Privacy Policy
How we collect, use, process, and protect your personal data across the STEP ESG Marketplace.
1. Overview & Data Controller
This Privacy Policy explains how the STEP ESG & Green Building Tech Marketplace("STEP," "we," "us," or "our"), operated by HAUTE INNOVA, collects, uses, shares, and protects personal data when you visit or use the Platform and its related services.
By using the STEP Marketplace, you agree to the collection and use of information in accordance with this policy. This policy applies to all users, including technology providers, enterprise buyers, and general visitors.
Data Controller
HAUTE INNOVA
Website: STEP Marketplace
For privacy inquiries: contact@hauteinnova.com
2. Information We Collect
We collect personal data through the following channels and interactions on the Platform:
Account & Profile Data
Name, email address, company name, job title, website URL, phone number, and profile photo when you register for an account or submit a technology listing.
Tool & Technology Submissions
Product descriptions, logos, screenshots, brochures, YouTube demo videos, pricing information, ESG certifications, sustainability metrics, and all metadata associated with tool listings submitted by Technology Providers.
Communication Data
Messages exchanged through the Contact Provider feature, Challenge submissions and responses, contact form inquiries, and newsletter subscription data.
Browsing & Usage Data
IP address, browser type, device information, pages visited, search queries, filter selections, AI ESG Advisor interactions, timestamps, and referral URLs collected automatically through cookies and server logs.
3. How We Use Your Data
We process your personal data for the following purposes:
- Operating and maintaining the STEP Marketplace, including tool listings, search, filtering, and the AI ESG Advisor.
- Processing Technology Provider registrations, tool submissions, and STEP Stars rating applications.
- Facilitating B2B connections between enterprise buyers and technology providers through the Contact Provider and Challenges features.
- Sending transactional communications (submission confirmations, approval/rejection notifications, challenge updates).
- Distributing newsletters and platform updates to subscribed users.
- Improving platform functionality, user experience, and AI recommendation accuracy through anonymized analytics.
- Enforcing our Terms of Use and preventing fraud, abuse, or misuse of the Platform.
- Complying with applicable legal obligations, regulatory requirements, and lawful government requests.
4. Legal Basis for Processing
Depending on the context, we rely on the following legal bases for processing personal data:
| Legal Basis | When Applied |
|---|---|
| Contractual Necessity | Account creation, tool submission processing, B2B communication facilitation |
| Consent | Newsletter subscriptions, non-essential cookies, marketing communications |
| Legitimate Interest | Platform security, fraud prevention, analytics, service improvement |
| Legal Obligation | Tax compliance, regulatory reporting, lawful data retention requirements |
5. Data Sharing & Third Parties
We do not sell your personal data. We may share information with the following categories of recipients:
Service Providers
Supabase (database & authentication), Vercel (hosting), Resend (email services), and other technology partners necessary for platform operations.
Verification Partners
EmiratesGBC and other accredited bodies involved in the STEP Stars certification and ESG verification process, with provider consent.
B2B Contacts
When you use the Contact Provider feature or respond to a Challenge, your contact information is shared with the relevant technology provider or buyer.
Legal & Regulatory
When required by law, regulation, legal process, or enforceable government request.
6. Security & International Transfers
We implement industry-standard security measures to protect your personal data, including:
- TLS/SSL encryption for all data in transit.
- Row-level security policies in our Supabase database ensuring data isolation per user.
- Secure authentication via Supabase Auth with email verification.
- Regular security reviews and access controls for administrative functions.
International Transfers: Your data may be processed in jurisdictions outside the UAE, including the European Union and the United States, where our service providers operate. We ensure appropriate safeguards (such as Standard Contractual Clauses) are in place for any international data transfers.
7. Your Rights & Choices
Depending on your jurisdiction, you may exercise the following rights regarding your personal data:
Access
Request a copy of the personal data we hold about you.
Rectification
Request correction of inaccurate or incomplete personal data.
Erasure
Request deletion of your personal data (subject to legal obligations).
Data Portability
Receive your data in a structured, machine-readable format.
Restrict Processing
Request limitation of processing in certain circumstances.
Withdraw Consent
Withdraw consent at any time where processing is consent-based.
To exercise any of these rights, please contact us at contact@hauteinnova.com. We will respond within 30 days.
8. Contact & Data Protection
If you have any questions, concerns, or requests related to this Privacy Policy or our data practices, please contact us:
STEP ESG Marketplace
Operated by HAUTE INNOVA
Email: contact@hauteinnova.com
We reserve the right to update this Privacy Policy at any time. Material changes will be communicated through the Platform. Continued use of the Platform following any update constitutes acceptance of the revised policy.