Privacy Policy

A.C.N. 699 804 307 Pty Ltd trading as Vederca (ABN 27 699 804 307, ACN 699 804 307) operates the Vederca platform and is responsible for the personal information described in this policy. We handle personal information in accordance with the Australian Privacy Principles in the Privacy Act 1988 (Cth).

This policy covers the Vederca website, the vendor registry, the buyer and vendor portals, the user guide, and the emails we send, including our outreach to businesses. It explains what we collect, why, who we give it to, and what you can do about it. It also covers people who have never dealt with us: people named in the vendor registry (section 6) and the business contacts we write to (section 10). If you are in the European Union or the United Kingdom, section 15 adds what the GDPR and the UK GDPR require.

Account and organisation information

Your name, work email address, job title, phone number where you give one, time zone, profile photo if you add one, and the organisation you belong to. If you verify a mobile number, the number and when it was verified. For the organisation: its registered name, registered business address, ABN and ACN or the equivalent registration number in your country, country, and the plan it is on.

If you sign in with Google, the details Google shares with us when you do: your Google account ID, email address and whether Google has verified it, your name, your profile photo link, your language setting where Google provides it, and for a Google Workspace account, its domain.

When you enter your organisation's registered business address, the address box suggests addresses as you type. To find them, our server sends what you have typed, with your organisation's country, to Google's address service. We do not store or log what you type. We keep only the address you choose, on your organisation's record.

Payment information

If your organisation buys Vederca Plus, payment is taken by Stripe on its own checkout page, and you manage the subscription on Stripe's billing page. We never see or store card numbers. We keep the Stripe customer ID, the subscription's status and dates, and a record of each period your organisation held Vederca Plus. We keep those records because the report on each procurement discloses any paid relationship an evaluated vendor had with us while the procurement ran.

Checks on organisations

The results of the automatic checks we run on an organisation's work email domain, on a mobile number, and against the Australian Business Register record for its ABN, and the results of the web searches we run on organisation names, including adverse media checks on vendors. We no longer ask anyone for verification documents such as company registration or proof of address. Verified is an optional badge our team grants. Documents some organisations uploaded before we stopped asking for them remain on that organisation's record.

Procurement content

Documents you upload, requirements, questions, clarifications, vendor profiles, product information, responses, evidence, scores and the reasoning attached to them, and the messages exchanged inside a procurement. This content may contain personal information about your own personnel or referees, which is why section 12 of our Terms of Service asks you to include it only where it is genuinely needed.

The vendor registry

Business information about software vendors that sell to financial institutions, and the names and job titles of people in business roles at them, compiled from public sources. Section 6 sets out what the registry holds, who sees it, and how to have it corrected or removed.

Business contacts we write to

The names, job titles, organisations, business email addresses and published business phone numbers of people at organisations we think could use Vederca, with the public page each detail came from, and a record of the emails we send them and whether they were opened or their links clicked. Section 10 explains.

Technical and usage information

Sign-in records (when each sign-in link was requested and used, and the IP address and browser behind each), session activity, feature usage, error and audit logs (which record the IP address and browser behind significant actions), and records of the emails and text messages we send you and whether they were delivered. Our servers also log every request made to them, including the IP address it came from, when it was made and the address it asked for.

On the public pages of the site only, and only if you allow the analytics category, we measure traffic with our own first party analytics. For each visit it records:

• your IP address;
• your browser's user agent (which identifies the browser and type of device), language setting and screen size;
• an approximate location (country, region and city) worked out from your browser's time zone, not from your IP address;
• the pages you view and the site that referred you;
• the link you arrived by, including its campaign (utm_*) parameters and any ad click identifier; and
• clicks on labelled page elements, how far down each page you scroll, how long you spend on it, and the name of any form you submit, never what you enter in it.

It stops at the door of the portals and the admin console, it never captures anything you type, and it goes to our servers rather than a third party analytics service. Analytics records are deleted after 12 months. The Cookie Policy lists the identifiers involved.

