Privacy Policy

1. Who controls your data

VendorLink MMC (“VendorLink”) is the controller of the personal data described in this policy. For any privacy question, or to exercise the rights in section 8, contact info@vendorlink.az.

This policy explains what we collect, why, who we share it with, and what you can do about it. It applies to vendorlink.az and related services.

2. What we collect

• Account data: name, business name, role, email address, phone number, password (stored hashed), and for Suppliers the company details and documents listed in the Supplier Verification Policy (registration extract, VÖEN, authorised contact person).
• Request and offer data: the content of RFQs you send or receive, quotations, specifications, quantities, delivery locations and messages exchanged through the Platform.
• Technical data: IP address, browser and device type, pages visited, dates and times, and similar log data, including cookies as described in the Cookie Policy.
• Correspondence: messages you send us by email, contact form, WhatsApp or phone, including support and dispute records.

3. Why we use it, and on what basis

• To provide the Platform — creating your account, showing listings, routing RFQs to relevant Suppliers, delivering offers back to Buyers. Basis: performance of our contract with you.
• To verify Suppliers — confirming a business exists and that its contact is genuine, so Buyers are not exposed to fake sellers. Basis: our legitimate interest in a trustworthy Platform, and your consent where you submit documents.
• To keep the Platform safe — detecting fraud, abuse, spam and security incidents. Basis: legitimate interest and legal obligation.
• To answer contact-form enquiries — the name and phone number you enter in the form on the contact page, together with any email, company, position and message you choose to add, are used only to answer your enquiry and to get back to you. The form is not stored in the site database; the enquiry is emailed to the company mailbox. Basis: the explicit consent you give before submitting the form. You can withdraw it at any time by writing to the address in section 12.
• To communicate — service messages, changes to terms, responses to your questions. Basis: contract and legitimate interest.
• Marketing — newsletters or product updates, only where you have opted in. Basis: consent. You can withdraw it at any time via the unsubscribe link or by emailing info@vendorlink.az.

4. What other users see

This is the part that matters most on the Platform. When you send an RFQ, the Suppliers you address it to — or, where you allow it, Suppliers we match to it — receive its content and the contact details needed to quote. When you publish a Supplier profile or listing, that information is public. Do not put personal data in a listing or RFQ that you are not willing to share with the other side.

5. Who else we share it with

• Hosting and infrastructure: our server is operated by Contabo GmbH (Germany).
• Professional advisers and authorities: accountants, lawyers, or state bodies where we are legally required to disclose.

We do not sell personal data.

6. Transfers outside Azerbaijan

Some providers above are located outside the Republic of Azerbaijan (for example, hosting in the European Union). Where personal data is transferred abroad we take the steps required by the Law of the Republic of Azerbaijan “On Personal Data” and, where the data relates to individuals in the EU, by the GDPR — including contractual safeguards with the provider.

7. How long we keep it

• Account and profile data: while your account is active, then 5 years after closure.
• RFQs, offers and messages: while the request is active, plus 5 years after it is deactivated. A request is deactivated automatically 30 days after it is posted; if the Buyer chose a later date when creating it, it is deactivated on that date instead. If the Buyer reopens the request, the 5 years run from the most recent deactivation. This period lets either side later evidence what was agreed.
• Contact-form enquiries: not stored in the site database — your enquiry is emailed to the company mailbox and remains there as correspondence. They are kept for 12 months from the date of the enquiry and then deleted; you can ask us to delete yours sooner at any time.
• Invoices and accounting records: as required by Azerbaijani tax law, currently 5 years.

8. Your rights

Subject to the conditions in applicable law, you may ask us to: confirm what data we hold about you and give you a copy; correct inaccurate data; delete data where we no longer need it; restrict or object to certain processing; and withdraw consent where processing is based on it. Write to info@vendorlink.az — we respond within 30 days. If you are not satisfied, you may complain to the data protection authority of the Republic of Azerbaijan.

9. Security

The site is served over HTTPS, passwords are stored hashed, administrative access is restricted, and the server is firewalled and kept updated. No system is perfectly secure; if a breach affects your personal data we will notify you and the competent authority as required by law.

10. Children

The Platform is for businesses. We do not knowingly collect data from anyone under 18.

11. Changes

We may update this policy. Material changes will be notified to registered users by email or on-Platform notice before they take effect.

12. Contact

VendorLink MMC, Baku, Azerbaijan · info@vendorlink.az