Privacy policy

SupplierDesk is operated by Rhodes & Collins LLC, Sharjah Media City Free Zone, Sharjah, United Arab Emirates. For privacy requests, write to privacy@supplierdesk.si.

We are the controller of account and billing data: the details of people who have an account, the company profile on the workspace, and the records of a subscription and its payment.

We are the processor of supplier records and verification data that the customer uploads or asks a supplier to submit. The customer decides why that data is collected and is the controller of it. We process it on the customer’s instructions to provide the service. The company named on the form is the organisation the supplier is dealing with.

• Account data: name, work email, role, a hashed password, and whether the person is active.
• Company profile: legal name, tax registration number, address, phone, email, website, and logo, where the customer provides them.
• Billing data: the plan, the price, a coupon used by the workspace, and a payment reference. Where card checkout is used, Stripe collects the card. We receive the result of the payment. We do not store the full card number.
• Supplier and verification records that the customer enters or that a supplier submits at the customer’s request. These may include names, addresses, phone numbers, tax numbers, bank details, and checklist answers. Identity documents the customer asks for may include an Emirates ID.
• Evidence files in the formats the service accepts, including licences and identity documents.
• Technical logs: IP address, browser user agent, and the time of a sign-in or a change, kept for security and for an audit of the workspace.

A location may be stored as a map link that the customer or the supplier provides. Opening that link is a visit to the map provider under that provider’s own terms.

• To provide the service, including accounts, roles, and the records the customer keeps. The basis is the contract.
• To bill the subscription, apply a coupon, and keep an invoice. The basis is the contract and our legitimate interest in being paid.
• To host supplier and verification records, send a form the customer has asked us to host, and store the files. The basis is the customer’s instruction, under the contract. The customer is responsible for its own legal basis for collecting that data.
• To secure the service, limit each customer to its own records, and investigate misuse. The basis is our legitimate interest in a secure service, and the customer’s instructions for Customer Data.
• To meet a legal duty, including a request from a competent authority.

We do not sell personal data. We do not use it for advertising.

Authorised users see the records their role allows. A supplier who submits a form sees the information collected for that submission. The supplier does not see the rest of the customer’s workspace.

We use subprocessors who process personal data to provide the service:

• A transactional email provider, to deliver messages about the service.
• Stripe, when a plan is paid by card. Stripe’s privacy notice applies to the checkout.
• Included storage that is part of the plan.
• Dedicated storage, where the customer orders it.
• A bucket the customer provides, where the customer chooses to store files there. Keys for that bucket are stored encrypted and are used to read and write those files.

A person who accepts or rejects a plan request sees the company and the person who submitted the request. Supplier records, tax numbers, and files are not shown for that decision. We also disclose personal data when the law, a court, or a competent authority requires it.

The service is provided for companies in the United Arab Emirates. If a subprocessor stores or accesses personal data outside the United Arab Emirates, we require that subprocessor to protect it. Write to privacy@supplierdesk.si if you need the categories of provider used for a workspace.

We keep personal data for the term of the contract and for a reasonable period afterwards where we need it to meet a legal obligation, including invoices, security, and claims. When the contract ends, the customer may ask us to delete or return Customer Data. We will do so, except for records we are required by law to keep. Requests go to privacy@supplierdesk.si.

Technical logs that record who changed a record, and the related IP address and browser, are kept for those security and legal purposes and are deleted when the purpose has ended.

We protect personal data with measures appropriate to the service. Traffic is encrypted in transit. Evidence files are encrypted at rest. Sensitive fields are encrypted. Downloads use signed links. Each customer’s records are isolated from other customers, and access is limited to people the customer authorises. The measures are summarised in the information security policy.

The UAE Personal Data Protection Law, Federal Decree-Law No. 45 of 2021, applies to personal data we process in the circumstances that law covers. Where the GDPR applies to a person, we handle that person’s data in line with the GDPR as well.

Federal Decree-Law No. 45 of 2021 gives people rights of access, correction, and erasure, and a right to object, subject to the conditions in that law. Where the GDPR applies, a person may have corresponding rights, including the right to lodge a complaint with a supervisory authority.

A person with an account may write to privacy@supplierdesk.si, or ask the customer’s administrator. A supplier who wants to know why an identity document or other record was requested should contact the company that asked for it, because that company is the controller. If the supplier cannot reach that company, they may write to us and we will help, including by forwarding the request. We respond within the time the applicable law requires.

You may complain to the UAE Data Office. Nothing in this policy limits that right.

The cookies we set are described in the cookie policy. They keep a session, protect forms, and, only if you choose to stay signed in, keep that sign-in. We do not use analytics or advertising cookies.

The service is for businesses. It is not directed at children, and we do not knowingly create an account for a child.

We update this policy by changing the date at the top of the page and, for a material change, by emailing the administrator. Questions and requests go to privacy@supplierdesk.si.