Separately, when you arrive through one of our tracked campaign links, we count the arrival whether or not you allow analytics. The count records only which link was used, the page it opened, the type of device and the domain of the site that sent you. It creates no identifier and stores nothing in your browser, and we do not keep your IP address or user agent with it: they are used only in a one-way form, changed every day, so that reloading the page is not counted twice. These counts are also deleted after 12 months.

We also keep daily totals of page views on the public pages whether or not you allow analytics, broken down only by page, referring site's domain, tracked campaign link, type of device and a country worked out from your browser's time zone, with no identifier, nothing stored in your browser, no IP address or user agent kept, and deletion after 12 months. For a vendor's listing and product pages the total also records the kind of page on our site you came from, such as a search, a category page or a comparison, never its address and never anything you typed.

When a vendor's page in the vendor registry is opened, we add one to a daily total of views for that listing, kept separately for people who are not signed in and for signed-in buyers. These totals carry no identifier, use no cookie, and we do not keep your IP address or user agent with them. The vendor sees the totals in its analytics, and nothing in them identifies who viewed.

A vendor also sees the page view totals described above for its own listing and product pages: by week, by how visitors arrived, and, on Vederca Plus, by country and type of device and by the search engine, AI assistant or social network that sent them. Any other referring site is counted and never named to the vendor. When products are compared in the registry, we add one to a daily total for each product in the comparison, with no identifier and no record of what it was compared with, and the vendor sees that total.

When you search the vendor registry, we keep the words you typed, the filters you set, your country and how many results came back, with no identifier, nothing stored in your browser and no IP address or user agent kept, and deletion after 12 months. We use this to improve the registry. Vendors on Vederca Plus see counts of what is searched in each category: the number of searches, the certifications and requirements asked for, the kind of institution named and the countries searches came from. A search term is shown to vendors only once it has been typed at least five times on three or more days, and never a term typed by someone who was signed in.

To show the vendor registry for your country, the public site works out which country you are in from your IP address, looked up on our own server in a country database (IP geolocation by DB-IP, licensed under CC BY 4.0), or failing that from your browser's time zone and language setting. The address is not sent to anyone else for this, and the lookup keeps neither the address nor its answer. If you pick a country in the region picker, your browser keeps it as vd_region only if you allow preference storage, as the Cookie Policy explains.

What we do not collect

We do not ask for payment card numbers, identity or verification documents, or sensitive information as the Privacy Act defines it. Do not send them to us.

Almost always directly from you: when you sign up, complete a profile, upload a document, or use a feature. We also collect:

• from your organisation, when an administrator adds you as a user or invites you to a procurement;
• from a buying organisation, when it invites your company to respond, including by email;
• from Google, if you choose to sign in with Google;
• from Stripe, which tells us whether an invoice has been paid and the status of a Vederca Plus subscription;
• from public sources, being the Australian Business Register, web search results about an organisation, and published tender and contract data, as part of our checks on organisations and market research;
• from public sources, such as a company's own website and product pages, public registers, published news and archived copies of public web pages, to compile the vendor registry (section 6);
• from an organisation's own website, web search results (including public LinkedIn search results) and other public pages such as media releases and conference programmes, to find the business contacts we write to (section 10); and
• automatically from your browser and our servers, as described above.

If we collect personal information about you from someone else and you have not dealt with us directly, we take reasonable steps to make sure you are aware of this policy. Every listing in the vendor registry links to section 6.

