Legal
Privacy Policy
Last updated: [date of publication]
On this page
1. Who we are
This Privacy Policy explains how BoreaTech S.r.l. ("BoreaTech", "we", "us") processes personal data when you visit supplierforge.com (the "Website") and when you or your organisation use the SupplierForge platform at app.supplierforge.com (the "Platform"). SupplierForge is a product of BoreaTech.
BoreaTech S.r.l., registered office [address], Bergamo, Italy, VAT [number], REA [number]. Privacy contact: privacy@supplierforge.com.
We process personal data in compliance with Regulation (EU) 2016/679 ("GDPR"), Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018, and other applicable data protection laws.
2. Our role: controller or processor
We act as controller for: data about visitors to the Website; contact form submissions; the account details of people who use the Platform (name, work email, role, login records); billing contacts; and communications with customers and prospects.
We act as processor for the content a customer (a supplier organisation) places in the Platform: product and catalog data, price books, buyer-specific fields, credentials for buyer systems, delivered files and run logs, and the details of the users the customer designates. For that content the customer is the controller, and we process it only on the customer's instructions under the Data Processing Agreement that forms part of every subscription. Requests from individuals about content a customer controls are passed to that customer.
3. Data we collect
3.1 Website visitors. Technical data collected by our hosting and security provider: IP address, browser type and version, operating system, pages visited, referring page, date and time of access. Cookies: only strictly necessary cookies set by Cloudflare for security and performance (for example __cf_bm, cf_clearance). We use no analytics, advertising or tracking cookies.
3.2 Contact form. Name, work email, company, country (optional), what you are interested in (quote, demo, security pack or other), how many buyers you deliver to (optional), which procurement systems your buyers use (optional), your message, and the source of your visit (a short code from the link you used to reach the Website, or the referring site's name) so that we know which of our channels brought you to us.
3.3 Platform users. We receive the name, work email address and role of each user from the customer organisation, which asks us to create the account; there is no self-service registration. We then hold: name, work email, role within the customer organisation, password hash, multi-factor authentication secret (encrypted), login and session records, IP address (masked before storage), actions taken in the Platform (audit log), notification preferences and consent records.
3.4 Customer content (processed on the customer's behalf). Product catalog data, prices and price books per buyer, buyer templates and categories, credentials for buyer systems (encrypted), files uploaded and files delivered to buyers, files exchanged through an SFTP location we host for the customer, run logs. Customer content may incidentally contain personal data such as contact names at a buyer; we process it only as instructed.
3.5 Billing and contract data. Company details, billing contact, invoices, payment records. Card payments are handled by Stripe; we do not store card numbers.
3.6 Security and incident reports. Reports sent to security@supplierforge.com, including the reporter's contact details.
4. Why we process it and on what legal basis
| Purpose | Data | Legal basis (GDPR Art. 6) |
|---|---|---|
| Answering quote, demo and security pack requests | Contact form data | Art. 6(1)(b), pre-contractual steps at your request |
| Providing the Platform to customers and their users | Platform user data, customer content (as processor) | Art. 6(1)(b), performance of the contract; for customer content, the customer's instructions |
| Account security: authentication, MFA, lockout, audit log | Platform user data, masked IP | Art. 6(1)(f), legitimate interest in securing the service; Art. 6(1)(c) where required |
| Delivering and securing the Website | Technical data, security cookies | Art. 6(1)(f), legitimate interest in security and performance |
| Billing and accounting | Billing data | Art. 6(1)(b) and Art. 6(1)(c), legal obligations on invoicing and tax |
| Service communications (invoices, security notices, changes to terms) | Contact details | Art. 6(1)(b) and Art. 6(1)(f) |
| Marketing communications | Contact details | Art. 6(1)(a), consent, withdrawable at any time |
| Handling security reports | Reporter details | Art. 6(1)(f), legitimate interest in the security of the service |
| Compliance with legal obligations and defence of claims | Any of the above as required | Art. 6(1)(c) and Art. 6(1)(f) |
We do not use personal data for automated decision-making with legal or similarly significant effects, and we do not sell personal data.
