Legal Notices
Ownership of Algorithms
The rating calculation algorithms and the associated databases are the exclusive property of Eco-Rating. Any attempt at mass data extraction (scraping) or reverse engineering of the calculation methods is strictly prohibited without prior agreement.
Technological development is carried out in partnership with DEVA (www.devagroup.biz).
Intellectual Property
All content on this platform (texts, graphics, logos, icons, images, videos) is the exclusive property of Eco-Rating or its partners. Any reproduction, representation, modification, publication or adaptation of all or part of the elements of the site, by any means or process, is prohibited without prior written authorisation.
Privacy Policy & Personal Data Protection (GDPR)
Last updated: 9 October 2026
Ecorating attaches paramount importance to respecting the privacy and protecting the personal data of its users.
The purpose of this policy is to inform users of the Ecorating platform of how their personal data is collected, processed and used, as well as of their rights, in accordance with the General Data Protection Regulation (GDPR 2016/679) and applicable laws.
1. Data Controller
The data controller is:
Company: Ecorating sas
Registered office: 55, Rue Grignan, 13006 Marseille.
Registration number: FR102 643 970 00019
Contact email / DPO: assistant@ecorating.net
2. Nature of Ecorating's Activity and Company Data
Ecorating manages a global database that evaluates and rates products, companies and countries in the form of environmental indices and assessments.
Public and B2B data: Information relating to companies, products and legal entities (CSR reports, environmental declarations, ratings) does not constitute personal data within the meaning of the GDPR.
Personal data: Only data directly relating to an identified or identifiable natural person (site visitors, representatives of registered companies, contacts) is protected under the GDPR.
3. Personal Data Collected
When you use the site, we may collect:
Account / user profile data: Last name, first name, professional or personal email address, secure (hashed) password, affiliated organisation.
Contact and support data: History of exchanges, messages submitted via the contact form.
Browsing and technical data: IP address, browser type, operating system, pages viewed, timestamp, connection logs.
Cookies and trackers: Audience and usage measurement data (with your prior consent).
4. Purposes and Legal Bases of Processing
| Purpose of processing | Legal basis (Art. 6 GDPR) |
|---|---|
| Access to the platform and consultation of ratings | Performance of a contract or pre-contractual measures |
| Creation and management of the user account | Performance of a contract |
| Response to contact / support requests | Legitimate interest |
| Site security, fraud detection and abuse prevention | Legitimate interest / Legal obligation |
| Audience measurement and improvement of features | Consent (cookies) or legitimate interest |
5. Hosting and Data Security
Hosting & Cloud: Ecorating's technical infrastructure and databases are hosted on secure infrastructures (in particular IONOS dedicated servers).
Technical subcontractors: Our hosting, managed-services and network infrastructure providers comply with the requirements of Article 28 of the GDPR and guarantee technical and organisational measures in line with the strictest security standards (encryption of data in transit and at rest, backups, firewalls).
6. Data Recipients and Transfers
Your personal data is never sold, rented or marketed to third parties.
It is only accessible to authorised members of the Ecorating team and, where applicable, to our technical subcontractors involved in the maintenance and hosting of the service.
Processing is primarily carried out within the European Economic Area (EEA). Any transfer outside the EEA is governed by appropriate safeguards (the European Commission's Standard Contractual Clauses, adequacy decisions).
7. Retention Period
Active user accounts: For the entire duration of the contractual relationship, then legal archiving or deletion within 3 years after the last recorded activity.
Contact requests: For the time necessary to process the request, then kept for a maximum of 1 year.
Connection and security logs: Kept for between 6 and 12 months maximum.
Measurement cookies: 13 months maximum from the date they are placed.
8. Your Rights
In accordance with Articles 15 to 22 of the GDPR, you have the following rights over your personal data:
Right of access: Obtain confirmation that data concerning you is being processed and obtain a copy of it.
Right to rectification: Correct inaccurate or incomplete information.
Right to erasure (“right to be forgotten”): Request the deletion of your data under the conditions provided by law.
Right to restriction of processing: Request the temporary freezing of the processing of certain data.
Right to object: Object at any time to processing based on our legitimate interest.
Right to data portability: Receive your data in a structured, machine-readable format.
To exercise these rights, you can contact us at: assistant@ecorating.net.
You also have the right to lodge a complaint with the competent data protection supervisory authority (in France, the CNIL: cnil.fr; in Belgium, the APD: autoriteprotectiondonnees.be).
9. Cookies
The Ecorating site uses cookies that are strictly necessary for the platform to function properly (session authentication, security). Optional cookies (statistical analysis, audience measurement) require your express consent via our cookie management banner, available from your first visit.
10. Changes to the Policy
Ecorating reserves the right to update this privacy policy at any time to reflect legal or technical developments. Any substantial change will be notified to registered users or clearly mentioned on this page.