We use personal information to:

• create and administer accounts, sign you in through single-use email links or Google sign-in, and verify a mobile number when you ask us to;
• provide the platform: running procurements, matching and inviting vendors, drafting documentation, and evaluating responses;
• publish the vendor registry and keep it accurate and current, show procurement teams who leads each vendor and when that changes, and show each vendor how often its listing and profile are viewed;
• show the vendor registry for the country you are in or choose;
• check that organisations are who they say they are;
• invoice and take payment for a buying organisation's fee and Vederca Plus, through Stripe;
• send service messages such as invitations, clarifications, status changes and security notices;
• tell businesses about Vederca, including inviting vendors to claim their registry listing, as section 10 describes;
• provide support, and to investigate and resolve issues you raise;
• keep the platform secure, detect misuse, and maintain audit trails;
• meet our legal obligations and to establish, exercise or defend legal claims;
• measure how the public website is used, only if you allow the analytics category; and
• improve the platform, using aggregated and de-identified information wherever it will do the job.

We do not sell personal information. We do not use your procurement content to train our own or any third party's machine learning models.

Several features work by sending your content to a third party AI provider, which processes it and returns a result. This happens when documents are read to draft requirements, when vendor profiles are matched against a brief, when a response is scored against its evidence, and when you talk to Kai. We also use the same provider to research companies for the vendor registry and read vendors' product pages (section 6), and to find the people at an organisation and the business contact details it publishes (section 10).

Our AI provider is Anthropic, listed in the table in section 7. Content is sent for processing and to return a result, and is not used by that provider to train its models. Anthropic processes it in the United States, so this is a disclosure of personal information overseas, covered in section 9. Output is decision support: a person in your organisation reviews it and makes the decision.

This section is for anyone named or described in the Vederca vendor registry at vederca.com/vendors, whether or not they have dealt with us. It explains what we hold, where it comes from, who sees it, how long we keep it, and how to have it corrected or removed.

What the registry is

The registry lists software vendors that sell to financial institutions. We research each listing ourselves from public sources, whether or not the company has signed up to Vederca. A listing is our compiled record of public information about a business, not a statement by the company, except for content the listing labels as published by the company itself.

What we hold about each company

Its name, legal name and business number where they are public, website, headquarters, size, year founded, products and what they do, categories, the regions it serves, the customers and partners it names publicly, the certifications and other credentials it states, and dated news about it. Each fact is kept with the public page it came from and the date we read it.

What we hold about people

The registry also holds personal information about people in business roles at listed companies: a person's name, their job title as published, the public page that names them, when we first and last saw them there, and, where a public source says they have left the company, that fact, its date and the page that says so. We collect these from the company's own website, such as its leadership or team page, and from published news. For the registry we do not collect anyone's contact details, photograph or anything about their private life.

We hold this because a financial institution choosing a supplier needs to know who leads it, and when that changes.

Where it comes from

The company's own website and product pages, read by our own crawler, which identifies itself as VedercaBot, or through our AI provider; archived copies of the company's own public pages; public registers, such as the Australian Business Register and the Consumer Data Right register; published news; and web search results.

Who sees it

Company facts are public on the listing. The names and job titles of the people we research for a listing are not on the public pages: they are shown only to signed-in procurement teams, meaning people at buying organisations with a Vederca account, and to the company itself once its account is linked to its listing. Procurement teams see a person who has left for 12 months after the date they left, marked as departed. We do not sell registry information.

A company that has claimed its listing and that we have verified can publish parts of its own Vederca profile on the listing, item by item: its tagline, About text, logo, products, photos, case studies, named clients and approved certifications. The company decides what is published and can take it down at any time. It can also publish people from its profile, one at a time: a person it chooses shows on the listing with their name, job title, photo and short introduction, never their email address or other contact details. The company confirms that each person has agreed. The references and documents in its profile are never published.

Correcting or removing information

Anyone named in the registry can ask us to see, correct or remove their own details, whether or not they or their company has an account. Email support@vederca.com with the subject "Privacy", tell us which listing and what should change, and we will answer within 30 days. We may first need to confirm that you are the person named. When we remove a person at their request, we record that, and we do not add them to that listing again from later reads of the company's pages or the news. Removing your details from the registry does not remove you from the company's own website or anywhere else they are published.

