VendorTech Privacy Policy
Version 1.0 | Effective date 21 October 2026
This Privacy Policy explains how VendorTech processes personal data when you visit vendor.tech, use its public Vendor directory, or use the platform as a registered Buyer or Vendor or as an authorized user of one. VendorTech is a business-to-business service, but the people who register, act for a business or are named in business records keep their rights under the EU General Data Protection Regulation (GDPR) and the Austrian Data Protection Act. Section 8 explains how we may use registered businesses’ names and Customer-supplied business logos, including those of Buyers, to identify businesses that use VendorTech.
1 Who is responsible
1.1 The controller is VendorTech, Handelskai, 1200 Vienna, Austria (VendorTech, we, us).
1.2 Send privacy questions and requests to [email protected]. You do not need an active account to use this contact.
1.3 Each Buyer or Vendor business decides what information it places on VendorTech. It remains responsible for having authority and a legal basis for the personal data it supplies and for its own later use of information it receives through the platform, as set out in section 18 of the Terms and Conditions.
2 Personal data we process
2.1 Account data. When you register or are invited, we process your Full name, company email address, a one-way hash of your password (never the password itself), your account type, your email verification status, and the name, website and email domain of the business you register, join or claim. Your Full name is required at registration and processed for your account and authorized team identification. You provide and can update your own Full name. It is separate from business names and is not an identity-verification claim. We do not ask for your job title or telephone number.
2.2 Business membership. We record your role in a business (Admin or Member), any delegated Tender permissions and who granted them, when your membership started or ended, and requests to join or claim a business, including the email address used and the decision taken.
2.3 Sign-in and security data. When you sign in we create a session that records your IP address, your browser's user agent and an expiry time. Registration, email verification and password recovery create short-lived records such as a verification code digest, attempt counters and timestamps. To limit abuse we count attempts per IP address, email address or similar subject; these counters store only a keyed cryptographic hash, not the address itself. Actions by VendorTech Platform Staff are logged with the staff member, the affected record and the stated reason.
2.4 Business content. Profiles, Tenders, Applications, saved searches, saved Vendors, folders, notes, private tags, shortlists and votes are business records, but they can identify people. Examples include free-text descriptions and client references, file names, which user created or voted on a record, and the email address of the colleague who added a Vendor to a shortlist or created a private tag. Vendor Tender-tag notes may contain structured references to eligible teammates, using stable account identifiers rather than saved copies of their names or email addresses. Typing an ordinary @word does not create a reference.
2.5 Compliance evidence. Vendors may upload licence, insurance and audit evidence. We process the file, its name, type, size and checksum, the uploading user, processing and malware screening results, staff review decisions and a record of each staff access. Such documents can name directors, employees, auditors, signatories or other people. Upload only what is needed to establish the compliance fact and redact unnecessary personal data.
2.6 Terms acceptance. When you accept the Terms and Conditions we record your account, your business, the accepted version and the server time of acceptance.
2.7 Service emails. For emails we send, such as verification codes, password recovery links and decisions on join or claim requests, we keep the recipient address, the delivery provider's message identifiers and delivery events.
2.8 We collect most of this data from you or from colleagues in your business. Some Vendor directory listings were prepared by VendorTech from public sources before the business registered; they contain company-level information. Personal data in uploaded documents and business content may come from the business that supplied it rather than from the person concerned.
3 Why we process personal data and our legal bases
3.1 To provide the platform described in the Terms and Conditions, including accounts, business membership, profiles, discovery, Tenders, Applications and service emails. Where the contract is with you, for example as a sole trader, the legal basis is Article 6(1)(b) GDPR. Where you act for a business, it is Article 6(1)(f) GDPR: our and the business's legitimate interest in providing the service that business requested.
3.2 To keep VendorTech secure and prevent fraud and misuse, including sessions, attempt limits, refusal of public email domains and blocked addresses, staff action logs and malware screening of uploads. Legal basis: Article 6(1)(f) GDPR, our legitimate interest in a secure and trustworthy service.
3.3 To review compliance evidence and show reliable business indicators. Legal basis: Article 6(1)(b) or 6(1)(f) GDPR as described in section 3.1, and our legitimate interest in the integrity of an institutional marketplace.
3.4 To meet legal obligations, such as accounting duties or lawful requests from authorities. Legal basis: Article 6(1)(c) GDPR.
3.5 To establish, exercise or defend legal claims. Legal basis: Article 6(1)(f) GDPR.
3.6 To identify businesses that use VendorTech by their business names and Customer-supplied business logos, as described in section 8.
3.7 We do not send newsletters, build advertising profiles or sell personal data. Accepting the Terms and Conditions is not consent to personal data processing. If we ask for your consent for a separate purpose, you can withdraw it at any time without affecting earlier processing.
4 Who receives personal data
4.1 Other users see business information as each feature indicates. Vendor profiles in the public directory are visible to anyone. A Buyer's business profile, including its name, website, institution type, description and jurisdictions, is shown to Vendors in connection with that Buyer's Tenders; individual Buyer users are not shown to Vendors on Tender pages. Authorized Team members see their business’s members’ Full names and email addresses, and authorized Buyer team members see who shortlisted a Vendor or voted. Vendor Tender tags and their mentions are visible only within the same Vendor to users with the required Tender permission and access to that Tender; mentioning someone does not grant access. Mentions display current authorized names, or a neutral unavailable label when the referenced person is no longer accessible. Personal names are not added to public directories or unrelated businesses’ profiles.
