Policies

This Acceptable Use Policy is part of the Terms. The service is for your company’s own supplier and verification work. Each Authorised User uses their own named account.

• Send a supplier form only to a supplier you intend to assess, at an address you believe is theirs.
• Upload evidence that relates to that assessment. Identity documents and bank details collected for it stay within your company’s use of the service.
• The company details a supplier sees must identify your company.
• Do not attempt to reach another customer’s records. Records, files, and download links are limited to the customer they belong to.

The following are outside the service, and we may suspend the workspace if we see them: accessing an account without authority, interfering with the service, exploiting a weakness, introducing malware, using a form to collect personal data for a purpose other than your supplier or verification work, uploading material you have no right to hold, or using the service to harass a person.

A weakness you find in good faith may be reported to legal@supplierdesk.si.

SupplierDesk uses cookies that the service needs in order to function. We do not use analytics or advertising cookies.

Paying by card opens Stripe. A cookie Stripe sets on Stripe’s own page is covered by Stripe’s notice. Blocking the session cookie means the service cannot keep you signed in.

You may cancel a subscription by written notice to legal@supplierdesk.si. Cancellation takes effect at the end of the current paid term. The service has no self-serve cancellation.

Prepaid fees for a year are non-refundable, except where the law requires a refund, or where the Terms provide a pro-rata refund because we terminate for convenience or fail to provide the service for a material period caused by us. A rejected plan request that has not been paid creates no fee.

These terms apply where we process Customer Data as a processor. Customer Data is defined in the Terms. You are the controller of Customer Data. We process it only to provide the service, on the documented instructions in the Terms, unless the law requires otherwise. We will tell you of that legal requirement when the law allows.

We will keep Customer Data confidential and ensure that people who process it are under a duty of confidentiality. We will apply the security measures in the information security policy below.

We use the subprocessors listed in the Privacy policy: transactional email, Stripe, included storage, optional dedicated storage, and an optional bucket you provide. We remain responsible for their processing of Customer Data for the service.

On termination we will delete or return Customer Data on a written request to privacy@supplierdesk.si, subject to records we must retain to meet a legal obligation. You are responsible for the lawful collection of supplier data, and for the information you give suppliers about that collection.

We maintain safeguards appropriate to a hosted business workspace. They include the following.

• Access to a workspace requires authentication. Access is limited by the role the customer assigns.
• Each customer’s records are isolated from other customers.
• Evidence files are encrypted at rest, on included storage, on dedicated storage, and on a bucket the customer connects. Sensitive fields are encrypted.
• The service is encrypted in transit. A download is made through a signed link and is limited to the customer that owns the file.
• Changes are recorded for security and audit, including the person, the IP address, and the browser, without copying encrypted values into that record.

You are responsible for your Authorised Users’ credentials, for removing access that should end, and for the access rules of a bucket you connect. Tell legal@supplierdesk.si if you believe an account or a file has been exposed.

This notice is for a person who has been asked to complete a form. The form is hosted by SupplierDesk, operated by Rhodes & Collins LLC, for the company named on the page. That company is the controller of the personal data the form collects. SupplierDesk processes it for that company.

The company collects the identity and supporting documents it asks for. Those documents may include an Emirates ID. The company uses them for the supplier relationship it is assessing. The files are stored for that company.

Questions about why a document was requested go to the company that sent you the form. If you cannot reach that company, write to privacy@supplierdesk.si and we will help you contact them. Your rights, including the right to complain to the UAE Data Office, are described in the Privacy policy.