Privacy Policy

1. Introduction

Vergabo ("Vergabo", "we", "us", or "our") is a business-to-business (B2B) procurement platform operated by Ecom Systems GmbH. The platform enables companies to publish Requests for Quotation (RFQs), discover qualified suppliers, exchange procurement-related information, receive quotations, compare offers, and manage sourcing workflows.

Protecting personal data and confidential business information is one of our core principles. We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), applicable national data protection laws, and other relevant legal requirements.

This Privacy Policy explains:

• what personal data we collect;
• how and why we process it;
• the legal basis for processing;
• how long information is retained;
• when information may be shared;
• what security measures we apply; and
• the rights available to individuals under applicable data protection laws.

This Privacy Policy applies to:

• the Vergabo website;
• all public and authenticated areas of the platform;
• company accounts;
• buyer and supplier workspaces;
• RFQs, quotations, procurement communications, and related services;
• customer support and business communications.

Certain platform features allow companies to decide which business information is publicly visible and which information remains available only to authorized users. Confidential procurement data, supplier quotations, private communications, and authenticated workspace content are processed separately from publicly accessible information.

By accessing or using Vergabo, you acknowledge that your personal data may be processed as described in this Privacy Policy.

2. Data Controller

The controller responsible for the processing of personal data under this Privacy Policy is:

Ecom Systems GmbH

Dombühl, Bavaria, Germany

Email: legal@vergabo.com

If you have questions regarding this Privacy Policy, the processing of your personal data, or your rights under applicable data protection laws, please contact us using the address above.

Where Vergabo processes personal data on behalf of business customers acting as independent controllers, each customer remains responsible for its own compliance with applicable data protection laws regarding the information it submits to the platform.

3. Information We Collect

The categories of personal and business information we collect depend on how you interact with Vergabo and which platform features you use.

3.1 Account Information

When you create an account or use authenticated services, we may collect:

• full name;
• business email address;
• encrypted authentication credentials managed through our authentication provider;
• preferred language;
• account preferences and notification settings;
• company role or user permissions.

We do not store plaintext passwords.

3.2 Company Information

Business users may voluntarily provide information describing their organization, including:

• company name;
• registered address;
• country;
• VAT or tax identification number (where applicable);
• company website;
• business description;
• industries served;
• manufacturing capabilities;
• certifications;
• supported languages;
• publicly displayed company profile information.

Companies determine which business information is made publicly visible through platform settings.

3.3 Procurement Information

When using Vergabo's procurement services, we process information necessary to operate the platform, including:

• Requests for Quotation (RFQs);
• procurement descriptions;
• technical specifications;
• attached documents and drawings;
• requested quantities;
• delivery requirements;
• deadlines;
• supplier quotations;
• procurement messages;
• procurement decisions;
• award information;
• Final Procurement Protocols and related procurement records.

Supplier quotations, private procurement communications, and confidential workspace data are not publicly accessible unless explicitly disclosed by the authorized user.

3.4 Communications

We collect information that you submit when communicating with us or with other platform users, including:

• customer support requests;
• procurement messages;
• email correspondence;
• system notifications;
• responses to verification requests.

Business communications exchanged through authenticated platform features are processed only for providing the requested services, maintaining platform security, and complying with applicable legal obligations.

3.5 Technical Information

When you access Vergabo, certain technical information may be collected automatically, including:

• IP address;
• browser type and version;
• operating system;
• device information;
• timestamps;
• referring pages;
• pages visited;
• diagnostic logs;
• security and authentication events.

This information is used to maintain platform security, detect abuse, troubleshoot technical issues, improve service reliability, and protect user accounts.

3.6 Cookies and Similar Technologies

Vergabo uses cookies and similar technologies necessary for authentication, security, language preferences, session management, and other essential platform functionality.

Where required by applicable law, non-essential cookies are used only after obtaining the appropriate user consent. Additional information is available in our Cookie Policy.

3.7 Information Generated Through Platform Use

As users interact with Vergabo, the platform may generate operational information such as:

• activity history;
• procurement workflow events;
• notification records;
• account verification status;
• audit logs;
• document processing metadata;
• system-generated identifiers required for secure platform operation.

These records are used exclusively for operating the platform, maintaining security, supporting customer service, complying with legal obligations, and improving the reliability and integrity of Vergabo's services.

