Privacy Notice

Supplex provides a business-to-business platform that organisations can use to manage supplier-related information, processes, workflows, forms, documents, evaluations, approvals and other configurable supplier-management activities.

Depending on the circumstances, Supplex may process personal data in two different capacities.

When Supplex is the controller

Supplex acts as a controller when we determine why and how personal data is processed for our own purposes, including in relation to:

• website visitors and enquiries;
• prospective customers;
• customer account administration;
• commercial and contractual relationships;
• billing and financial administration;
• communications with customer representatives;
• security of our services and infrastructure;
• fraud and abuse prevention;
• legal and regulatory compliance; and
• operation and administration of Supplex as a business.

This Privacy Notice primarily applies to those activities.

When Supplex is a processor

When a customer uses Supplex to collect, upload, store, organise or otherwise process personal data through its Supplex environment, the customer will normally determine the purposes and means of that processing.

In those circumstances, the customer is the controller and Supplex acts as its processor.

This may include personal data concerning the customer's employees, supplier representatives, prospective suppliers, contractors and other individuals whose information is entered into Supplex.

We process that data on the customer's documented instructions and subject to our Data Processing Agreement.

If your personal data has been provided to Supplex by an organisation that uses our platform, you should normally direct privacy requests concerning that data to that organisation. We will assist our customer in responding where required.

Account and profile information

When you are given access to Supplex, we may process information such as:

• name;
• business email address;
• organisation;
• job title or role;
• account identifiers;
• user permissions and access roles;
• invitation and account status;
• authentication information; and
• account preferences.

Passwords are not stored by Supplex in readable form.

Service and security information

When you use Supplex, systems may generate technical and operational information including:

• IP address;
• browser and device information;
• session information;
• login and authentication events;
• timestamps;
• actions performed within the service;
• audit events;
• error and diagnostic information;
• security events; and
• information necessary to investigate misuse, incidents or service problems.

Some service-generated records may form part of Customer Data and therefore be processed by Supplex as a processor rather than as an independent controller.

Communications and support information

If you contact us, request support or communicate with our team, we may process:

• your name and contact information;
• your organisation;
• messages and correspondence;
• support requests;
• files or screenshots you choose to provide; and
• information necessary to investigate and resolve your request.

Sales, trial and customer relationship information

If you contact Supplex about purchasing or evaluating the service, we may process information such as:

• name;
• work email;
• telephone number, where provided;
• company;
• role;
• requirements and areas of interest;
• meeting notes;
• proposal and contract information;
• trial information; and
• correspondence relating to the commercial relationship.

Billing and administrative information

Where relevant, we may process:

• customer organisation details;
• billing contact information;
• invoice information;
• transaction references;
• tax information; and
• records required for accounting and legal compliance.

Where payments are processed by an external payment provider, Supplex may not receive full payment-card information.

Customer-controlled data

Customers may configure Supplex to process information relating to suppliers and supplier-management processes.

Depending on the customer's configuration, this can include:

• supplier contact information;
• names and business contact details;
• roles and organisations;
• qualification responses;
• onboarding information;
• supplier documents and certificates;
• approvals and workflow actions;
• forms and questionnaires;
• comments and communications;
• evaluation or performance information;
• task assignments;
• document metadata;
• audit records;
• compliance information; and
• other information selected by the customer.

For this category of information, Supplex normally acts as processor on behalf of the customer.

Supplex's standard service is not designed to require customers to collect special-category personal data under Article 9 GDPR or personal data relating to criminal convictions and offences under Article 10 GDPR.

Customers should not configure Supplex to collect such information unless they have determined that doing so is necessary and lawful and have implemented any safeguards required by applicable law.

If additional contractual or security measures are required for a particular category of information, the customer should contact Supplex before processing it through the service.

Where Supplex acts as controller, we may process personal data for the following purposes.

Where we rely on legitimate interests, we consider the nature of the information, the reasonable expectations of the individuals concerned and the potential impact of the processing.

You may object to processing based on legitimate interests in the circumstances described below.

We may receive personal data:

• directly from you;
• from your employer or organisation;
• from a Supplex customer that creates an account for you;
• through your use of our website or service;
• through communications with us;
• from service providers assisting us in operating Supplex; or
• from publicly available professional or business sources where lawful.

Customer-controlled data is primarily provided or generated by the customer and its authorised users.

We do not sell personal data.

We may disclose personal data where necessary to:

• infrastructure and hosting providers;
• authentication and security providers;
• email and communications providers;
• monitoring, support and operational service providers;
• professional advisers such as accountants, auditors and lawyers;
• government bodies or regulators where legally required;
• a purchaser, investor or successor in connection with a legitimate corporate transaction; or
• other parties where you or the relevant customer has instructed us to do so.

Providers processing Customer Data on our behalf are subject to appropriate contractual data-protection obligations.

