Privacy Policy for Procure to Pay VMS Software

Last Updated: July 30, 2025

This Privacy Policy describes how personal and business data is handled in relation to the Procure To Pay VMS software solution ("Software") provided by Procure To Pay Chat ("Provider," "we," "us," or "our"). As a Provider of on-premise and customer-hosted web-based software for businesses, our approach to data privacy is centered on the principle of Customer data ownership and control.

1. Our Role as Software Provider

The Procure To Pay VMS Software is designed to be deployed and hosted directly on your (the "Customer's") servers. This means that:

• We, as the Provider, generally do not collect, store, or process any of your, your users', or your vendors' personal or business data through the Software itself during its operation.
• All information entered by your internal users and your external vendors into the Software is collected, stored, and managed directly by the Customer on their own infrastructure.
• The Customer is the data controller and/or data processor (as applicable under relevant data protection laws) for all data collected and processed within their instance of the Procure To Pay VMS Software.

2. Data Collection by the Provider (Minimal)

Given the nature of our deployment model (customer-hosted), we generally do not collect any personal or business data related to your use of the Software once it is deployed on your servers.

Any data we might collect would be strictly limited to:

• Information required for licensing and billing purposes (e.g., Customer business name, contact person name, email, billing address) during the sales and subscription process. This data is handled outside the operational Software itself.
• Limited technical data (e.g., IP address, browser type) when you visit our public website (e.g., for demo requests)

3. Data Ownership and Storage

• Data Ownership: All data entered into your instance of the Procure To Pay VMS Software (including vendor details, POs, invoices, etc.) is owned entirely by you, the Customer. The Provider does not claim any ownership rights over your operational data.
• Data Storage: All data processed and stored by the Procure To Pay VMS Software resides on the Customer's own servers. The Provider does not host or store your operational data.

4. Data Sharing and Selling

We do not share or sell any data collected through your use of the Procure To Pay VMS Software to third parties, as we do not collect or store such data ourselves.

Any data shared or processed by your instance of the Software (e.g., with your own integrated systems or external vendors via the vendor portal) is done under your (the Customer's) control and responsibility, and in accordance with your own privacy policies and data sharing agreements.

5. Data Security

Since the Software is hosted on your servers, you, the Customer, are solely responsible for implementing and maintaining appropriate technical and organizational measures to ensure the security, integrity, and confidentiality of all data stored on your servers. This includes, but is not limited to, server security, network security, data backups, access controls, and disaster recovery planning.

We design our Software with security features (e.g., user authentication, role-based access control) to assist the Customer in protecting their data, but the ultimate responsibility for the security of the hosting environment lies with the Customer.

6. Cookies and Tracking Technologies

The Procure To Pay VMS Software, when deployed and accessed via a web portal, may use "session-related cookies" or similar technologies. These are strictly necessary for the technical operation of the portal (e.g., to maintain a user's logged-in session, remember user preferences within a single session).

These session cookies do not collect personal identifying information and are typically deleted when the user closes their browser. We do not use these for tracking user behavior across different websites or for advertising purposes.

The Customer, as the host of the Software, is responsible for informing its users about the use of such necessary operational cookies in their own privacy policies.

7. User Rights and Data Deletion/Access

As the Customer, you own and control the data within your Procure To Pay VMS Software instance. Therefore:

• Your users (both internal staff and your external vendors) have the right to request data access, correction, or deletion directly from you, the Customer.
• The Customer is responsible for responding to such requests in accordance with their own privacy policies and obligations under applicable data protection laws (e.g., GDPR, CCPA).
• The Provider will assist the Customer with data access or deletion capabilities within the Software's functionality, to the extent technically feasible and permitted by the Customer's own server policies and data architecture.

8. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page. We encourage you to review this Privacy Policy periodically for any changes.

9. Contact Us

If you have any questions about this Privacy Policy or our data handling practices, please contact us at [Your Contact Email/Details].