4. How We Use Information

We use personal and business information only where necessary to provide, operate, improve, and secure the Vergabo platform and to comply with applicable legal obligations.

Depending on how you use the platform, we may process information for the following purposes.

4.1 Providing Platform Services

We use information to:

• create and manage user accounts;
• authenticate users and protect access to accounts;
• publish and manage Requests for Quotation (RFQs);
• enable supplier participation in procurement processes;
• exchange procurement-related communications;
• process quotations and procurement workflows;
• generate procurement documentation;
• maintain user preferences and platform settings.

4.2 Company Verification

Where applicable, we process company information to:

• verify business identities;
• reduce fraud and abuse;
• improve trust within the procurement network;
• support company verification features.

Verification does not constitute an endorsement or guarantee of any company, product, or service.

4.3 Communication

We use contact information to:

• respond to support requests;
• send service-related notifications;
• deliver account verification emails;
• send password reset instructions;
• notify users about procurement activity;
• communicate important changes to the platform or legal documentation.

We do not use transactional emails for unrelated marketing purposes.

4.4 Platform Security

We process technical and operational information to:

• detect unauthorized access;
• prevent fraud and abuse;
• investigate security incidents;
• monitor platform reliability;
• maintain audit logs;
• enforce our Terms of Use;
• protect users and the integrity of the platform.

4.5 AI-Assisted Features

Certain Vergabo features may use artificial intelligence to assist users with procurement-related tasks, including:

• extracting structured information from uploaded procurement documents;
• generating summaries;
• comparing quotations;
• recommending suppliers;
• improving procurement workflows.

AI-generated content is intended to assist users and does not constitute legal, commercial, financial, or procurement advice.

Users remain responsible for reviewing AI-generated output before making procurement or business decisions.

4.6 Improving Our Services

We may use aggregated and non-identifiable information to:

• improve platform performance;
• analyze feature usage;
• develop new functionality;
• improve usability and reliability;
• monitor system health.

Where reasonably possible, this information is processed in aggregated or de-identified form.

4.7 Legal Compliance

We may process information where necessary to:

• comply with applicable laws;
• respond to lawful requests from competent authorities;
• establish, exercise, or defend legal claims;
• enforce contractual rights;
• comply with accounting, tax, and regulatory obligations.

5. Legal Bases for Processing

Where the GDPR applies, Vergabo processes personal data only where a valid legal basis exists under Article 6 GDPR.

Depending on the circumstances, processing may rely on one or more of the following legal bases.

5.1 Performance of a Contract

We process personal data where necessary to provide the services requested by users, including:

• creating and maintaining accounts;
• providing procurement functionality;
• enabling buyer and supplier interactions;
• delivering notifications;
• processing RFQs and quotations;
• providing customer support.

5.2 Compliance with Legal Obligations

We may process personal data where necessary to comply with applicable legal requirements, including obligations relating to:

• accounting;
• taxation;
• fraud prevention;
• regulatory compliance;
• lawful requests from public authorities.

5.3 Legitimate Interests

We may process personal data where necessary for our legitimate interests, provided such interests are not overridden by the rights and freedoms of individuals.

These interests include:

• protecting platform security;
• preventing fraud and abuse;
• maintaining service availability;
• improving platform functionality;
• verifying business users;
• protecting the integrity of procurement processes;
• defending legal claims.

5.4 Consent

Where required by applicable law, we process personal data based on your consent.

Examples may include:

• optional cookies;
• future optional marketing communications;
• other features where consent is legally required.

Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

6. Company and Business Information

Vergabo is designed for business users participating in commercial procurement activities.

Companies may voluntarily provide business information to create public or private company profiles and participate in procurement processes.

Such information may include:

• company name;
• business address;
• website;
• industries;
• manufacturing capabilities;
• certifications;
• supported languages;
• company description;
• publicly visible contact information;
• other business profile information voluntarily submitted by the company.

Each company determines which business information is made publicly available through platform settings.

Procurement-related information submitted through authenticated workspaces, including supplier quotations, private procurement communications, internal notes, and confidential attachments, is not publicly disclosed unless the authorized user explicitly chooses to publish such information or disclosure is otherwise required by applicable law.

Where company verification features are available, Vergabo may process additional business information to confirm the authenticity of an organization. Verification is intended to improve trust within the platform and does not constitute certification, endorsement, financial assessment, or a guarantee of future performance.

