Privacy Policy

Last updated: 20.10.25

Privacy Policy

Downstream ESG (“we”, “our”, “us”) is committed to protecting your privacy and handling your personal information responsibly, transparently, and in accordance with applicable data-protection laws, including the UK General Data Protection Regulation (UK GDPR) and the Privacy and Electronic Communications Regulations (PECR).

Who We Are

Downstream ESG provides ESG consulting and reporting services for businesses seeking to reference recognised sustainability frameworks such as the Global Reporting Initiative (GRI).
Data Controller: Downstream ESG (sole trader – Peter Melhuish)
Contact Email: accounts@downstreamesg.com

What Information We Collect

We may collect and process the following personal data:

• Contact details: name, email address, phone number, company name, and job title.
• Website usage data: IP address, browser type, pages visited, and time spent on site.
• Marketing data: email preferences and engagement (e.g., newsletter opens).
• Cookies and analytics: via Google Analytics and similar tools.

We collect this information when you:

• Complete a contact or consultation form.
• Subscribe to our newsletter or updates.
• Interact with our site, adverts, or social channels.

How We Use Your Information

We use personal data to:

• Respond to enquiries and provide consulting services.
• Send requested materials or newsletters (with consent).
• Manage client relationships and project delivery.
• Improve our website, marketing, and user experience.
• Comply with legal and regulatory requirements.

Lawful Bases for Processing

We rely on one or more of the following lawful bases:

• Consent – for email marketing, cookies, and voluntary opt-ins.
• Contract – to perform services you request.
• Legitimate interests – for analytics, business development, and security.
• Legal obligation – where we must retain records or comply with law.

Marketing and Opt-In Emails

You will only receive marketing emails if you have opted in or have an existing business relationship with us. Data will be managed in accordance with GDPR guidelines.

You can unsubscribe at any time by clicking “unsubscribe” in any email or by contacting accounts@downstreamesg.com.

We never sell or rent your data to third parties.

Cookies and Analytics

We use cookies and similar technologies to understand website traffic and improve performance.

Analytics: We use Google Analytics and related Google Ads cookies to collect aggregated usage data (e.g., page views, device type).
Advertising: In future we may use Google Ads Remarketing to show tailored ads to visitors who have interacted with our site. These cookies enable interest-based advertising but do not identify you personally.

How We Store and Protect Your Data

• Data is stored securely on our enterprise grade CRM file storage, and encrypted cloud services.
• Access is restricted to authorised personnel.
• We retain personal data only as long as necessary to fulfil the purposes outlined above or as required by law.

Sharing of Information

We may share limited data with:

• Service providers supporting our operations (e.g., CRM, email delivery platforms, Google Analytics).
• Professional advisers and regulators when legally required.

All processors operate under appropriate data-processing agreements.

International Transfers

Some of our suppliers (e.g., Zoho Corporation, Microsoft and Google LLC) may store data outside the UK.

Where transfers occur, we rely on adequacy decisions or standard contractual clauses to ensure appropriate protection.

Your Rights

Under the UK GDPR, you have the right to:

• Access the personal data we hold about you.
• Request correction or deletion of your data.
• Withdraw consent at any time (for marketing or cookies).
• Object to processing based on legitimate interests.
• Lodge a complaint with the Information Commissioner’s Office (ICO): www.ico.org.uk.

Requests can be made to accounts@downstreamesg.com.

Data Retention

We keep contact and project data for as long as reasonably necessary to fulfil the purpose it was collected for, normally:

• Marketing data: until you withdraw consent.
• Client records: up to 6 years after project completion (for legal and tax purposes).

Links to Other Sites

Our website may contain links to third-party sites (e.g., LinkedIn, Google, other partners).
We are not responsible for the privacy practices or content of those sites. Please review their privacy policies.

Changes to This Policy

We may update this Privacy Policy from time to time. The updated version will always be posted on this page with a revised “Last updated” date.

Contact

If you have any questions or concerns about how we handle your data, please contact:
accounts@downstreamesg.com