1. Introduction
Welcome to www.vendor-onboarding.info (the “Website”).
This Privacy Policy explains how the organisation legally responsible for operating this Website (“we”, “us”, “our” or the “Platform Operator”) collects, uses, stores, protects and discloses personal information in connection with vendor engagement, supplier qualification, registration, due diligence and procurement-related communications.
We recognise the importance of protecting the personal and business information entrusted to us.
This Policy applies to website visitors, prospective suppliers, registered vendors, authorised company representatives, procurement contacts and individuals communicating with the Platform Operator.
2. Scope of This Privacy Policy
This Policy applies to personal information processed through:
- Website visits and enquiry forms.
- Expression of Interest (EOI) submissions.
- Supplier identification and preliminary assessments.
- Vendor registration and account administration.
- Know Your Customer (KYC) and due-diligence processes.
- Supplier classification and procurement communications.
- Tender enquiries and related correspondence.
- Email campaigns, notifications and supplier engagement.
- Authorised vendor portal activities.
3. Information We May Collect
Depending on the nature of the interaction, we may collect the following information.
We aim to limit collection to information reasonably necessary for the stated purpose.
4. How We Collect Information
We may obtain information:
- 1Directly from individuals completing forms, submitting documents or contacting us.
- 2From companies nominating representatives for supplier engagement.
- 3Through supplier registration and qualification activities.
- 4From publicly accessible business directories and corporate websites.
- 5From business contact databases and other lawful third-party sources.
- 6Automatically through Website and portal technologies, where enabled.
When information is obtained indirectly, we will provide applicable privacy information and honour relevant individual rights as required by law.
5. Purposes of Processing Personal Information
We process information for legitimate and clearly defined business purposes, including:
6. Legal Bases for Processing
Where required by applicable data protection law, we rely on one or more appropriate legal bases, including:
- Consent: Where an individual has freely provided valid consent for a specific processing activity.
- Contractual necessity: Where processing is necessary to enter into or perform an agreement.
- Legitimate interests: Where processing supports lawful business operations, supplier engagement, security or relevant professional communications, subject to applicable safeguards and individual rights.
- Legal obligations: Where information must be processed to meet applicable regulatory or statutory requirements.
We will not rely on legitimate interests where that basis is unavailable or inappropriate under applicable law.
7. Email Communications and Supplier Outreach
The Platform Operator may communicate with prospective and registered suppliers regarding qualification procedures, registration requirements, EOIs, procurement-related enquiries and relevant service notifications.
Communications may be facilitated by contracted email delivery or campaign-management providers.
Depending on the tools enabled, such providers may process recipient email addresses, message content, delivery logs, bounce information and engagement events on our behalf.
Recipients may opt out of non-essential outreach communications through an available unsubscribe mechanism or by contacting our designated privacy address.
Opting out of promotional or prospecting communications will not necessarily prevent essential administrative, security, contractual or legally required notifications.
We will comply with applicable rules governing electronic marketing and business communications.
9. Disclosure of Personal Information
We may share relevant information with authorised recipients when reasonably necessary for the purposes described in this Policy. Recipients may include:
We do not authorise service providers to use personal information for unrelated purposes outside their permitted contractual or legal roles.
We will not sell personal information for independent third-party marketing purposes.
10. International Data Transfers
Our activities and service providers may involve the processing or storage of information in different countries.
Where personal information is transferred internationally, we will assess and implement the safeguards required by applicable data protection legislation.
These may include appropriate contractual protections, recognised transfer mechanisms, assessments of recipient protections or other lawful arrangements.
The precise transfer arrangements depend on the location of the Platform Operator, relevant individuals and service providers.
11. Data Security
We recognise the importance of protecting confidential supplier and personal information.
The Platform Operator will maintain reasonable technical and organisational safeguards appropriate to the nature and sensitivity of the information processed. Depending on the systems used, these may include:
- Role-based access restrictions.
- Secure authentication procedures.
- Encryption in transit and, where appropriate, at rest.
- Controlled access to confidential supplier documents.
- Security logging and monitoring.
- Backup and recovery arrangements.
- Procedures for investigating security incidents.
- Confidentiality requirements for authorised personnel.
No internet-based system can guarantee absolute security.
Users are responsible for maintaining the confidentiality of their account credentials and reporting suspected unauthorised access.
12. Data Retention
We retain personal information only for as long as reasonably necessary to fulfil the purposes for which it was collected or to satisfy applicable legal, contractual, audit or regulatory requirements. Retention periods may vary according to the information involved.
For example:
- Supplier records may be retained during active qualification or business relationships.
- Unsuccessful or inactive supplier records may be retained for a justified, documented period.
- Compliance records may be retained where required by applicable law.
- Security logs may be retained for operational and investigative purposes.
- Email suppression records may be retained where necessary to honour unsubscribe requests.
When information is no longer required, it will be securely deleted, anonymised or otherwise handled in accordance with applicable requirements.
13. Individual Privacy Rights
Depending on applicable law and individual circumstances, individuals may have rights to:
- 1Request access to personal information held about them.
- 2Request correction of inaccurate or incomplete information.
- 3Request deletion of information in qualifying circumstances.
- 4Object to certain processing activities.
- 5Request restriction of processing where applicable.
- 6Withdraw consent where consent is the legal basis.
- 7Request data portability where legally available.
- 8Object to direct marketing communications.
- 9Submit a complaint to an appropriate data protection authority.
Requests should be submitted to:
We may request reasonable verification of identity before responding to a privacy request. Requests will be handled within the time limits required by applicable law.
14. Confidentiality of Supplier Documents
Supplier submissions may contain confidential commercial, technical, financial or corporate information.
We will use such information only for appropriate supplier assessment, registration, compliance, procurement or other disclosed business purposes.
Access will be limited to authorised parties with a legitimate need to review the information.
Confidentiality obligations may also be governed by applicable contracts, nondisclosure agreements or procurement documentation.
15. Third-Party Websites and External Services
Our Website may contain links to external websites, supplier systems, service providers or procurement resources.
These third parties may maintain independent privacy policies and data handling practices.
We encourage users to review the privacy notices of external services before submitting personal information.
16. Children’s Privacy
The Website is intended for business and professional supplier engagement and is not directed at children.
We do not intentionally solicit personal information from children through supplier registration or procurement engagement activities.
If we become aware that personal information has been collected from a child without an appropriate legal basis, we will take steps consistent with applicable law.
17. Automated Processing and Supplier Assessment
Technology may be used to organise supplier information, support document review, identify relevant service categories and assist administrative qualification processes.
Where automated tools are used, their purposes and safeguards will be assessed in accordance with applicable law.
Any legally significant decision-making processes will be subject to applicable transparency, review and individual-rights requirements.
18. Changes to This Privacy Policy
We may update this Privacy Policy to reflect changes in our operations, technology, service providers, legal requirements or information-handling practices.
The latest version will be published on this Website with an updated revision date.
Where legally required, we will provide additional notice or obtain consent before implementing material changes.
19. Contact and Privacy Enquiries
For questions concerning this Privacy Policy, personal information or privacy rights, please contact:
We aim to address legitimate privacy concerns promptly, fairly and in accordance with applicable law.
20. Governing Data Protection Requirements
The Platform Operator will comply with data protection and privacy legislation applicable to its activities, establishment, processing operations and affected individuals.
Depending on the relevant circumstances, these requirements may include applicable UAE data protection laws, the EU General Data Protection Regulation, the UK GDPR, Nigeria’s Data Protection Act or other relevant legislation.
The applicability of any particular law depends on the legal entity, location, nature of processing and relevant jurisdiction.
© 2026 TAQA TD GROUP PJSC. All rights reserved.
Official Website: www.vendor-onboarding.info
This Privacy Policy should be read together with the Website's applicable Terms of Use, Cookie Notice and any supplier-specific data protection or confidentiality notices.