Business users are responsible for ensuring that the information they submit to Vergabo is accurate, up to date, and that they have the necessary authority to provide such information on behalf of their organization.

7. Cookies and Similar Technologies

Vergabo uses cookies and similar technologies to provide essential platform functionality, improve user experience, maintain security, and ensure the reliable operation of our services.

Cookies are small text files stored on your device when you visit our website. Some cookies are strictly necessary for the operation of the platform, while others may be used only with your consent where required by applicable law.

7.1 Essential Cookies

Essential cookies are necessary for the operation of Vergabo and cannot be disabled through our platform. These cookies may be used to:

• authenticate users;
• maintain secure login sessions;
• protect against unauthorized access;
• remember language and localization preferences;
• provide essential platform functionality;
• ensure platform security and reliability.

Because these cookies are necessary for the operation of the service, they are processed on the basis of our legitimate interest or the performance of a contract, as applicable.

7.2 Optional Cookies

Where required by applicable law, Vergabo requests your consent before using non-essential cookies or similar technologies.

If optional analytics or functionality cookies are introduced in the future, they will only be activated after obtaining the appropriate consent through our cookie preferences.

You may withdraw or modify your cookie preferences at any time.

7.3 Managing Cookies

Most web browsers allow users to control or delete cookies through browser settings.

Please note that disabling essential cookies may affect the availability or functionality of certain features of the Vergabo platform.

Additional information regarding cookies and consent preferences may be provided through our Cookie Policy.

8. AI-Assisted Processing

Vergabo may use artificial intelligence ("AI") technologies to assist users with procurement-related workflows and improve the efficiency of the platform.

AI features are designed to support users and are not intended to replace human judgment or decision-making.

AI-assisted processing may include:

• extracting structured information from uploaded procurement documents;
• generating summaries of procurement content;
• comparing supplier quotations;
• recommending suppliers based on procurement requirements;
• identifying potentially relevant procurement information;
• supporting document analysis and procurement workflows.

AI-generated content is provided solely as an informational and productivity-enhancing tool.

Users remain fully responsible for reviewing, verifying, and approving all AI-generated information before relying on it for procurement, contractual, commercial, technical, or legal decisions.

Vergabo does not guarantee the completeness, accuracy, or suitability of AI-generated output.

Where AI services are provided through third-party providers, only the information necessary to deliver the requested functionality is processed, and appropriate contractual and technical safeguards are applied where required by applicable law.

Vergabo does not use AI to make solely automated decisions that produce legal effects or similarly significant effects on individuals within the meaning of Article 22 GDPR.

Final procurement decisions, supplier selection, contract awards, and other commercial decisions are made exclusively by the authorized users of the platform.

9. Data Sharing

Vergabo does not sell personal data.

We may share personal or business information only where necessary to provide our services, comply with legal obligations, protect our legitimate interests, or where authorized by the user.

9.1 Service Providers

We work with carefully selected service providers who process information on our behalf in accordance with applicable data protection laws.

These providers may include services supporting:

• cloud infrastructure;
• database hosting;
• authentication;
• secure file storage;
• transactional email delivery;
• platform hosting;
• customer support;
• security monitoring.

Service providers process personal data only on our documented instructions and only to the extent necessary to provide their respective services.

9.2 Procurement Participants

Information submitted through the platform may be shared with other authorized participants in a procurement process where necessary to provide the requested functionality.

For example:

• buyers may receive supplier quotations submitted through the platform;
• suppliers may receive procurement information published by buyers;
• users participating in the same procurement process may exchange procurement-related communications.

Supplier quotations, private procurement communications, confidential attachments, and authenticated workspace information are not made publicly available unless explicitly published by the authorized user or otherwise required by applicable law.

9.3 Legal Requirements

We may disclose personal information where required to:

• comply with applicable laws or regulations;
• respond to lawful requests from courts, regulators, or public authorities;
• establish, exercise, or defend legal claims;
• investigate fraud, abuse, or security incidents;
• protect the rights, property, safety, or security of Vergabo, our users, or third parties.

9.4 Business Transfers

If Vergabo or Ecom Systems GmbH becomes involved in a merger, acquisition, restructuring, financing, sale of assets, or similar corporate transaction, personal data may be transferred as part of that transaction, subject to appropriate confidentiality and legal safeguards.