A current list of subprocessors used for Customer Data is available to customers on request.

Supplex may use carefully selected third-party service providers to help deliver the service.

Where those providers process Customer Data on behalf of Supplex, they act as subprocessors.

Supplex requires subprocessors to enter into contractual obligations that provide an appropriate level of protection for personal data and remain responsible for its obligations regarding processing carried out through its subprocessors as required by applicable data-protection law.

Our customer Data Processing Agreement contains further information regarding subprocessors and customer notification of changes.

Supplex may use service providers located in, or accessible from, countries outside the country in which you are located.

Where GDPR or another applicable data-protection regime restricts international transfers, Supplex will use an appropriate legal transfer mechanism.

Depending on the circumstances, this may include:

• an adequacy decision;
• the European Commission's Standard Contractual Clauses;
• another legally recognised transfer mechanism; and
• supplementary technical, contractual or organisational measures where appropriate.

Customers may request further information about applicable transfer safeguards by contacting hello@supplex.app.

Supplex uses technical and organisational measures intended to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Measures used by Supplex include, as appropriate:

• encryption of data in transit;
• encryption at rest through applicable infrastructure services;
• authentication and access controls;
• role-based permissions;
• tenant-level access controls;
• security logging and monitoring;
• audit trails; and
• separation of development and production environments.

No system connected to the Internet can be guaranteed to be completely secure.

Additional security commitments applicable to Customer Data are contained in the Supplex Data Processing Agreement and applicable customer agreement.

We retain personal data only for as long as necessary for the purpose for which it was collected, including satisfying contractual, legal, accounting, security and dispute-resolution requirements.

Our retention criteria include the duration of the customer relationship, the sensitivity and nature of the information, legal requirements and whether information is necessary for security or legal claims.

Where information is required in connection with legal proceedings, investigations or compliance obligations, it may be retained for longer.

Supplex may use cookies or similar local-storage technologies necessary to:

• authenticate users;
• maintain sessions;
• protect the service;
• remember essential preferences; and
• provide functionality requested by users.

Where Supplex introduces non-essential analytics, advertising or similar technologies that require consent under applicable law, we will provide the appropriate information and consent controls before using those technologies.

Depending on applicable law and the circumstances, you may have rights including:

• access to your personal data;
• correction of inaccurate personal data;
• deletion of personal data;
• restriction of processing;
• objection to certain processing;
• portability of certain personal data;
• withdrawal of consent where processing relies on consent; and
• the right to lodge a complaint with a data-protection supervisory authority.

These rights are not absolute and may be subject to legal conditions and exceptions.

Where Supplex acts as controller, requests may be sent to hello@supplex.app.

We may need to verify your identity before acting on a request.

Where Supplex processes the relevant information only on behalf of a customer, we may direct the request to that customer or assist the customer in responding.

Supplex may send business-related marketing communications where permitted by applicable law.

You can ask us to stop sending marketing communications at any time by using the unsubscribe mechanism provided in the communication or by contacting us.

Opting out of marketing does not prevent us from sending necessary transactional, security, contractual or service-related communications.

Supplex does not use personal data for its own purposes to make solely automated decisions that produce legal effects or similarly significant effects on individuals.

The Supplex platform may allow customers to configure workflows, scoring methodologies, evaluations, qualification criteria or automated process steps.

Where a customer uses these functions to make decisions concerning individuals, the customer determines the purpose, criteria and lawful basis for that processing and is responsible for complying with applicable requirements relating to automated decision-making.

Supplex is a business-to-business service and is not intended for use by children.

Customers should not intentionally use Supplex to collect personal data relating to children unless such processing has been specifically assessed as lawful and appropriate.

We may disclose personal data where we reasonably believe disclosure is necessary to comply with an applicable law, binding legal process or lawful governmental request.

Where legally permitted and appropriate, we will seek to limit disclosure to the information legally required.

If Supplex or the business operating Supplex is involved in a merger, acquisition, restructuring, financing, sale of assets or similar transaction, personal data may be disclosed to relevant advisers and counterparties subject to appropriate confidentiality and data-protection safeguards.

If you have concerns about how Supplex processes personal data, please contact us first at hello@supplex.app.

You may also have the right to lodge a complaint with the competent data-protection authority in the country where you live, work or believe a violation occurred.

Where applicable, Supplex's lead supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).

We may update this Privacy Notice from time to time to reflect changes to Supplex, our processing activities or applicable law.

We will publish the revised version with an updated "Last updated" date and, where appropriate, provide additional notice of material changes.

Questions or requests concerning this Privacy Notice can be sent to:

Logicode Consulting OÜ, trading as Supplex
Registry code: 16823494
Lõõtsa tn 2a, Lasnamäe linnaosa
Harju maakond, Tallinn 11415
Estonia
Email: hello@supplex.app