Your data is not the product.

1. Controller and contact

The controller is [Legal entity required], [Registered address required], represented by [Authorized representative required]. Privacy requests: privacy@vendorduel.example.

2. Data we process

• Account data: business email, name, locale, authentication identifiers, and workspace membership.
• Business data: organization name, website, country, contacts, vendor profile, and approval state.
• Duel and offer data: software spend, requirements, commercial terms, decisions, and communications submitted through the service.
• Verification data: evidence metadata and private verification files. Vendors never receive those files.
• Transaction data: Stripe checkout, payment, receipt, and refund identifiers. VendorDuel does not store full card details.
• Security data: session information, timestamps, audit events, abuse reports, and technical request data.

3. Purposes and legal bases

• Provide accounts, Duels, offers, selections, payments, and introductions: performance of the service agreement.
• Verify buyers and vendors, prevent fraud, enforce marketplace rules, and secure the service: legitimate interests in a trustworthy B2B marketplace.
• Invoices, transaction evidence, regulatory responses, and accounting: legal obligations.
• Publish a verified Win or send optional marketing: explicit, withdrawable consent. Service access is not conditional on this consent.

4. Sharing and international transfers

Data is shared only as needed with infrastructure and authentication providers, Stripe for payments, transactional email providers, professional advisers, and authorities where legally required. Buyer and vendor identities are exchanged only after a paid introduction. Where a provider processes data outside the EEA, we use an applicable adequacy decision or approved transfer safeguards.

5. Retention

• Verification files: scheduled for deletion after 30 days unless an active fraud, dispute, or legal hold requires longer retention.
• Unsuccessful draft or rejected marketplace records: minimized or deleted when no longer operationally necessary.
• Contracts, payments, invoices, and related audit evidence: retained for the applicable statutory period.
• Account and workspace data: retained while active, then deleted or anonymized subject to transaction, dispute, security, and legal-retention requirements.
• Published Wins: remain public until consent is withdrawn or continued publication is no longer justified.

6. Your rights

Depending on applicable law, you may request access, correction, deletion, restriction, portability, or object to processing. You may withdraw consent at any time without affecting earlier lawful processing. You may also complain to [Competent data-protection authority required] or another competent supervisory authority.

Export data or request deletion →

7. Security and automated decisions

We use access controls, row-level database policies, private document storage, immutable offer versions, payment webhooks, and administrative audit logs. VendorDuel does not make solely automated decisions producing legal or similarly significant effects.

8. Changes

Material changes will be announced in the service. The version date above identifies the notice that applies.