Privacy Policy
How The Procurementor handles your personal data
Last updated:
This policy explains what personal data we collect through Procurementor Savings Tracker (savings.theprocurementor.com), why, on what legal basis, and what rights you have under the General Data Protection Regulation (GDPR).
For data you enter into the application on behalf of your organization (initiatives, savings, suppliers…), your organization is the data controller and we act as a processor: see the Data Processing Agreement (DPA).
1. Data controller
THE PROCUREMENTOR, a French société par actions simplifiée (SAS) with a share capital of €1,000, registered with the Metz Trade and Companies Register (RCS) under number 130 492 077, with its registered office at 10 rue du Général Devers, 57370 Phalsbourg, France ("we"). For any data-related question: privacy@theprocurementor.com.
2. Data we collect
- Account data: full name, work email address, password (stored hashed), role, team and account status.
- Invitations: email address, name, role and team of the people an administrator invites to their organization.
- Proof of acceptance: the version of the Terms you accepted and the date of acceptance.
- Organization data: organization name, reporting currency, pricing plan.
- Business data entered in the app: savings initiatives, amounts and savings lines, suppliers, targets, exchange rates, attachments, messages and mentions exchanged on initiatives, notifications and the audit log.
- Contact messages: name, email and content you send us via the contact forms.
- Technical data: access logs, IP address, browser type and cookies strictly necessary for authentication.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Provide the service and manage your account | Performance of a contract (Art. 6.1.b) |
| Security, fraud prevention and the audit log | Legitimate interest (Art. 6.1.f) |
| Transactional emails (confirmation, invitations, reset) | Performance of a contract (Art. 6.1.b) |
| Respond to your contact or support requests | Legitimate interest (Art. 6.1.f) |
| Keep proof of your acceptance of the Terms | Legitimate interest (Art. 6.1.f) |
| Protect forms against abuse (rate limiting and, when enabled, an anti-bot check) | Legitimate interest (Art. 6.1.f) |
| Comply with legal obligations (accounting, tax) | Legal obligation (Art. 6.1.c) |
4. Sub-processors
We rely on a small number of carefully selected vendors to deliver the service. All are bound by contractual data-protection commitments.
| Sub-processor | Role | Location |
|---|---|---|
| Supabase Pte. Ltd. | Database, authentication and file storage | Data hosted in the EU (Paris, France) |
| Vercel Inc. | Web application hosting and content delivery network (CDN) | Server code runs in Paris; global delivery network; US company — transfers covered by SCCs |
| Brevo (Sendinblue SAS) | Transactional email delivery (confirmation, invitations, reset) and notification of your contact messages | France (EU) |
5. Hosting and transfers
The database, authentication and file storage are hosted in the European Union (Paris, France (EU — eu-west-3)) by Supabase. The application's server code runs on Vercel in the Paris region (cdg1). Vercel is a US company and its delivery network routes requests and serves static content from the point of presence closest to the visitor, so technical data (IP address, access logs) may be processed outside the EU. Those transfers are covered by the applicable data processing agreements and Standard Contractual Clauses (SCCs).
6. Retention
- Account and organization data: kept while your account is active.
- Deletion of an organization by its administrator (Account page): the organization's data, its attachments and its members' sign-in identities are erased immediately from the live systems.
- Backup copies: where they exist, they expire with the hosting provider's retention cycle (see the Security page).
- Individual requests sent to our privacy address: handled within one month.
- Contact messages: up to 24 months.
- Data kept for legal obligations (e.g. invoicing): for the applicable statutory periods.
7. Your rights
Under the GDPR you have the rights of access, rectification, erasure, restriction, objection and data portability, as well as the right to lodge a complaint with a supervisory authority (e.g. the CNIL in France).
From the Account page, every user can export their personal data; an administrator can export all of the organization's data and delete it permanently. You can also write to privacy@theprocurementor.com: we reply within one month.
9. Changes
We may update this policy. The last-updated date is shown at the top of the page; material changes will be notified to you.