A company can ask us to correct or update its listing in the same way. Once a company has claimed its listing and we have verified it, it can see in the vendor portal everything we hold about the listing, with the source and date of each fact, and make its requests there. If a company asks us to take its listing off the registry, we remove the listing's detail, including the people named on it, and keep only a minimal entry of public business facts: its name, website and categories, unless the law requires us to remove more.

How long we keep it

We keep a listing, and the details of the people on it, while the company is listed and the information remains relevant, and we check listings against their sources regularly so that they stay current. Dated news drops off a listing after 18 months. A person who has left stays on our record, marked as departed with the date. A company that stops trading or merges into another is retired: its listing is hidden from the registry and kept as a record.

Inside the platform, information is disclosed as the product works: your profile and response go to the buying organisation that invited you; a procurement's content is visible to the users in the organisation running it and to the vendors invited to it. A public procurement is listed only to vendors with a complete profile in the sectors the buying organisation chooses. Private procurements are never listed.

The vendor registry is public, except for the names and job titles of the people it lists, which are shown only as section 6 describes. Apart from its company name, website, size and year founded, which may complete its listing, what a vendor adds to its own profile appears on its listing only where the vendor has published it there. Everything else in the profile is shared only with a buying organisation that Vederca has verified and that is running a procurement, and only with those of its users who have accepted the Platform Confidentiality Undertaking.

We also disclose to a buying organisation, in the report on a procurement your organisation responded to, whether your organisation held Vederca Plus while the procurement ran, and when.

Vendors on Vederca Plus see grouped information about the organisations viewing their profile, such as their region, country, industry and size band, and what they opened, including the videos they played. A figure is shown only where at least five organisations are behind it, and never with a name or a person. They also see, for each category of the registry, how many procurement organisations opened a vendor in it, with their industries and size bands, on the same rule and for no vendor in particular.

We also use the following service providers:

We may also disclose personal information to our professional advisers, to a party acquiring our business (subject to this policy continuing to apply), and where we are required or authorised by law, including to a court, regulator or law enforcement agency.

The platform's application, database, stored files and server logs are hosted by Amazon Web Services in its Sydney region (ap-southeast-2), in Australia. Email is sent through Amazon SES and text messages through Amazon SNS, both from the Sydney region.

The website is delivered through Amazon CloudFront, which serves the site's pages and files from AWS locations close to each visitor, so a request from outside Australia may pass through an AWS location in that visitor's own region.

Some of the providers in the table in section 7 are located outside Australia, so using them is a disclosure of personal information overseas for the purposes of Australian Privacy Principle 8. The countries are:

• the United States, where Anthropic processes the content sent to our AI features and the public pages and search results we research for the vendor registry and our outreach records, and where Stripe (payments), Google (Google sign-in and the address lookup) and Serper (web search) are located;
• the countries where Amazon CloudFront has locations, when it delivers the website to a visitor outside Australia; and
• the United Kingdom and the United States, where the public tender registers we search are, which receive search queries only.

Before disclosing personal information overseas we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles, including through the contract we hold with them. By using the platform you acknowledge these overseas disclosures.

Most of what we send to account holders is a service message: an invitation, a clarification, a status change, a security notice. These are part of the platform and you cannot opt out of them while your account is open, though you can control the categories and frequency in your notification settings. We send a text message only when you ask us to verify a mobile number.

Outreach to businesses

We also write to people at organisations we think could use Vederca: financial institutions that buy software, and vendors that sell it, including companies listed in the vendor registry, which we invite to claim their listing. These emails are direct marketing. For them we keep an outreach record of business contacts: a person's name, organisation and job title, their business email address and, where the organisation publishes one, a business phone number, with the public page or search result each detail came from. Phone numbers are recorded for information only.

