Vendoro Global Privacy Policy

1. Information We Collect

We collect information to operate, support, and secure our B2B procurement platform. The categories of information collected include:

• Account & Identity Data: Full name, organizational email address, job title, company name, department, role-based permissions, and login credentials.
• Mobile Communications Data: Cell phone number provided during account registration or administrator provisioning for Multi-Factor Authentication (2FA) and operational requisition alerts.
• Procurement & Transactional Data: Purchase orders, requisitions, catalog items, supplier pricing tiers, budget caps, approval decisions, invoice records, and receiving slips.
• Technical Telemetry & Audit Logs: IP addresses, browser types, device signatures, session timestamps, operating system version, and API interaction logs required for SOC 2 Type II security monitoring.

2. Legal Bases & Purposes for Processing

Under global data protection laws (including GDPR Art. 6 and CCPA/CPRA), we process data based on the following legal grounds:

• Performance of Contract: Processing necessary to deliver procurement workflows, approve requisitions, generate purchase orders, and fulfill SaaS service agreements.
• Legitimate Business Interests: Maintaining platform security, detecting fraud, conducting audit logging, and optimizing platform performance.
• Compliance with Legal Obligations: Fulfilling tax, financial reporting, HIPAA audit, and regulatory record retention duties.
• Consent: Explicit user consent provided for receiving operational SMS notifications.

3. SOC 2 Type II Technical & Organizational Safeguards

In alignment with AICPA SOC 2 Type II standards, Vendoro maintains strict security controls:

• End-to-End Encryption: TLS 1.3 cryptographic protocols protect data in transit across public networks. FIPS 140-2 validated AES-256 bit encryption secures all databases, transaction logs, and storage backups at rest.
• Row-Level Tenant Segregation: Strict logical multi-tenant isolation policies prevent unauthorized cross-tenant data visibility.
• Least Privilege & SSO: Mandatory Role-Based Access Controls (RBAC), multi-factor authentication (MFA), and optional Enterprise SSO integration (SAML 2.0 / OAuth).
• Continuous Vulnerability Management: Daily automated vulnerability scans, quarterly third-party penetration tests, and 24/7 SIEM threat monitoring.

4. Information Sharing (IMPORTANT: SMS Consent) & Mobile Communication Disclosure

Vendoro strictly respects your privacy. No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

• Operational Use Only: Mobile phone numbers provided during user profile creation or administrator onboarding are used exclusively for operational notifications, such as multi-factor authentication (2FA) and purchase requisition approval alerts.
• No Third-Party Sharing: All text messaging originator opt-in data and consent will not be shared with any third parties or affiliates for marketing or promotional purposes under any circumstances.

5. HIPAA Compliance & Protected Health Information (PHI) Safeguards

For customers operating in healthcare environments subject to HIPAA and HITECH regulations:

• Business Associate Addendum (BAA): Vendoro enters into formal BAAs with covered entities to govern the handling of ePHI.
• Administrative & Physical Controls: Staff background checks, mandatory HIPAA security training, role-based restriction, and secure data center access controls.
• Technical Safeguards (45 CFR § 164.312): Automatic logoffs, audit logs, unique user identification, encrypted transmissions, and automated backup integrity verification.

6. PCI-DSS Payment Card Data Security

Vendoro complies with PCI-DSS v4.0 standards for financial transactions:

Payment transactions are tokenized directly via embedded PCI-DSS Level 1 certified gateways (e.g., Stripe, Authorize.net) over TLS 1.3 encrypted connections.

7. Subprocessors & Third-Party Service Providers

Vendoro engages vetted third-party subprocessors exclusively to support core platform functionality under strict contractual data protection agreements:

8. Consumer Privacy Rights (GDPR, CCPA & CPRA)

Depending on your location, you possess specific consumer privacy rights regarding your Personal Data:

• Right to Know / Access: Request details regarding the categories and specific pieces of personal information collected.
• Right to Rectification: Request correction of inaccurate or incomplete personal records.
• Right to Erasure (Right to be Forgotten): Request deletion of your personal data, subject to statutory record retention rules.
• Right to Data Portability: Obtain a copy of your personal data in a structured, machine-readable format (JSON/CSV).
• Right to Non-Discrimination: We will never discriminate against any user for exercising their legal privacy rights.

To submit a Data Subject Access Request (DSAR), please contact your Organization Administrator or email privacy@vendoro.ai.

9. Cookies & System Telemetry

Vendoro uses strictly necessary operational cookies and local storage tokens exclusively to maintain active user login sessions, store UI preferences, and preserve tenant context. We do not use third-party tracking cookies or advertising pixels.

10. International Data Transfers & EU-US Privacy Compliance

Customer Data is processed primarily in Microsoft Azure data centers located in the United States. For international data transfers from the EEA, UK, or Switzerland, Vendoro relies on Standard Contractual Clauses (SCCs) and EU-US Data Privacy Framework principles to ensure equivalent levels of protection.

11. Data Protection Officer & Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our security practices, please contact our Data Protection Officer: