Supplier Portal Privacy Policy

1. Definitions

For the purposes of this Privacy Policy, “Company” means Elan Holding QPSC and includes its affiliates, subsidiaries, and any other entity that directly or indirectly controls, is controlled by, or is under common control with Elan Holding (collectively referred to as the “Elan Group”).

2. Purpose of the Portal

The Supplier Portal is used by the Company’s procurement team to manage supplier registration, communication, sourcing activities, and ongoing supplier relationships. This includes:

• Supplier onboarding and registration
• Maintaining supplier profiles and company documents
• Updating legal and compliance information
• Issuing RFQs/RFPs/RFIs and inviting suppliers to participate
• Allowing suppliers to submit, revise, and track their offers before deadlines
• Sharing clarifications, notifications, and managing bid-related discussions
• Sending regret notifications to unsuccessful bidders
• Storing procurement-related documents (contracts, legal docs, offers, etc.)
• Recording negotiated offers, final awards, and sharing POs
• Tracking supplier performance and generating reports

3. Information Collected

The Company may collect and process the following information:

• Company details (e.g., name, registration details, address)
• Contact information (e.g., names, email addresses, phone numbers)
• Financial and compliance information (e.g., tax details, certifications)
• Documents submitted during registration or tendering processes
• ICV certification and such other documents, as may be applicable

4. Purpose of Processing

Supplier information is collected and used strictly for procurement-related purposes, including:

• Supplier registration and onboarding
• Supplier evaluation and due diligence
• Tendering and sourcing processes
• Contract negotiation and management
• Ongoing supplier communication and performance monitoring

5. Data Protection and Confidentiality

All supplier information is treated as confidential and is accessible only to authorized personnel within the procurement team or other relevant internal departments on a need-to-know basis. Appropriate technical and organizational measures are implemented to safeguard such data.

6. Data Sharing

Supplier information will not be shared with third parties except:

• Where required by applicable laws or regulations
• Where necessary for compliance, audit, or legal obligations
• With authorized service providers supporting procurement processes, subject to confidentiality obligations

7. Supplier Responsibilities

Supplier is responsible for:

• Ensuring that all information provided on the portal is accurate, complete and up to date
• Updating the corporate documents to ensure that they remain valid throughout the process
• Safeguarding and maintaining the confidentiality of its login credentials
• Maintaining confidentiality of procurement-related information

8. Data Retention

All Supplier information including but not limited to proposals, tender clarifications, etc., will be stored and retained in the portal in accordance with company policy, applicable legal, regulatory, and audit requirements.

9. Supplier Rights

Suppliers shall have access to the portal through its assigned username and password, enabling it to access, update, correct, or delete its personal and company related data, subject to applicable legal and contractual obligations. The Supplier may also modify or revise its quotations/proposals during the tendering process, provided that any such changes are made prior to the applicable submission deadline.

10. Data Security

The Company implements reasonable technical and organizational measures to protect supplier data against unauthorized access, loss, misuse, or disclosure.

11. Updates to this Policy

Company reserves the right to update or modify this Privacy Policy from time to time. Any changes will be communicated through the Supplier Portal or other appropriate means.

12. Legal Basis

The Company processes supplier data for legitimate business purposes related to procurement, contractual necessity, and compliance with applicable laws in accordance with the Qatar Personal Data Privacy Protection Law No. 13 of 2016.