Privacy Policy

This Policy applies to all personal data and non-personal information collected by us through or in connection with the Platform. It applies to all individuals who interact with the Platform including authorised Users of a Customer such as administrators, procurement personnel and approvers, Suppliers who register on or are invited to the Supplier Portal to participate in Procurement Events, visitors who browse the eProqure website without creating an account and any other individuals who communicate with us through the Platform or through our official contact channels.

The Platform is intended for use by business entities and their authorised personnel and is not directed at or intended for use by individual consumers. Where this Policy refers to a Customer it means the organisation that has subscribed to or been granted access to the Platform and on whose behalf Users access and use the Platform.

This Policy does not apply to information collected by third-party websites or services to which our Platform or website may link. We are not responsible for the privacy practices of those third parties and we encourage you to review their respective privacy policies before providing any personal data to them.

eProqure is a cloud-based Procurement and Supply Chain Management Platform that enables organisations to digitise, automate and manage their sourcing, procurement, supplier collaboration, purchase order workflows and logistics tracking through a centralised web application. The Platform is owned, operated and maintained by Webclues Infotech Pvt Ltd.

The Platform helps organisations conduct procurement events such as Requests for Quotation, Requests for Tender, Tenders and Reverse Auctions, while providing visibility from purchase request creation through to supplier selection, purchase order generation and shipment tracking. The Platform consists of one or more modules depending on a Customer's subscription and implementation scope, including strategic sourcing, RFQ management, tender management, reverse auctions, supplier management, the Supplier Portal, procurement approvals and workflows, purchase order integration, ERP and CRM integrations, WhatsApp and communication integrations, vehicle tracking, shipping container tracking, reporting and analytics, and user and organisation management.

The Platform facilitates procurement and logistics processes but does not act as a buyer, seller, supplier, marketplace operator, freight carrier, logistics provider, payment processor, financial institution or legal representative. All procurement decisions, supplier selection, pricing negotiations, purchase orders, transportation arrangements and contractual agreements remain the sole responsibility of the Customer organisation.

We collect personal data through different means depending on how you interact with the Platform. The categories of data we collect are described below.

3.1Data You Provide Directly

• a.Registration and Account Information: When a Customer registers on the Platform we collect the organisation's name, business address and contact details together with the full name, email address, mobile number, password in encrypted form and role of each authorised User. This information is necessary to create and administer the Account, verify identity and provide access to the Platform's features.
• b.Procurement and Transactional Data: When Users create and manage Procurement Events we collect the details of those events including specifications, bidding rules and auction settings, supplier quotations and bids, supporting documents, bid comparisons, evaluation records, approval records and Purchase Order data. This data forms the primary input for the Platform's sourcing and procurement functionality.
• c.Supplier Data:When a Supplier is invited to or registers on the Supplier Portal we collect the Supplier's contact details together with the quotations, bids and supporting documentation submitted by that Supplier in connection with a Procurement Event.
• d.Subscription and Billing Information: When a Customer subscribes to a paid plan we collect billing information including name, billing address, contact details and payment instrument details. Payment processing is handled by third-party payment service providers and we do not directly store complete payment card information on our systems.
• e.Support and Communication Data: When you contact our support team or communicate with us through the Platform, in-Platform messaging or email we collect records of those communications including the content of your messages and any personal data you share in the course of seeking assistance.

3.2Data Collected Automatically

• a.Usage and Interaction Data: We collect data about how Users interact with the Platform including login timestamps, pages visited, features used and actions taken. This data is used to improve Platform performance, personalise the User experience, monitor for security incidents and conduct internal analytics.
• b.Device and Technical Data: We automatically collect technical information including your IP address and the approximate geographic location derived from it, the type and version of your browser and operating system, device type, the date and time of your access and the referring URL from which you arrived at the Platform.
• c.Cookies and Similar Technologies: We use cookies and similar tracking technologies to maintain session state, remember preferences, enhance security and collect usage analytics, as further described in Section 6 of this Policy.

