Privacy Policy

Procurax Inc. (“Procurax,” “we,” “us,” or “our”) is committed to protecting the personal data of individuals who interact with our platform, website, and services. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you access procurax.io, use the Procurax enterprise procurement platform, or engage with us in any other way.

This policy applies to all users of the Procurax platform, including employees of our enterprise customers, visitors to our website, and individuals who contact us for sales or support inquiries. By using our services, you acknowledge that you have read and understood this Privacy Policy.

Procurax Inc. is the data controller for information collected on our website and in connection with our direct marketing activities. For personal data processed on behalf of our enterprise customers through the Procurax platform, we act as a data processor and our customers act as data controllers.

Account and Registration Information: When you or your organization creates a Procurax account, we collect your name, work email address, job title, company name, phone number, and billing information. This information is necessary to provide our services and manage your account relationship.

Platform Usage Data: We collect data about how you interact with the Procurax platform, including features used, pages visited, actions taken, time spent, error reports, and system performance data. This helps us improve the platform and provide support.

Procurement Data: The Procurax platform processes procurement data that you and your organization enter, including purchase requests, supplier information, contracts, approval decisions, and financial data. This data belongs to you and is processed only to provide our services.

Communications Data: We retain records of your communications with us, including support tickets, sales inquiries, and email correspondence, to provide continuity of service and improve our customer experience.

Technical and Device Data: We automatically collect certain technical information including IP address, browser type, operating system, device identifiers, and referring URLs when you access our website or platform.

Cookies and Tracking Technologies: We use cookies and similar technologies to maintain session state, remember your preferences, and analyse platform usage. See our Cookie Policy for full details.

We use the information we collect for the following purposes:

• Service Delivery: To provide, operate, and maintain the Procurax platform and associated services under your subscription agreement.
• Account Management: To manage your account, process payments, and communicate with you about your subscription.
• Customer Support: To respond to your inquiries, troubleshoot issues, and provide technical assistance.
• Platform Improvement: To analyse usage patterns, identify bugs, develop new features, and improve platform performance.
• Security and Fraud Prevention: To detect, investigate, and prevent fraudulent activity, unauthorized access, and other misuse of our platform.
• Legal Compliance: To comply with applicable laws, regulations, and legal obligations, including responding to lawful requests from public authorities.
• Marketing Communications: To send you information about Procurax products, features, and events, where you have given consent or we have a legitimate interest to do so. You can opt out at any time.

For individuals in the European Economic Area (EEA), United Kingdom, or Switzerland, we process personal data under the following legal bases:

• Contract Performance: Processing necessary to fulfill our contractual obligations to you or your organization.
• Legitimate Interests: Processing necessary for our legitimate business interests, such as fraud prevention, platform security, and product improvement — where these interests are not overridden by your rights.
• Legal Obligation: Processing required to comply with applicable laws and regulations.
• Consent: Where we rely on your consent, such as for certain marketing communications, you may withdraw that consent at any time.

We do not sell your personal data to third parties. We may share your information in the following limited circumstances:

• Service Providers: We engage trusted third-party vendors to support our operations, including cloud hosting (AWS), payment processing (Stripe), email delivery, analytics, and customer support tools. These providers process data only on our instructions under binding confidentiality obligations.
• Customer Organization: Where you access Procurax through your employer or organization, your usage data and profile information is accessible to designated administrators within your organization.
• Legal Requirements: We may disclose information when required by law, subpoena, court order, or other legal process, or when we believe in good faith that disclosure is necessary to protect our rights or the safety of others.
• Business Transfers: In the event of a merger, acquisition, or sale of all or substantially all of our assets, your information may be transferred to the acquiring entity, subject to equivalent privacy protections.

We retain personal data for as long as necessary to provide our services and fulfill the purposes described in this policy, unless a longer retention period is required by law.

Account data is retained for the duration of your subscription and for a period of 7 years following termination, unless you request earlier deletion. Procurement data processed through the platform is retained according to the data retention settings configured by your organization as data controller.

After the applicable retention period, personal data is securely deleted or anonymized in accordance with our data deletion procedures.

Depending on your location, you may have the following rights regarding your personal data:

• Access: The right to request a copy of the personal data we hold about you.
• Correction: The right to request correction of inaccurate or incomplete personal data.
• Erasure: The right to request deletion of your personal data, subject to certain exceptions.
• Portability: The right to receive your personal data in a structured, machine-readable format.
• Restriction: The right to request that we restrict the processing of your personal data in certain circumstances.
• Objection: The right to object to processing based on legitimate interests or for direct marketing purposes.
• Withdrawal of Consent: Where processing is based on consent, the right to withdraw that consent at any time.

To exercise any of these rights, contact us at support@procurax.io. We will respond within 30 days. If you are dissatisfied with our response, you have the right to lodge a complaint with your local data protection authority.

Procurax Inc. is headquartered in the United States. If you are located outside the United States, your information will be transferred to and processed in the United States and potentially other countries where our service providers operate.

For transfers from the EEA, UK, or Switzerland to countries not recognized as providing adequate data protection, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, supplemented by appropriate technical and organizational safeguards.

Enterprise customers can request data residency in their preferred region (EU, US, or APAC) under our Enterprise Plus plan. Contact support@procurax.io for details.

We implement industry-leading technical and organizational security measures to protect your personal data, including:

• AES-256 encryption for all data at rest and TLS 1.3 for all data in transit
• Multi-factor authentication and role-based access controls
• Regular penetration testing by independent security firms
• SOC 2 Type II and ISO 27001 certification
• 24/7 security monitoring and incident response
• Annual security awareness training for all employees

While we take extensive measures to protect your data, no transmission over the internet or electronic storage method is 100% secure. We cannot guarantee absolute security, but we commit to notifying you promptly in the event of a data breach affecting your personal data.

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will notify you by email (if we have your email address) or through a prominent notice on our website at least 30 days before the changes take effect.

We encourage you to review this policy periodically. Your continued use of the Procurax platform following notice of changes constitutes your acceptance of the updated policy.

For questions, concerns, or requests related to this Privacy Policy or our data practices, please contact our Privacy team:

• Email: support@procurax.io
• Post: Procurax Inc., Attn: Privacy Team, Washington, D.C., USA

For EEA residents: Our EU Representative can be contacted at the same email address with “EU Privacy” in the subject line.