Platform policy

Privacy Policy

Last updated: June 6, 2026

This Privacy Policy explains how SupplyUp, an Egypt-based B2B marketplace that connects verified Egyptian exporters with global importers, collects, uses, shares, and protects your personal and business data. It applies to buyers, suppliers, platform administrators, and visitors, and is interpreted in line with Egypt's Personal Data Protection Law (Law No. 151 of 2020) and, for users in the EU/EEA, the GDPR.

1. Who we are & scope

SupplyUp ("we", "us") is the controller responsible for processing your data on the platform.
This policy covers our website, applications, APIs, and related marketplace services.
By using the platform you acknowledge you have read this policy. If you do not agree, please do not use the platform.

2. Information we collect

Account & identity data: display name, email, role (buyer/supplier/admin), verification state, phone number, social-login identifier, profile picture, and session information.
Company & supplier data: business profile, contact details, products, certifications, and supply categories.
Verification (KYC) documents: commercial registration, tax card, export license, factory inspection reports, and bank-ownership evidence — handled as private, confidential data.
Marketplace & transaction data: RFQs, quotes, inquiries, messages/chat, and order states.
Usage & device data: pages visited, searches, clicks, and security signals (including a hashed IP fingerprint used for anti-abuse).
Cookies and similar technologies; and data from third parties such as social-login providers and verification partners.

3. How we use your data

To operate accounts, dashboards, search, catalog listings, RFQs, inquiries, and buyer–supplier communication.
To review and verify suppliers and documents and to issue trust badges through deliberate admin action.
To prevent fraud and abuse and to protect buyers, suppliers, and platform security.
To improve quality, measure performance, personalize results, and troubleshoot.
To send important operational messages; we do not send marketing without an appropriate legal basis.
To comply with legal obligations and resolve disputes.

4. Legal bases for processing

Performance of a contract: to provide the services you request.
Legitimate interests: security, fraud prevention, and service improvement, balanced against your rights.
Consent: for certain cookies and optional communications (withdrawable any time).
Legal obligation: where law requires us to retain or disclose data.

5. How we share your data

With other users: public supplier profile and published products are shown to buyers; necessary contact data is shared between the parties to an inquiry/RFQ.
Private verification documents and internal admin fields are never exposed to public buyers or visitors.
With trusted service providers: hosting/storage via Cloudflare (R2/D1), email, analytics, and security, under contract.
For legal reasons and in business transfers, with these protections preserved.

6. Cookies & tracking

We use essential cookies for sessions/preferences and analytics cookies for performance. See the Cookie Policy.
You can control cookies via your browser; disabling essential cookies may affect the platform.

7. International data transfers

The platform runs on Cloudflare's global network, and data may be processed outside your country.
We apply appropriate safeguards, including standard contractual clauses where required.

8. Data retention

We keep data while needed to operate an account, meet compliance needs, resolve disputes, or protect the platform.
On account deletion we delete or anonymize data unless a legitimate legal/security obligation requires retaining some of it.

9. Data security

Role-based access controls; sensitive documents stored privately and reachable only via short-lived signed links.
Encryption in transit, plus session controls and credential invalidation when needed.
No method is 100% secure, but we apply measures appropriate to the risk.

10. Your rights

Access, correct, delete, restrict, object to, and port your data, and withdraw consent.
You can request account deletion from settings or via the email below.
You may complain to the Egyptian Data Protection Center, or your EU supervisory authority if applicable.

11. Children

The platform is for business (B2B) use and is not directed to anyone under 18; we do not knowingly collect their data.

12. Third-party links

The platform may link to external sites not covered by this policy; review their own privacy policies.

13. Changes to this policy

We may update this policy, revise the "Last updated" date, and notify material changes through the platform.

14. Contact us

For privacy questions or to exercise your rights, contact our Data Protection Officer at the email below.
Operating entity: SupplyUp [full legal name] — [registered address, Egypt].

Questions? Contact us at privacy@supplyup.org