3.3Data Received Through Integrations

• a.ERP and CRM Data:Where a Customer connects its enterprise resource planning or customer relationship management system to the Platform we may receive approved purchase requests and synchronise procurement data with those systems, including pushing awarded supplier details back to the Customer's ERP system. Integrations are only implemented where the relevant third-party system provides accessible APIs, open endpoints or other supported integration interfaces.
• b.Logistics and Tracking Data: Where a Customer subscribes to logistics or tracking modules we may receive vehicle tracking, shipping container tracking, trip tracking, delivery milestone and estimated arrival data through supported APIs, GPS providers, telematics systems and logistics partners configured by the Customer. Such tracking is performed through third-party service providers who are integrated to the Platform for that purpose.
• c.Communication Integration Data: Where a Customer enables WhatsApp or other communication integrations we process the data exchanged through those channels to the extent necessary to deliver procurement invitations, notifications and reminders.

3.4Data We Do Not Collect

The Platform is intended for use by business entities and their authorised personnel and is not directed at or intended for use by individual consumers or by persons below the age of eighteen. We do not knowingly collect personal data from individuals below the age of eighteen and we do not seek to collect sensitive categories of personal data such as racial or ethnic origin, political opinions, religious beliefs, health or medical information, biometric data or genetic data. Users and Suppliers should not include such information in any document or communication uploaded to the Platform, as this information is not required for the operation of the Platform's procurement and logistics features and we are not responsible for information that is voluntarily included in uploaded documents.

We process personal data only for specific, defined and legitimate purposes. The purposes for which we process personal data are as follows.

• 4.1Account Creation and Administration: We process registration data to create and administer a Customer's Account and User accounts, to verify identity and to authenticate access when a User logs in.
• 4.2Procurement Event Management: We process procurement and transactional data to enable Customers to create and manage Requests for Quotation, Requests for Tender, Tenders and Reverse Auctions, to invite Suppliers, to receive and compare quotations and bids, to evaluate Suppliers and to record awards through configurable approval workflows.
• 4.3Supplier Collaboration: We process Supplier contact and submission data to enable Suppliers to be invited through the Supplier Portal, to receive quotations digitally, to allow Suppliers to participate in reverse auctions and to centralise supplier communication.
• 4.4Purchase Order and ERP Synchronisation: Where enabled by the Customer we process procurement and award data to synchronise records with the Customer's ERP or CRM systems and to enable automatic or assisted purchase order creation.
• 4.5Logistics and Shipment Tracking Visibility: Where a Customer subscribes to logistics modules we process tracking data received from third-party providers to present shipment status, trip progress, delivery milestones and estimated arrival information on the Platform's dashboards.
• 4.6Subscription and Payment Processing: We process billing and payment data to administer a Customer's subscription, to process payments and to manage renewals and cancellations.
• 4.7Customer Support: We process communications data and account information to respond to queries, resolve technical issues and provide assistance in connection with use of the Platform.
• 4.8Platform Analytics and Improvement: We process automatically collected usage and technical data to understand how the Platform is used, to identify areas for improvement and to optimise the user experience.
• 4.9Security and Fraud Prevention: We process certain technical data to monitor for and prevent unauthorised access to the Platform, to detect and prevent fraudulent activity and to maintain the integrity and security of our systems.
• 4.10Marketing and Communications: Where consent has been provided or where we have a legitimate interest to do so we may send information about new features, industry insights and relevant updates. Consent may be withdrawn or such communications may be opted out of at any time by contacting us at the address set out in Section 13 of this Policy.
• 4.11Legal Compliance and Defence of Claims: We may process personal data as necessary to comply with our obligations under applicable law, to respond to requests from government or regulatory authorities and to establish, exercise or defend legal claims.

5.1We process personal data on one or more of the following legal bases depending on the nature of the data and the purpose for which it is processed.