We find these details on the organisation's own website, such as its contact, team and leadership pages, in web search results, including public LinkedIn search results, and on other public pages such as media releases and conference programmes. At a vendor we write to the people and inboxes that deal with new business, such as sales, bids and tenders, marketing, partnerships and country management, or to a general enquiries address the company publishes.

We email an address only when we have recorded a basis for it: the organisation published it and our message relates to the person's role, the person has an existing business relationship with us, or they asked to hear from us. Where we cannot find a published address for someone, we may work out a likely address from the pattern of the organisation's other published addresses, but we never email a worked out address unless a basis is recorded for it. Under the Spam Act 2003 (Cth), we rely on the consent inferred from an address being conspicuously published where our message relates to the person's role, or on consent the person gave us.

Our outreach emails measure whether they are opened and which links are followed: each copy carries a small image and links unique to it, and we record when they are loaded or followed, with the browser's user agent. We use this to see whether our outreach is useful and to avoid writing again to people it does not interest.

Your choices

Every commercial email we send identifies us and how to contact us, and carries a working unsubscribe link, together with a one-click unsubscribe your mail program can offer. Unsubscribing takes effect at once, and in any case within five business days: your address goes on our suppression list, which we check before every send and keep even if your other details are deleted, so that you are not emailed again. You can also ask us at any time, free of charge, to stop using your details for direct marketing, to delete your outreach record, or to tell you where we got your details, by emailing support@vederca.com with the subject "Privacy". We act on these requests within a reasonable time, and tell you the source of your details unless that is impracticable or unreasonable.

The platform keeps a small amount of information in your browser, and asks for your consent before anything beyond what is strictly necessary is stored. Our Cookie Policy lists every item, what it is for, and how to change your choice at any time.

We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. These include encryption in transit (HTTPS), access controls that separate one organisation's data from another's, role-based permissions inside an organisation, passwordless authentication with single-use links or Google sign-in, sessions that last at most eight hours and can be revoked, and audit logging of significant actions.

No system is perfectly secure. If an eligible data breach occurs we will assess and respond in accordance with the Notifiable Data Breaches scheme, and notify affected individuals and the Office of the Australian Information Commissioner where the scheme requires it.

We keep personal information only for as long as we need it for the purposes in this policy, then destroy or de-identify it. In practice:

• Account records are kept while the account is open. When you delete your account, we remove your personal details from it straight away (your name, email address, job title, phone number and verified mobile number, photo, time zone, notification settings and Google sign-in details), end every session and deactivate it. A deleted account cannot be restored. Procurement records you took part in stay complete and show "Deleted user" where you appeared, and we keep a record of the deletion itself, which includes the name and email address the account had at the time. Logs made while the account was open are kept as described below.
• Organisation records are kept while the organisation has members. When its last member deletes their account, the organisation is closed and its records are kept, because procurements it took part in rely on them. You can ask us to erase a closed organisation's records; its responses to other organisations' procurements stay in those procurements.
• Procurement content is kept as part of the owning organisation's records, because a procurement record is something both sides may need to rely on later.
• Kai conversations. A vendor's conversations with Kai, the assistant in the vendor portal, about a procurement are kept as part of that procurement's record, and Vedercaadministrators can read them. They are deleted seven years after the procurement ends, which is when the buyer records its decision or the procurement closes without one. Other Kai conversations are kept with the organisation's records, as described above.
• The vendor registry is kept as section 6 describes.
• Outreach records are kept while we may write to the organisation again. People our lead research suggests and nobody on our team confirms are deleted after 30 days; for a suggestion our team dismissed, we keep only a reduced form of the person's name and their organisation, so that the same person is not suggested again. Copies of organisations' web pages read to find the contact details they publish are deleted after 30 days. An address that unsubscribes, or whose owner asks us to delete their outreach record, stays on our suppression list permanently, so that it is never emailed again.
• AI processing records. The full text of what we send to our AI provider and what it returns is cleared from our records after 30 days. The record that the call was made, with its size and cost, is kept.
• Sign-in links, with the time, IP address and browser recorded when each was requested and used, and mobile verification codes are deleted 30 days after they expire.
• Site analytics records are deleted after 12 months.
• Security, audit and email delivery logs, and our servers' request logs, are kept while we need them to keep the platform secure, investigate problems and resolve disputes.

