Villanova ESG is an EU–Brazil supplier evidence advisory. This notice explains how the firm handles personal data submitted through website inquiries, email, supplier evidence discussions and business review requests, and the rights that may be available under applicable data protection laws, including the GDPR and the LGPD where they apply.

Last updated: June 2026.

Scope

Villanova ESG provides supplier evidence, buyer-readiness and regulatory risk reviews on an advisory basis. In that context, people contact the firm through email, website links, intake forms, business messages, referral channels and document-review discussions. This policy covers the personal data processed through those channels: the categories of data, the purposes of processing, retention logic, data-sharing principles and data subject rights. It is not a client engagement agreement.

Who this applies to

Website visitors, business contacts, prospective clients, supplier representatives, buyer representatives, partner contacts and individuals who communicate with Villanova ESG about supplier evidence or advisory services.

Controller and contact

The website and business-contact channels are operated by Villanova ESG. Privacy-related requests — access, correction, deletion or questions — go to [email protected], with enough information to identify the communication or data concerned.

Processing principle

Villanova ESG does not need broad personal data to evaluate a business inquiry. The normal focus is company context, role, email address, buyer pressure, supplier documentation and commercial timeline.

Data categories

The exact information processed depends on what the individual or company submits. Villanova ESG does not ask visitors to send unnecessary personal, sensitive or private information through open email links.

Contact and identity data

  • Name, professional email address and telephone number where provided.
  • Company name, role, department and country.
  • Communication history, inquiry context and reply records.

Business inquiry data

  • Sector, product, buyer geography and target market.
  • Procurement, contract, compliance or board-level trigger.
  • Timeline, commercial risk concern and evidence request details.

Supplier evidence context

  • Document categories available for review discussions.
  • Traceability, origin, carbon, environmental or product-data context.
  • High-level descriptions of documentation gaps and review priorities.

Website technical data

  • Basic server logs, device information, browser type, time of access and security logs generated by the website or hosting layer.
  • Optional analytics or marketing cookies, if enabled, are disclosed and controlled separately.

Privacy request data

  • Information needed to identify and respond to a data rights request.
  • Records of the request, verification steps and response.

Information not requested

Health data, personal financial records, criminal records, private family data and unrelated sensitive information should not be submitted through open website or email channels.

How personal data is used

The purposes are narrow: respond to inquiries, evaluate whether a supplier evidence review is relevant, communicate with professional contacts, manage engagement discussions, protect website security and preserve necessary business records.

  1. Responding to inquiries. Data is used to answer emails, contact requests, review questions and supplier evidence discussions.
  2. Assessing commercial fit. Company, sector, product, buyer pressure and timeline information is used to understand whether Villanova ESG can support the request.
  3. Preparing proposals or next steps. Business context may be used to prepare a review scope, intake response, meeting agenda or engagement proposal.
  4. Maintaining business records. Relevant correspondence may be retained for administrative, legal, accounting, security or dispute-prevention purposes where appropriate.

Lawful basis

Depending on jurisdiction and context, Villanova ESG may rely on pre-contractual steps, legitimate business interests, consent where requested, compliance with legal obligations or another applicable lawful basis. The basis varies with the type of communication, the jurisdiction of the requester and the nature of the engagement.

Pre-contractual steps

When a company requests a review, proposal or engagement discussion, contact and business data may be processed to evaluate and respond to that request.

Legitimate business interest

Professional contact data may be processed to manage business communication, maintain records, improve inquiry handling and protect website security.

Consent and withdrawal

Where processing depends on consent, the individual may withdraw it. Withdrawal does not affect processing that occurred before withdrawal, or processing required under another lawful basis.

Sharing, international transfers and retention

Data is shared only where needed to operate the website, manage communications or support the requested business purpose.

Service providers

Data may be processed through email providers, hosting providers, security systems, document storage services, professional advisors or other operational vendors used to respond to inquiries and manage business records. These providers process data only for necessary operational, security, advisory or administrative purposes.

International context

Because Villanova ESG operates between the EU and Brazil, business communications may involve contacts, service providers or records connected to more than one country. Appropriate safeguards are used where required by applicable law.

Retention

Personal data is retained only for as long as necessary for the inquiry, relationship, engagement, legal obligation, administrative requirement, security purpose or dispute-prevention need. Retention periods vary by context.

Data subject rights

Depending on the applicable law and jurisdiction, individuals may have the right to request confirmation of processing, access to personal data, correction of inaccurate data, deletion, restriction, objection, data portability, information about sharing, withdrawal of consent and review of certain automated decisions where relevant.

  • Access or confirmation. Ask whether Villanova ESG processes personal data about you and request access where applicable.
  • Correction. Request correction of incomplete, inaccurate or outdated contact or business data.
  • Deletion or restriction. Request deletion or limitation where applicable, subject to legitimate retention, legal obligations or dispute-related needs.
  • Objection or withdrawal. Object to certain processing, or withdraw consent where processing is based on consent.

To exercise a right, email [email protected] with your name, email address, company context, country, the relevant communication and the specific right being exercised. Villanova ESG may request additional information to verify the requester's identity, protect third-party rights, locate the relevant record or prevent unauthorized access to personal data.

Cookies and website technologies

Essential technologies may be used to operate the website, protect security, prevent abuse, maintain forms and support basic functionality. Optional analytics or marketing tools are not treated as essential; if used, they are disclosed with appropriate notice and consent controls. See the Cookie Policy for current details.

The website may link to external sources, regulatory institutions or third-party platforms. Their privacy practices are governed by their own policies, not by this page.

Security and confidentiality

Villanova ESG applies reasonable organizational and technical measures to protect business communications. No open email or website channel, however, should be treated as a secure repository for highly confidential, sensitive or privileged documents unless an appropriate engagement structure and transfer method has been agreed.

  • Limit the submission. Initial inquiries should describe the business issue without attaching excessive personal identifiers or unnecessary sensitive details.
  • Business context first. For supplier evidence requests, describe company, sector, product, buyer geography, timeline and available document categories before sending document sets.
Villanova ESG takes privacy and confidentiality seriously, but cannot guarantee absolute security of electronic communication or third-party infrastructure.

What this policy is not

This page describes Villanova ESG's privacy approach for website and business-contact data. It does not create a client relationship, legal advice, an audit opinion, regulatory approval, certification, buyer approval or a guarantee of compliance with every privacy regime in every jurisdiction.

  • Not a client agreement. Submitting an inquiry does not create a consulting engagement, confidentiality agreement, legal representation or advisory mandate.
  • Not a cookie inventory. If analytics, CRM, advertising or tracking tools are added, cookie disclosures and controls are updated accordingly.
  • Not a universal legal document. This policy is reviewed by qualified counsel when the operating entity, jurisdiction, data processors, website tools or intake workflows change.

Updates and legal references

Villanova ESG may update this Privacy Policy when website tools, data practices, service providers, legal requirements or intake workflows change. The last-updated date is revised whenever the page changes materially.

The official sources below frame transparency duties, controller obligations and data subject rights. They are references, not a substitute for legal advice.

Sources: Regulation (EU) 2016/679 (GDPR), EUR-Lex · EDPB, Respect individuals' rights · Lei 13.709/2018 (LGPD), Planalto · ANPD, Direitos dos Titulares

This Privacy Policy does not provide legal advice, certification, regulatory approval or a guarantee of compliance. Submitting an inquiry does not create an engagement.