• 5.2We process registration and Account data, procurement and transactional data, Supplier data and billing data on the basis that such processing is necessary for the performance of a contract with the relevant Customer, namely the Terms and Conditions governing use of the Platform, or is necessary to take steps prior to entering into such a contract.
• 5.3We process usage data, device data and technical logs on the basis of our legitimate interests in maintaining the security and performance of the Platform, detecting and preventing fraud and conducting internal analytics to improve the Platform's features, provided that these interests are not overridden by the interests or fundamental rights of the individuals concerned.
• 5.4We process personal data to the extent required to comply with applicable law, court orders, regulatory requirements and lawful requests from governmental or regulatory authorities on the basis of legal obligation.
• 5.5We process personal data for marketing communications and any other purpose not required for contractual performance on the basis of consent, which may be withdrawn at any time through the unsubscribe mechanism in any marketing communication or by contacting us at the details in Section 13. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

6.1What Cookies Are

Cookies are small text files that are placed on your device by a website or platform when you visit it. They are widely used to make digital platforms work efficiently and to provide useful information to the operators of those platforms. Cookies may be session cookies which are deleted when the browser is closed or persistent cookies which remain on the device for a defined period or until deleted. The Platform uses cookies and similar tracking technologies to operate effectively and to improve the user experience.

6.2Categories of Cookies We Use

• a.Strictly Necessary Cookies These cookies are essential for the operation of the Platform and cannot be disabled. They enable core functionalities such as page navigation, secure login, session management and preference retention.
• b.Analytical and Performance Cookies We use analytical tools to collect information regarding Platform usage including pages visited, session duration, referral sources, approximate geographic location and device information. This data is used to understand usage patterns and to improve the Platform.
• c.Functional Cookies These cookies allow the Platform to remember preferences and choices such as language settings and display preferences.
• d.Marketing and Preference Cookies Subject to consent these cookies help us understand interests and assess the relevance of our communications. These cookies do not track activity across unrelated third-party websites.

6.3Managing and Disabling Cookies

The Platform utilises a cookie consent mechanism that is displayed when a User first visits the Platform. Strictly necessary cookies are enabled automatically because they are required for the operation of the Platform. Analytical, functional and marketing cookies are activated only after affirmative consent is provided through the cookie banner and such consent may be modified or withdrawn at any time through the cookie preference settings available on the Platform.

We do not sell Customer Data. We treat personal data with strict confidentiality and share it only in the following limited circumstances.

• 7.1Supplier and Customer Visibility: The fundamental purpose of the Platform is to facilitate procurement events between Customers and Suppliers. When a Customer creates a Procurement Event and invites Suppliers, the relevant quotation, bid and supporting document data submitted by a Supplier is made visible to the inviting Customer, and details of the Procurement Event are made visible to the invited Suppliers, as necessary for the Platform to function. Suppliers and Users should review the contents of any document submitted through the Platform before submission.
• 7.2Cloud Hosting and Infrastructure Providers: We engage cloud infrastructure providers to host, operate and maintain the Platform and to store data securely on our instructions and subject to contractual data protection obligations.
• 7.3Third-Party System Providers: Where a Customer configures an integration we exchange data with ERP, CRM, logistics, telematics and communication platform providers, including WhatsApp and similar channels, solely to the extent necessary to deliver the relevant integration.
• 7.4Payment and Billing Providers: We engage third-party payment processors to process subscription payments and billing information.
• 7.5Technical Support and Maintenance Providers: We engage personnel and service providers to assist with Platform maintenance, diagnostics and support activities. Such personnel access data only to the extent necessary for the relevant activity and are bound by confidentiality obligations.
• 7.6Legal and Regulatory Disclosure: We may disclose personal data to government authorities, regulatory bodies, law enforcement agencies or courts where required by applicable law or a valid court order, or where reasonably necessary to protect the rights, safety or property of the Company, its Customers or the public.
• 7.7Professional Advisers: We may share personal data with our lawyers, accountants, auditors and other professional advisers where necessary for the purposes of obtaining professional advice or managing legal proceedings, on a confidential basis.
• 7.8Business Transfers: In the event of a merger, acquisition, restructuring or sale of all or a substantial portion of our business or assets, personal data held by us may be transferred to the acquiring or successor entity. We will notify Customers of any such transfer that materially affects the handling of their data and will ensure that the receiving entity is bound by obligations no less protective than those in this Policy.

