Privacy Policy

VendorPot maintains security, privacy, governance, and operational controls designed in alignment with recognized information-security practices, including ISO/IEC 27001 principles and applicable data-protection requirements such as the KSA and UAE PDPL. These controls are designed to support compliance with applicable requirements, including:

• GDPR - General Data Protection Regulation (EU)
• UAE PDPL - UAE Personal Data Protection Law
• Saudi PDPL - Saudi Personal Data Protection Law
• Qatar PDPL - Qatar Personal Data Privacy Protection Law
• Bahrain PDPL - Bahrain Personal Data Protection Law
• DPDP Act - Digital Personal Data Protection Act (India)

Formal certification and assessment activities are managed separately as part of VendorPot's ongoing compliance program.

Data Controller: VendorPot Limited
Email: [email protected]
Data Protection Officer: [email protected]

We process your personal data based on:

• Consent: When you register and voluntarily use the platform
• Contract Performance: To provide the services you requested
• Legal Obligation: To comply with applicable laws and regulations
• Legitimate Interests: To improve our services and prevent fraud

• Facilitate connections between vendors and buyers
• Process transactions and manage accounts
• Send important notifications and updates
• Improve user experience and platform functionality
• Conduct analytics and market research
• Prevent fraud and ensure security
• Comply with legal and regulatory requirements

VendorPot may use account profile information, company information, product and RFQ context, current page or dashboard context, platform activity, and available account controls to provide personalized assistance, AI-enabled guidance, recommendations, and workflow support.

AI Genie may prepare or assist with actions such as creating products, creating RFQs, updating profiles, and other supported platform workflows. Where AI-assisted features prepare actions that modify platform records, such actions are executed only after user confirmation and applicable permission checks. Users are responsible for reviewing an action before confirming it.

Relevant platform context is used to provide these features. This does not mean that all user data is automatically sent to AI providers.

Buyers may choose to publish an RFQ as open to eligible vendors. Directed RFQs may still be limited to selected vendors. RFQ visibility is controlled by the buyer and VendorPot platform rules.

Buyer identity and contact information may be masked, limited, or withheld until an appropriate platform condition is met, such as a suitable vendor match, subscription status, an authorized disclosure condition, or another applicable workflow rule. Buyer identity is not hidden in every case.

VendorPot may process data used for internal or external referrer workflows, including, where applicable, lead requirements, referrer source, vendor engagement activity, link opening or viewing activity, opportunity status, and related lead workflow metadata.

This data is used for referral, lead-routing, engagement tracking, and opportunity-management purposes.

VendorPot may make beta or preview versions of platform features available through a controlled enhancement environment. Where applicable, existing account and platform data may be used to provide access to those features.

We never sell your personal data. We may share data with:

• Other Platform Parties: Sharing contact information when making inquiries or lead requests
• Service Providers: Cloud infrastructure, analytics, and payment processors
• Legal Authorities: When legally required or to protect our rights
• Business Transactions: In case of merger, acquisition, or asset sale

Connecting Google Calendar is optional. VendorPot uses Google OAuth to connect a user's Google account and may access only the Google Calendar information authorized by the user. The Calendar integration is used to support VendorPot meeting and calendar functionality.

Depending on the permissions granted, this may include relevant event information such as:

• Calendar and event identifiers
• Event title
• Date and time
• Meeting details
• Attendees, where applicable

VendorPot may create, update, display, or synchronize calendar events where required by the feature. VendorPot does not receive or store the user's Google password. VendorPot does not sell Google Calendar data, and Google Calendar data is not used for advertising or unrelated marketing purposes. OAuth credentials and tokens may be securely stored where required to maintain the integration.

Users may revoke or disconnect their Google Calendar integration. After access is revoked, VendorPot will no longer use the revoked authorization to access that user's Google Calendar.

VendorPot's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You have the following rights regarding your personal data:

We retain your personal data for as long as necessary to:

• Provide our services and maintain your account
• Comply with legal and regulatory obligations
• Resolve disputes and enforce our agreements
• Prevent fraud and maintain security

Where applicable, and subject to legal and operational requirements, retained records may include AI-assisted action logs, RFQ visibility records, referrer lead activity, Google Calendar integration metadata, and authentication-method records.

We implement appropriate technical and organizational security measures to protect your data:

• Encryption in transit and at rest (TLS/SSL, AES-256)
• Access controls and multi-factor authentication
• Regular security audits and vulnerability assessments
• Employee training on data protection
• Secure data backups and disaster recovery
• Network monitoring and intrusion detection systems

In the event of a personal data breach likely to result in risks to your rights and freedoms, we will:

• Notify the relevant supervisory authority within 72 hours of becoming aware of the breach
• Inform affected individuals without undue delay
• Document the breach and our response
• Take steps to mitigate potential harm

We use cookies and similar tracking technologies to:

• Maintain your session and preferences
• Understand how you use the platform
• Improve performance and site functionality
• Provide personalized content and recommendations

You can manage your cookie preferences through your browser settings. Note that disabling certain cookies may affect platform functionality.

VendorPot is a B2B platform designed for commercial use. We do not knowingly collect personal information from individuals under 18 years of age. If we learn that we have inadvertently collected data from a minor, we will promptly delete it.

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the 'Last Updated' date. We will also send email notification for significant changes. Your continued use of the platform after such changes constitutes your acceptance of the updated policy.