Where required by applicable law, affected users will be informed of such changes.

9.5 Public Information

Certain information intentionally designated as public by users or companies may be accessible to visitors and search engines.

Examples may include:

• publicly visible company profile information;
• publicly published Requests for Quotation (RFQs);
• publicly available procurement summaries;
• other information that users explicitly choose to make publicly available through the platform.

Information that is not intentionally designated as public, including supplier quotations, private messages, confidential documents, and authenticated workspace content, is not publicly disclosed by Vergabo except where required by applicable law or with the authorization of the relevant user.

10. International Data Transfers

Vergabo primarily processes personal data within the European Economic Area ("EEA").

Where it is necessary to transfer personal data outside the EEA or another jurisdiction with applicable data transfer restrictions, Vergabo implements appropriate safeguards in accordance with applicable data protection laws.

Such safeguards may include:

• adequacy decisions adopted by the European Commission;
• the European Commission's Standard Contractual Clauses (SCCs);
• supplementary technical and organizational measures where appropriate;
• other legally recognized transfer mechanisms.

Where third-party service providers process personal data on our behalf, we take reasonable steps to ensure that such providers maintain an appropriate level of security and comply with applicable data protection requirements.

International transfers are limited to the information necessary to provide the requested services and are performed only where a valid legal basis exists.

11. Data Retention

Vergabo retains personal and business information only for as long as necessary to fulfill the purposes described in this Privacy Policy, comply with applicable legal obligations, resolve disputes, enforce agreements, and maintain the security and integrity of the platform.

Retention periods depend on the type of information and the services used.

Examples include:

• account information for the duration of an active account and for a limited period thereafter where required for legal, security, or operational purposes;
• company profile information while the company maintains an active presence on the platform;
• procurement records for the period necessary to support procurement workflows, contractual obligations, dispute resolution, and legal compliance;
• technical logs, security events, and audit records for periods appropriate to security monitoring, fraud prevention, and legal obligations;
• customer support communications for the period reasonably necessary to resolve requests and maintain service quality.

Certain procurement-related documents may be retained according to platform-specific retention policies applicable to the relevant workflow. Where such policies are published within the platform, they form part of this Privacy Policy.

When personal data is no longer required, it is deleted, anonymized, or securely disposed of using reasonable technical and organizational measures, unless continued retention is required or permitted by applicable law.

12. Data Security

Vergabo implements appropriate technical and organizational measures designed to protect personal data and confidential business information against unauthorized access, disclosure, alteration, loss, or destruction.

Our security program includes measures appropriate to the nature of the services provided and may include:

• encryption of data in transit using industry-standard TLS;
• encrypted storage of authentication credentials by our authentication provider;
• role-based access controls;
• the principle of least privilege;
• Row Level Security (RLS) for database access where appropriate;
• authentication and authorization controls;
• secure server-side processing for sensitive operations;
• audit logging and security monitoring;
• infrastructure hardening;
• regular security updates and maintenance;
• backup and disaster recovery procedures appropriate for platform operations.

Access to personal data is limited to authorized personnel and trusted service providers who require such access to perform their responsibilities and who are subject to appropriate confidentiality obligations.

Although Vergabo applies commercially reasonable safeguards to protect personal data, no method of electronic transmission or storage can be guaranteed to be completely secure. Consequently, we cannot guarantee absolute security.

Users are also responsible for maintaining the confidentiality of their account credentials, using strong passwords, protecting access to their devices, and notifying Vergabo promptly if they believe their account has been compromised.

In the event of a personal data breach, Vergabo will take appropriate measures in accordance with applicable law, including notification of competent supervisory authorities and affected individuals where required by the GDPR or other applicable legislation.

13. Your Rights

Depending on your location and the applicable data protection laws, you may have certain rights regarding the processing of your personal data.

Subject to applicable legal requirements, these rights may include:

• the right to obtain confirmation of whether we process your personal data;
• the right to access your personal data;
• the right to request correction of inaccurate or incomplete information;
• the right to request deletion of your personal data;
• the right to request restriction of processing;
• the right to object to certain processing activities;
• the right to data portability where technically feasible;
• the right to withdraw consent where processing is based on consent;
• the right not to be subject to unlawful discrimination for exercising your privacy rights where applicable.

You may exercise your rights by contacting us using the contact information provided in this Privacy Policy.