8.1Webclues Infotech Pvt Ltd is incorporated and operates in India. The Platform may be hosted on cloud infrastructure located in India or in other jurisdictions depending on our infrastructure configuration, and personal data collected through the Platform may accordingly be processed, stored or accessed outside the country in which a Customer, User or Supplier is located.

8.2Where we transfer personal data across international borders we take appropriate measures to ensure that an adequate level of data protection is maintained in accordance with applicable law, which may include contractual safeguards with the recipient. By using the Platform and providing personal data to us you acknowledge and consent to the transfer of personal data outside your country of location for the purposes described in this Policy.

9.1We implement and maintain technical and organisational measures appropriate to the nature of the data processed to protect personal data against unauthorised or unlawful access, processing, accidental loss, destruction or damage. These measures include encryption of data in transit, encryption of data at rest where technically supported, role-based access controls, secure authentication mechanisms, audit logging, periodic access reviews, vulnerability management and incident response procedures.

9.2No method of transmission over the internet or method of electronic storage is entirely free from risk. While we take all reasonable precautions to protect personal data we cannot guarantee its absolute security against all threats. We shall not be liable for any loss, damage or unauthorised access arising from vulnerabilities that are outside our direct control, including vulnerabilities in a Customer's own devices, networks or Third-Party Systems. Customers and Users are responsible for maintaining the security of their own Account and User credentials.

10.1We shall notify affected Customers without undue delay and in any event within the timeframe required by applicable law upon becoming aware of a security incident that has resulted in or is reasonably likely to result in unauthorised access to, disclosure, loss or alteration of personal data.

10.2Such notification shall include, to the extent available at the time, a description of the nature of the incident, the categories of data affected, the likely consequences, the measures taken or proposed to address the incident and the contact details of our designated contact for further information.

10.3We shall maintain incident response procedures and shall cooperate with relevant regulatory authorities in the investigation and resolution of security incidents in accordance with applicable law.

We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected or as required by applicable law. The following general retention principles apply.

• 11.1Account and Registration Data: Retained for the duration of the Customer's active Subscription and for a reasonable period thereafter, not typically exceeding three years, for the purposes of managing outstanding matters and defending legal claims.
• 11.2Procurement and Supplier Data: Retained for the duration of the Customer's active Subscription and for a reasonable period thereafter as necessary for legal compliance, audit trail purposes and resolution of any outstanding matters. A Customer may request deletion of its Account and associated data, which shall be processed within a reasonable period subject to any lawful basis for continued retention.
• 11.3Payment and Billing Data:Retained for the period required by applicable financial and tax record-keeping obligations, which may extend beyond the termination of the Customer's Account.
• 11.4Usage and Technical Data: Retained for a reasonable period not typically exceeding twelve months from the date of collection, or such longer period as may be justified by our legitimate interests in Platform security and improvement.
• 11.5Communications and Support Data: Retained for a period of three years from the date of the relevant communication or such longer period as may be necessary to resolve the matter or defend a related claim.
• 11.6Marketing Communication Data: Retained until consent is withdrawn or the recipient opts out of such communications.

Upon the expiry of the applicable retention period personal data is securely deleted or anonymised in a manner that prevents the re-identification of individuals.

Subject to applicable law and certain legal exceptions you have the following rights in relation to the personal data we hold about you. We will respond to any request to exercise these rights within the time period required by applicable law and we may need to verify your identity before processing your request.

