1. Who controls your data
Vendorlink MMC (“VendorLink”), [REGISTERED ADDRESS], Baku, Azerbaijan, VÖEN [VÖEN], is the controller of the personal data described in this policy. For any privacy question, or to exercise the rights in section 8, contact [PRIVACY EMAIL].
This policy explains what we collect, why, who we share it with, and what you can do about it. It applies to vendorlink.az and related services.
2. What we collect
- Account data: name, business name, role, email address, phone number, password (stored hashed), and for Suppliers the company details and documents listed in the Supplier Verification Policy (registration extract, VÖEN, authorised contact person).
- Request and offer data: the content of RFQs you send or receive, quotations, specifications, quantities, delivery locations and messages exchanged through the Platform.
- Transaction data (Phase 2): orders, invoices, amounts, and payment status. Card details are handled by our payment provider and are not stored by us.
- Technical data: IP address, browser and device type, pages visited, dates and times, and similar log data, including cookies as described in the Cookie Policy.
- Correspondence: messages you send us by email, contact form, WhatsApp or phone, including support and dispute records.
3. Why we use it, and on what basis
- To provide the Platform — creating your account, showing listings, routing RFQs to relevant Suppliers, delivering offers back to Buyers. Basis: performance of our contract with you.
- To verify Suppliers — confirming a business exists and that its contact is genuine, so Buyers are not exposed to fake sellers. Basis: our legitimate interest in a trustworthy marketplace, and your consent where you submit documents.
- To keep the Platform safe — detecting fraud, abuse, spam and security incidents. Basis: legitimate interest and legal obligation.
- To process orders and payments (Phase 2) — including invoicing, commission and refunds. Basis: contract and legal obligation (accounting and tax).
- To communicate — service messages, changes to terms, responses to your questions. Basis: contract and legitimate interest.
- Marketing — newsletters or product updates, only where you have opted in. Basis: consent. You can withdraw it at any time via the unsubscribe link or by emailing [PRIVACY EMAIL].
4. What other users see
This is the part that matters most on a marketplace. When you send an RFQ, the Suppliers you address it to — or, where you allow it, Suppliers we match to it — receive its content and the contact details needed to quote. When you publish a Supplier profile or listing, that information is public. Do not put personal data in a listing or RFQ that you are not willing to share with the other side.
5. Who else we share it with
- Hosting and infrastructure: our server is operated by Contabo GmbH (Germany).
- Email delivery: [EMAIL PROVIDER], for account and notification emails.
- Payment provider (Phase 2): [PAYMENT PROVIDER], which processes card and bank data under its own privacy terms.
- Professional advisers and authorities: accountants, lawyers, or state bodies where we are legally required to disclose.
We do not sell personal data.
6. Transfers outside Azerbaijan
Some providers above are located outside the Republic of Azerbaijan (for example, hosting in the European Union). Where personal data is transferred abroad we take the steps required by the Law of the Republic of Azerbaijan “On Personal Data” and, where the data relates to individuals in the EU, by the GDPR — including contractual safeguards with the provider.
7. How long we keep it
- Account and profile data: while your account is active, then [RETENTION: ACCOUNT] after closure.
- RFQs, offers and messages: [RETENTION: RFQ] from creation, so both sides can evidence what was agreed.
- Invoices and accounting records: as required by Azerbaijani tax law, currently 5 years.
- Server and security logs: [RETENTION: LOGS].
8. Your rights
Subject to the conditions in applicable law, you may ask us to: confirm what data we hold about you and give you a copy; correct inaccurate data; delete data where we no longer need it; restrict or object to certain processing; and withdraw consent where processing is based on it. Write to [PRIVACY EMAIL] — we respond within [RESPONSE DAYS] days. If you are not satisfied, you may complain to the data protection authority of the Republic of Azerbaijan.
9. Security
The site is served over HTTPS, passwords are stored hashed, administrative access is restricted, and the server is firewalled and kept updated. No system is perfectly secure; if a breach affects your personal data we will notify you and the competent authority as required by law.
10. Children
The Platform is for businesses. We do not knowingly collect data from anyone under 18.
11. Changes
We may update this policy. Material changes will be notified to registered users by email or on-Platform notice before they take effect.
12. Contact
Vendorlink MMC, [REGISTERED ADDRESS], Baku, Azerbaijan · [PRIVACY EMAIL]