United States. Where personal data is transferred outside the EEA, we rely on an adequacy decision (such as the EU-U.S. Data Privacy Framework, where the recipient is certified), the European Commission's Standard Contractual Clauses, or another safeguard recognised under the GDPR.

    9. Data retention

    We keep personal data only as long as necessary for the purposes described above, and in any event no longer than:

    • Account data: for the duration of the platform relationship, plus 5 years afterwards to handle any residual queries or disputes.
    • Medal certification and audit records: for the validity period of the medal, plus 5 years afterwards for evidentiary and appeal purposes.
    • Invoices and accounting records: 7 years, as required by Belgian accounting and tax law.
    • Marketing/newsletter data: until you unsubscribe or withdraw consent, plus a short period to record that you did.
    • Cookies and analytics identifiers: no longer than 13 months, renewed only if you give consent again.
    • Website and security logs: 12 months.

    10. Data security

    We implement appropriate technical and organisational measures to protect personal data against accidental loss, destruction, alteration, unauthorised disclosure or access. Access to data is restricted to authorised personnel and service providers bound by confidentiality obligations.

    11. Your rights

    In accordance with the General Data Protection Regulation (GDPR), you have the following rights regarding your personal data:

    • Right of access to your personal data
    • Right to rectification of inaccurate data
    • Right to erasure ("right to be forgotten")
    • Right to restriction of processing
    • Right to data portability
    • Right to object to processing, including marketing
    • Right to withdraw consent at any time
    • Right to lodge a complaint with a supervisory authority — in Belgium, the Autorité de protection des données / Gegevensbeschermingsautoriteit (Rue de la Presse 35, 1000 Brussels; contact@apd-gba.be; www.autoriteprotectiondonnees.be), or the supervisory authority of your own country of residence or work

    To exercise these rights or for any question about the processing of your data, please contact us at hello@vsme-medals.eu. We will respond within one month of receiving your request.

    12. Children

    Our platform is intended for use by professionals acting on behalf of businesses. It is not directed at, and we do not knowingly collect personal data from, individuals under the age of 16.

    13. Changes to this Policy

    This Privacy Policy may be updated from time to time to reflect changes in our practices or legal requirements. The applicable version is the one published on the date of consultation.

    Last updated: 25 August 2026

    14. How to contact us

    For any question about this Policy or how we handle personal data, contact us at hello@vsme-medals.eu, or by post at Rue Américaine 84/RC, 1050 Ixelles, Belgium.