• 12.1Right of Access: You have the right to obtain confirmation as to whether we are processing personal data about you and to receive a copy of that data together with information about the purposes of processing, the categories of data processed and the recipients to whom data has been disclosed.
• 12.2Right of Rectification:You have the right to request that we correct any inaccurate personal data we hold about you without undue delay, and to have incomplete personal data completed. In many cases you can update profile information directly through the Platform's account management settings.
• 12.3Right of Erasure: You have the right to request that we delete personal data where it is no longer necessary for the purposes for which it was collected, where consent has been withdrawn and there is no other lawful basis for processing, or where processing is unlawful, subject to exceptions including where retention is required by applicable law.
• 12.4Right to Restriction of Processing: You have the right to request that we restrict the processing of personal data in certain circumstances, such as where the accuracy of the data is contested or where processing is unlawful but deletion is not desired.
• 12.5Right to Data Portability: Where processing is based on consent or on a contract and is carried out by automated means, you have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format and to have that data transmitted to another service provider where technically feasible.
• 12.6Right to Object: You have the right to object to the processing of personal data where that processing is based on our legitimate interests, and to object at any time to processing for direct marketing purposes.
• 12.7Right to Withdraw Consent: Where processing is based on consent you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
• 12.8Right to Grievance Redressal: If you are located in India you have the right to lodge a grievance with our Data Protection Officer in accordance with Section 13 of this Policy and, where the grievance remains unresolved, to approach the Data Protection Board of India or such other authority as may be constituted under the Digital Personal Data Protection Act 2023.

To exercise any of the above rights please contact us using the details set out in Section 13. We will not charge a fee for exercising your rights unless a request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or decline to act on the request.

If you have any questions about this Policy, wish to exercise any of your rights in relation to your personal data, wish to make a complaint about our data practices or wish to withdraw consent to processing, please contact us using the following details.

• Company: Webclues Infotech Pvt Ltd
• Email: Sales@webcluesinfotech.com
• Postal Address: 1010, Signature 01, Survey No. 841/1/2/10, Plot No. 287 / 276, S.G. Highway, Makarba, Ahmedabad, Gujarat, India - 380051
• Website: www.eproqure.com

We will acknowledge receipt of your communication within three business days and will endeavour to respond in full within thirty days or within such shorter period as may be required by applicable law.

The Platform may contain links to third-party websites and embedded content from external sources, and may integrate with Third-Party Systems including payment processors, ERP and CRM systems, logistics and telematics providers and communication platforms. When you follow a link to or interact with a third-party website or service you leave the Platform and your activity is governed by the privacy policy of that third party. We have no control over and are not responsible for the data collection or privacy practices of any third-party website or service, and we encourage you to review the privacy policy of every third-party service you interact with. Our use of Third-Party Systems does not affect our obligations to protect personal data as described in this Policy.

The Platform is designed for use by business entities and their authorised personnel and is not intended for or directed at individual consumers or at persons below the age of eighteen years. We do not knowingly collect or solicit personal data from individuals below the age of eighteen. Any individual accessing the Platform on behalf of a Customer represents and warrants that they are at least eighteen years of age. If we become aware that we have collected personal data from a person below the age of eighteen without appropriate authorisation we will take prompt steps to delete that data from our systems. If you believe that a minor has submitted personal data to us please contact us immediately at the details provided in Section 13.

We may update this Policy from time to time to reflect changes in our data practices, the features we offer or applicable law. Where we make a material change to this Policy we will notify registered Customers by email or through a notice on the Platform at least thirty days before the change takes effect, and we will update the effective date set out at the top of this document. Where we are required by applicable law to obtain consent to any changes we will do so before implementing them. Continued use of the Platform following the publication of an updated Policy constitutes acceptance of the changes to the extent permitted by applicable law.

This Policy shall be governed by and construed in accordance with the laws of India, without regard to its conflict of laws principles. Any dispute, controversy or claim arising out of or in connection with this Policy which cannot be resolved amicably between the parties shall be subject to the exclusive jurisdiction of the courts at Ahmedabad, Gujarat, India, subject to the arbitration provisions set out in our Terms and Conditions.