Before responding to certain requests, we may need to verify your identity in order to protect the security of personal data and prevent unauthorized disclosure.

Please note that certain rights may be limited where processing is necessary to comply with legal obligations, establish or defend legal claims, prevent fraud or abuse, protect the rights of others, or continue providing services requested by our users.

If you believe that our processing of your personal data violates applicable data protection laws, you also have the right to lodge a complaint with the competent supervisory authority.

14. Public Procurement Content

Vergabo is designed to facilitate business-to-business procurement. Certain procurement information may therefore be intentionally made publicly available by buyers in order to receive quotations from suppliers and improve procurement transparency.

Publicly available information may include, depending on the buyer's selected visibility settings and the functionality of the platform:

• Request for Quotation (RFQ) title;
• procurement description;
• industry or category;
• delivery country or region;
• procurement deadlines;
• publicly visible attachments or summaries where intentionally published;
• buyer company name where the buyer has chosen to disclose it;
• other procurement information explicitly designated as public by the buyer.

Public RFQs may be indexed by search engines and may appear in search results or AI-powered search experiences where permitted by applicable search engine policies.

Information that is not designated as public is not intentionally disclosed by Vergabo. This includes, for example:

• supplier quotations;
• quoted prices and commercial terms;
• supplier identities where not publicly disclosed;
• private procurement communications;
• confidential attachments;
• internal procurement notes;
• authenticated workspace content;
• user account information.

Users are responsible for ensuring that they do not intentionally publish confidential, proprietary, trade secret, or personal information unless they are authorized to do so.

Vergabo provides platform controls that allow users to determine which procurement information is publicly visible and which information remains accessible only to authorized participants.

15. Automated Decision Making

Vergabo may use automated technologies, including artificial intelligence, to assist users with procurement-related tasks and improve the efficiency of platform workflows.

Examples may include:

• extracting structured information from procurement documents;
• generating document summaries;
• identifying potentially relevant suppliers;
• comparing procurement information;
• supporting search and recommendation features.

These technologies are designed solely to assist users.

Vergabo does not use solely automated decision-making, including profiling, to make decisions that produce legal effects or similarly significant effects on individuals within the meaning of Article 22 GDPR.

Procurement decisions---including supplier selection, quotation evaluation, contract awards, and purchasing decisions---are made exclusively by the authorized users of the platform.

AI-generated content, recommendations, classifications, comparisons, and summaries are provided for informational purposes only and should be reviewed by users before being relied upon for commercial, contractual, technical, financial, or legal decisions.

Users remain solely responsible for all procurement and business decisions made through the platform.

16. Children's Privacy

Vergabo is a business-to-business (B2B) platform intended exclusively for companies, business professionals, and other organizations engaged in commercial procurement activities.

Our services are not directed to children, and we do not knowingly collect personal data from individuals under the age of 18 or from any person who is not legally authorized to use the platform on behalf of a business or organization.

If we become aware that personal data has been collected from a child or another individual who is not permitted to use the platform under applicable law, we will take reasonable steps to delete such information without undue delay, unless its retention is required by law.

If you believe that a child has provided personal data to Vergabo, please contact us using the contact information provided below.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in:

• applicable laws or regulatory requirements;
• our services or platform functionality;
• security practices;
• data processing activities;
• business operations; or
• other legitimate operational or legal reasons.

When we make material changes to this Privacy Policy, we will update the "Last updated" date at the top of this document and, where required by applicable law, provide appropriate notice through the platform or by other reasonable means.

The most current version of this Privacy Policy will always be available on the Vergabo website.

Your continued use of Vergabo after the effective date of an updated Privacy Policy constitutes your acknowledgment of the revised policy, except where applicable law requires additional consent.

18. Contact

If you have questions about this Privacy Policy, our privacy practices, or the processing of your personal data, please contact us:

Ecom Systems GmbH

Dombühl, Bavaria, Germany

Privacy & Legal

legal@vergabo.com

General Information

info@vergabo.com

Customer Support

support@vergabo.com

If you wish to exercise your rights under applicable data protection laws, please contact legal@vergabo.com. We will respond to your request within the time limits required by applicable law.

For security-related matters, including the reporting of suspected vulnerabilities or security incidents affecting the Vergabo platform, please contact us at info@vergabo.com.

We are committed to handling privacy and security inquiries promptly, transparently, and in accordance with applicable data protection laws.