Last change April 20, 2026
In connection with the use of the SupplyOn-Services, personal data will be processed both from you as a user and from other persons involved in the delivery of the SupplyOn-Services. These “data subjects”, as defined by the GDPR, are for simplification hereinafter referred to as “users”.
The following groups of persons may be considered users of SupplyOn-Services:
SupplyOn processes users’ personal data in two different scenarios:
A) For SupplyOn’s own purposes, to operate, advertise or distribute the SupplyOn-Services.
B) On behalf of buyers, who use the SupplyOn-Services to manage processes with their suppliers.
You can use the following methods to obtain information regarding which buyer is responsible for your case after logging into the SupplyOn Portal:
Alternatively, please send your request, to determine the responsible buyer, to datenschutz@supplyon.com. Please note that in order to process the legitimacy of your request, we must verify your identity and will request further information. However, we will never ask you for your user password.
The following information regarding the protection of personal data being processed should therefore be understood in relation to the relevant scenario of each case.
If you are a user of the SupplyOn-Services for SupplyOn directly or for a service provider, then SupplyOn is the controller responsible for processing your data:
SupplyOn GmbHLudwigstrasse 4985399 HallbergmoosTelephone: +49 811 99997 0E-Mail: datenschutz@supplyon.com
As a user of SupplyOn-Services, you can either work for a buyer or for a supplier. A supplier is always associated with at least one buyer at SupplyOn. In this case, the buyer is responsible for the processing of your personal data, for which SupplyOn has been commissioned to work for in accordance with the instructions given by the buyer.
SupplyOn’s Data Protection Officer isdatenschutz süd GmbHWörthstraße 1597082 WürzburgTelephone: +49 931 304976 0E-Mail: datenschutz@supplyon.com
As a user of SupplyOn-Services, you can either work for a buyer or for a supplier. A supplier is always associated with at least one buyer at SupplyOn. SupplyOn is a processor working under the instructions of buyers, therefore, we will respond to any requests for information sent to datenschutz@supplyon.com by providing the contact details of the data protection officer of the buyer responsible for the personal data in question. Alternatively, you may contact the buyer directly at any time.
Your personal data will be processed by SupplyOn for its own purposes.
As a user of SupplyOn-Services, we initially process your personal data, in connection with the use of the SupplyOn Platform, for the purpose of contract processing. This finds its legal basis in Art. 6 para. 1 lit. b GDPR in connection with the applicable terms and conditions for SupplyOn-Services. During the registration process, you as a user of SupplyOn-Services will be requested to provide the following registration data, which will be stored by SupplyOn and used as described below:
During the use of SupplyOn-Services, SupplyOn stores and uses the following data from you, the user, and your company (customer):
This includes, in particular, the following processing steps:
If you decide to pay by credit card, we process the necessary data to process the payment on the basis of Art. 6 para. 1lit. b GDPR. Your bank data will not be collected by SupplyOn, but exclusively via a payment service provider whose service is directly integrated into our payment page. SupplyOn has no access to your bank data. If you require more information about the processing of your data processed for payment purposes, please click on the following link: https://www.evopayments.eu/datenschutz/.
As a registered user, you have the ability to be informed, depending on your own area of interests, about certain services provided by SupplyOn (through subscribing to newsletters or receiving invitations to surveys). You decide voluntarily about the scope. The legal basis for this is explicit consent in accordance with Art. 6 para. 1 lit. a and Art. 7 GDPR in conjunction with § 7 para. 2 UWG. You can manage these services at any time and, if necessary, adjust or revoke previously given consent. You can view your personal services after logging in to the SupplyOn-Portal via the menu options Administration –> My User –> Privacy Settings.
If you are interested in SupplyOn-Services you may contact us via the contact form on our website or order our newsletter. All necessary information regarding these services can be found in the privacy notice of our website.