4.2 Service providers process personal data on our behalf under data processing agreements: DigitalOcean (hosting of the vendor.tech website, application and database, in the European Union); Amazon Web Services (private encrypted storage of uploaded documents and files, malware screening, document sanitization and related logs, in the Europe (Frankfurt) region); and Resend (delivery of service emails).
4.3 Where necessary, we share personal data with professional advisers, auditors or insurers bound by confidentiality, and with courts, authorities or law enforcement where the law requires it.
5 International transfers
5.1 Our website, application and database are hosted by DigitalOcean in the European Union, and uploaded documents and files are stored by Amazon Web Services in the European Union. We do not transfer personal data outside the European Union.
6 How long we keep personal data
6.1 Verification codes expire after 5 minutes, registration attempts after 30 minutes, password recovery links after 15 minutes and Platform Staff invitations after 24 hours. Expired records are kept until you delete your account or ask us to delete them. A temporary Full-name copy in a registration attempt is cleared when registration completes or the attempt is deleted.
6.2 Sessions end when you sign out or when they expire. We keep your account, membership and business content until you delete your account or ask us to delete it.
6.3 When you permanently delete your personal account, your sessions, password and recovery records are deleted immediately and your account record is replaced by a pseudonymous placeholder. Records that belong to a business's history, such as Tenders, Applications, shortlist entries, private tags, join and claim decisions and email delivery evidence, remain linked to that placeholder or keep the email address captured in them, as described in sections 17 and 18.4 of the Terms and Conditions. They are kept until you ask us to delete them through section 1, unless the law requires us to keep them. Structured mention references follow the tag’s lifecycle and do not keep historical name snapshots. References to deleted or inaccessible accounts display “Unavailable teammate”. This does not automatically erase ordinary free text that someone entered.
6.4 Uploads that fail malware screening are removed from intermediate storage after 24 hours, failed processing copies after 7 days and other intermediate copies after 30 days.
6.5 Terms acceptance records are kept as evidence for as long as claims relating to the agreement can be raised.
6.6 We keep personal data longer only where the law requires it, for example for accounting, or where it is needed to establish, exercise or defend legal claims, and we delete or anonymize it when that purpose ends. Backups are overwritten in their regular cycle.
7 Cookies and browser storage
7.1 VendorTech uses one cookie: the session cookie better-auth.session_token, named __Secure-better-auth.session_token on secure connections, which keeps you signed in. It is strictly necessary for the service you request and therefore does not require consent.
7.2 The signed-in workspace remembers your light or dark theme choice in your browser's local storage under vendortech-workspace-theme. It stays on your device and is not sent to us.
7.3 We do not use analytics, advertising or tracking cookies, third-party scripts or externally loaded fonts.
8 Naming businesses that use VendorTech
8.1 We may use the names and Customer-supplied business logos of registered Buyer and Vendor businesses that use VendorTech. As set out in section 10 of the Terms and Conditions, while a business account is active we may use its legal and trading names and business logos supplied by the Customer to identify it truthfully as a registered user of VendorTech, for example in customer or user lists, on our websites and social media, and in advertisements, presentations, sales materials and investor materials.
8.2 This covers only business names and business logos supplied by the Customer. On this basis we do not publish testimonials, endorsements, quotations, case studies, performance claims, Tender participation, commercial terms, communications or other private platform activity, and we do not name the individual people who use VendorTech for a business.
8.3 New use of a business name or Customer-supplied business logo ends when the business account is permanently deleted or becomes inactive. A Vendor directory listing prepared before registration, or an unconfirmed registration, does not permit this use.
8.4 A business name or logo is usually not personal data. Where it identifies a person, for example a sole trader, we rely on our legitimate interest in showing who uses VendorTech (Article 6(1)(f) GDPR). That person may object at any time through section 1, and we will then stop using the name or logo for this purpose.
9 Automated assessments
9.1 VendorTech shows business-level indicators calculated from platform records, such as Verified, based on compliance records verified by staff, and Trusted, based on Buyer activity such as saves, shortlists or Tender awards. Saved-search results are ranked by how many criteria match. Registration with a public email domain or a blocked address or domain is refused automatically; you can ask for a review through section 1. We do not make decisions about individuals based solely on automated processing that produce legal or similarly significant effects within the meaning of Article 22 GDPR.
10 Your rights
10.1 Subject to the legal conditions, you have the right to access your personal data, to have it corrected or erased, to restrict its processing and to data portability. You may object at any time to processing based on legitimate interests, on grounds relating to your particular situation (Articles 15 to 21 GDPR).
10.2 You can permanently delete your personal account in your account settings. Some records remain afterwards as described in section 6.
10.3 Send requests to [email protected]. We may ask for information to confirm your identity. We answer within one month, which can be extended by two further months where necessary.
10.4 You may lodge a complaint with a supervisory authority, in particular in the EU member state where you live or work or where the alleged infringement took place. In Austria this is the Datenschutzbehörde (Austrian Data Protection Authority), dsb.gv.at.
11 Whether you must provide personal data
11.1 A Full name, company email address and password are required to register; without them we cannot create an account. Other profile and Tender information is optional unless a feature you choose to use requires it.
12 Security
12.1 We protect personal data with technical and organizational measures, including encrypted connections, password hashing, keyed hashing of attempt counters, encryption of stored email payloads, private encrypted storage and malware screening for uploaded documents, role-based staff access and access logging. If you suspect misuse, contact [email protected].
13 Changes to this Privacy Policy
13.1 We update this Privacy Policy when our processing changes, for example when we add a feature or a service provider. The version and effective date at the top identify the current text. Where a change requires your consent, we will ask for it.