5. Who we share it with
We share personal data only with the service providers listed below and only as needed to provide the service. They act as our processors under written agreements, except Stripe, which acts as an independent controller for card payments under its own privacy policy:
| Provider | Purpose | Location and safeguards |
|---|---|---|
| Fly.io, Inc. | Application hosting and databases | EU region (Amsterdam) by default; US entity, Standard Contractual Clauses |
| Cloudflare, Inc. | Website hosting, DNS, edge security, object storage for files and backups | EU jurisdiction for storage; EU-U.S. Data Privacy Framework and Standard Contractual Clauses |
| Upstash, Inc. | Redis (caching, queues, rate limiting) | EU region (Amsterdam); US entity, Standard Contractual Clauses |
| Plus Five Five, Inc. (Resend) | Transactional email | United States; Standard Contractual Clauses |
| Functional Software, Inc. (Sentry) | Error tracking, no request bodies or credentials | EU instance, Frankfurt, Germany (de.sentry.io) |
| Healthchecks.io | Monitoring of scheduled jobs (no personal data beyond operator alerts) | Riga, Latvia, EU |
| Stripe Payments Europe, Ltd. | Card payments | Ireland; Stripe acts as independent controller for payment data |
| Hetzner Online GmbH | SFTP server for file delivery to buyer systems and SFTP locations hosted for customers | Finland, EU |
We update this list before adding a sub-processor and notify customers under the Data Processing Agreement. We may also disclose personal data where required by law, regulation or legal process, or to establish, exercise or defend legal claims.
6. International transfers
The Platform and its backups are hosted in the European Union by default. Where a provider processes data outside the EU or EEA, the transfer relies on an adequacy decision (including the EU-U.S. Data Privacy Framework where the provider is certified) or on the European Commission's Standard Contractual Clauses, together with the provider's technical and organisational safeguards. Customers who need hosting in another region can request it; the applicable transfer safeguards are set out in the order form.
7. How long we keep it
| Data | Retention |
|---|---|
| Contact form submissions | Up to 24 months after our last exchange, unless you ask for earlier deletion |
| Website technical data (Cloudflare) | Per Cloudflare's retention, typically no longer than [72 hours] |
| Platform user accounts | For the duration of the subscription and [90 days] after termination, then deleted or anonymised |
| Audit logs | [7 years] from the event, for security and accountability, then archived or deleted |
| Customer content | For the duration of the subscription; deleted within [30 days] after termination, with written confirmation; encrypted backups expire after the backup retention period that applies to the customer's data, which is [30 days] unless the order form states otherwise |
| Delivered files and run logs | [13 months] from delivery, or as agreed in the order form |
| Files on a customer SFTP location | Live folder 30 days by default (at most 120 days at the customer's request), archive copies 90 days by default; then deleted automatically |
| Billing records | 10 years, as required by Italian tax law |
| Security reports | 24 months after closure of the report |
8. How we protect it
Traffic to the Website and the Platform is encrypted in transit. Credentials, API keys and secrets are encrypted at rest. Access to the Platform is role-based and scoped to each customer; multi-factor authentication is available to every user and enforced for administrators. Logins, configuration changes and approvals are logged. Backups are encrypted before they leave the environment. Our security page at supplierforge.com/security describes the measures in more detail.
9. Your rights
Under the GDPR you may ask us for access to your personal data (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), and you may object to processing based on legitimate interests (Art. 21) and withdraw consent at any time (Art. 7(3)). Write to privacy@supplierforge.com. We answer within one month; where a request is complex we may extend by up to two further months and will tell you why. Platform users can export their personal data and request deletion from within the Platform.
Where we act as processor, we forward your request to the customer that controls the data and assist them in answering it.
10. Complaints
You may lodge a complaint with a supervisory authority. In Italy: Garante per la Protezione dei Dati Personali, Piazza Venezia 11, 00187 Roma, garanteprivacy.it, protocollo@gpdp.it. You may also complain to the authority of your country of residence or work.
11. Children
The Website and the Platform are for business use and are not directed at anyone under 16. We do not knowingly collect personal data from children.
12. Third-party links
The Website may link to third-party sites. Their privacy practices are their own; please read their policies.
13. Changes to this policy
We may update this policy to reflect changes in our practices, the Platform or the law. The date at the top shows the latest revision. Material changes are announced on the Website and, for customers, by email to the billing contact.
14. Contact
BoreaTech S.r.l., [address], Bergamo, Italy. Privacy: privacy@supplierforge.com. General: info@supplierforge.com. Security reports: security@supplierforge.com.