Your personal data as a user is processed on behalf of a buyer in order to enable you to use the SupplyOn-Services as Software-as-a-Service (SaaS). This includes in particular the rollout of the SupplyOn-Services, the operation of the SupplyOn-Services as well as training and support when using the SupplyOn-Services. SupplyOn processes your personal data on behalf of the buyer in accordance with the conditions laid out in a commissioned data processing agreement pursuant to Art. 28 GDPR.
The use of SupplyOn-Services, for you as a contact person or employee of a buyer, finds its legal basis in Art. 6 para 1 lit. b GDPR and requires your employer to fulfill the obligations from your respective employment relationship.
Artificial intelligence (AI) is used for some functions within the scope of SupplyOn services if the purchasing company has activated these functions. We will inform you in advance if a function is carried out with AI with a corresponding notice. Some of these functions may also involve the processing of personal data, e.g., contact details when translating or summarizing documents. Processing is carried out strictly for specific purposes. In the event of a (possible) data transfer to non-EU countries, we have of course contractually ensured that an adequate level of data protection is in place. In some cases, we use service providers who provide us with AI models.
SupplyOn offers a search tool that can be used to find, extract, and summarize current information from public websites. AI is used in the process to collect data. The process aims to collect company-related data, such as security certificates. When searching public websites, personal data may be processed if the websites searched contain personal data, e.g., information about managing directors or employees of suppliers or other persons. Only relevant, company-related data is extracted and summarized. The processing is based on the legitimate interest of effectively and quickly identifying risks in the supply chain (Art. 6 para. 1 lit. f GDPR). If your personal data is processed in this context, you have the right to object with effect for the future.
We use Microsoft Teams as part of your collaboration with SupplyOn.
The provisions under sections 3. A) and B) apply accordingly to data protection responsibilities. If SupplyOn does not use Microsoft Teams for its own purposes during meetings with you, the respective commissioning purchasing company is the responsible party.
Microsoft Teams is used for business communication via online meetings. When you participate in an online meeting, audio and video signals are transmitted to the other conference participants in encrypted form. You are free to use the chat, question, or survey functions during the online meeting. Before joining the conference room, you can enter your name and choose whether to enter with your camera or microphone on or off.
If we wish to record online meetings, we will inform you of this in advance and ask for your consent (Art. 6 para. 1 lit. a GDPR). When a video recording starts, all meeting participants will receive a system notification in which they can consent to the recording. Consent is only valid for the respective meeting, is always voluntary, and refusal or withdrawal of consent does not have any negative consequences. The recordings are used for information, training, or documentation purposes, e.g., for employees or external parties.
In addition to video recording, there is a function that automatically transcribes a meeting in order to document meetings, to make our work more efficient, or for colleagues who were unable to attend. If the transcription function is activated in meetings, we will inform you of this in advance and ask for your consent (Art. 6 para. 1 lit. a GDPR). Consent applies only to the respective meeting, is always voluntary, and refusal or withdrawal of consent does not entail any negative consequences. The transcription is created with the help of artificial intelligence.
The transcription uses speech recognition to record all contributions to the meeting and summarizes them in a transcript. For this purpose, your voice will be temporarily recorded and deleted shortly after the end of the meeting. Microsoft has no access to the audio recordings. After the meeting has ended, the meeting host will have access to the minutes and can control access to them by the other meeting participants.
If you do not agree to the recording or transcription, you can revoke your consent at any time by deactivating your camera or microphone or by leaving the meeting. The revocation only applies to the future.
Of course, we have ensured that an appropriate level of data protection is in place. Microsoft is certified under the EU-U.S. Data Privacy Framework and standard contractual clauses are in place where necessary.
Your personal data, as a user, may be passed on to service providers in connection with the use of certain SupplyOn-Services. These service providers will either act in strict accordance with our instructions within the framework of a commissioned data processing agreement pursuant to Art. 28 GDPR and we will transmit your personal data on a legal basis pursuant to Art. 6 para. 1 GDPR. Insofar as the service providers providing support have their headquarters outside the EU/EEA, we have ensured the legality of the data transfer by means of suitable guarantees (e.g. by means of EU standard contractual clauses in accordance with Art. 46 para. 2 lit. c GDPR)
In connection with providing SupplyOn Services on behalf of a buyer (as a commissioned SaaS service), SupplyOn is the primary recipient of your personal data.
Your personal data will not be passed on to third parties by SupplyOn without documented instructions from the buyer, unless there is a legal obligation to do so under relevant legal provisions.
Your personal data will be passed on to external service providers (business partners and other subcontractors) within the scope of SupplyOn-Services, depending on the scope of the agreement involved. These service providers support us in data processing within the scope of a commissioned data processing agreement and are strictly bound by instructions pursuant to Art. 28 GDPR. If the service providers are located outside the EU/EEA, SupplyOn has ensured the legality of the data transfer by means of suitable guarantees (e.g. by EU standard contractual clauses according to Art. 46 para. 2 lit. c GDPR). Upon request, we will provide you with an overview of the service providers relevant to your case.
As soon as consent is limited or completely revoked regarding the receipt of information about SupplyOn Services, SupplyOn restricts the use of users’ personal data.
In addition, SupplyOn processes users’ personal data for the purpose of processing a contract only as long as the underlying contractual relationship exists.
Furthermore, as soon as you are no longer registered as a user (e.g. termination of the contract between SupplyOn and the company for which you work), SupplyOn deletes your personal data which was being used for the purpose of informing you about SupplyOn-Services.
This only applies if there are no legal obligations on SupplyOn’s part to retain the data, preventing such deletion. In this case a restriction of processing takes the place of deletion.
SupplyOn deletes users’ personal data on the instructions of the buyer and upon termination of the contract between SupplyOn and the buyer or the corresponding supplier, provided that SupplyOn does not have any legal obligation to store the data, preventing such deletion. In this case, a restriction of processing takes place instead of deletion.
Regardless of which company is specifically responsible for the processing of your data, you are entitled to various rights as a data subjects, which we would like to explain to you below.
Data subjects have the right to be informed by the controller about the personal data concerning them and to have incorrect data corrected or deleted, if one of the reasons stated in Art. 17 GDPR applies, e.g. if the data is no longer required for the purposes pursued. You have also the right to limit the processing if one of the conditions mentioned in Art. 18 GDPR is present and in the cases of Art. 20 GDPR the right to transfer data. If data is collected on the basis of Art. 6 para. 1 lit. e (data processing for the fulfillment of official tasks or the protection of the public interest) or lit. f (data processing to pursue legitimate interests), the data subject has the right to object to the processing at any time for reasons arising from his/her particular situation. We will then no longer process the personal data unless there are verifiable compelling grounds for processing worthy of protection which outweigh the interests, rights and freedoms of the data subject, or the processing serves to assert, exercise or defend a legal claim.
Furthermore, any data subject shall have the right to complain to a supervisory authority if he or she considers that the processing of data concerning him or her is in breach of data protection provisions. In particular, the right of appeal may be exercised before a supervisory authority in the Member State in which the data subject is residing or in which the alleged infringement took place. The competent supervisory authority for SupplyOn is the Bayerisches Landesamt für Datenschutzaufsicht, Promenade 27 (Schloss), 91522 Ansbach, Germany.
To exercise your rights as a data subject, please contact the relevant controller. We will be happy to support you! You will find the necessary information for making contact in this document in the section “Contact Details for the Controller’s Data Protection Officer”.
Regardless of which company is responsible for the processing of your personal data, the following applies:
The disclosure of your personal data is neither required by law, nor by contract, nor is it necessary to conclude a contract. As a user of SupplyOn-services, you are not obligated to provide your personal data. The consequences of not providing your personal data are that you cannot register for or use the SupplyOn Services.
FREE WHITEPAPER
See how AI-native Sourcing helps buyers execute RFQs faster while staying fully in control.
AI-native Sourcing
Mit AI-native Sourcing automatisieren Sie zeitaufwändige Schritte im Ausschreibungsprozess und gelangen schneller von der Anfrage zur Vergabe.
European manufacturers face new sourcing challenges. Discover the five dimensions that reveal the gap between sourcing ambition and execution capability.