We may keep information for longer where a law requires it or where it is needed for a legal claim, and we keep aggregated de-identified statistics indefinitely.

You can see and change most of your information yourself in account settings and in your organisation's profile. You can also ask us for access to the personal information we hold about you, and ask us to correct it if it is wrong, whether or not you have an account. This includes information about you in the vendor registry and in our outreach records.

Email support@vederca.com with the subject "Privacy", or use the support console if you have an account. We respond to a request for access or correction within 30 days, and there is no charge for making one. We may need to verify your identity first. There are limited grounds in the Privacy Act on which we may refuse access or decline a correction; if we do, we will tell you why in writing and how to complain, and if we decline a correction you can ask us to keep a statement with the information saying that you consider it wrong.

Anyone can ask us to correct or remove information in the vendor registry, including their own name and job title or anything about their company, whether or not they have an account. Section 6 explains how, and what happens next.

You can delete your account from account settings. Section 13 explains what deleting it removes and what stays. Deleting an account does not delete a procurement record held by another organisation, because that record is theirs.

If you are in the European Union or the United Kingdom, section 15 sets out your further rights.

If you are in the European Union or the United Kingdom, the GDPR or the UK GDPR may apply to how we handle your personal data, and this section adds the information they require. We, A.C.N. 699 804 307 Pty Ltd trading as Vederca, are the controller, and you can reach us at support@vederca.com with the subject "Privacy". If you are named in the vendor registry, or are one of the business contacts we write to, and we did not collect your details from you, sections 6 and 10 and this section are the information Article 14 requires us to give you.

Why we may use your data

• to provide the platform to you and your organisation, under our contract with you or with it (Article 6(1)(b));
• to meet our legal obligations, such as keeping tax records (Article 6(1)(c));
• to measure how the public website is used, only with your consent (Article 6(1)(a)), which you can withdraw at any time under Cookie settings;
• to compile and publish the vendor registry, including the names and job titles of people in business roles, and to write to business contacts about Vederca, on the basis of our legitimate interests (Article 6(1)(f)); and
• to keep the platform secure and to establish, exercise or defend legal claims, also on the basis of our legitimate interests.

Our legitimate interest in the registry is giving financial institutions an accurate, current and sourced record of the vendors that serve them, including who leads each vendor and when that changes, which a regulated institution needs to know when it chooses a supplier. In our outreach, it is telling businesses about a service relevant to their work. We have weighed these interests against yours: we use only information published for business purposes, the registry holds no contact details for the people it names and nothing about their private lives, their names are shown only to signed-in procurement teams and to the company itself, and you can object at any time.

What we hold and where it comes from

For the registry: your name, job title, the company you work for, the public page that names you and, where a public source says so, the date you left. For our outreach: your name, job title, organisation, business email address, any business phone number your organisation publishes, the source of each detail (which may be a public LinkedIn profile), and our emails to you and whether they were opened or their links followed. We collect these from publicly accessible sources, as sections 6 and 10 describe. Section 6 says who sees registry information, and section 13 how long we keep each kind of record.

Where your data goes

Your data is held in Australia (section 8) and processed by the service providers in section 7, some of which are in the United States (section 9). Both countries are outside the European Economic Area and the United Kingdom. You can ask us how your data is protected when it is transferred, and for a copy of the safeguards we rely on.

Your rights

You have the right to ask us for access to your data, and to have it corrected, erased or restricted. You can object to our use of it on the basis of legitimate interests, and we will stop unless we have compelling legitimate grounds that override your interests or need it for a legal claim. You can object to direct marketing at any time, and we will stop. Where we use your data on the basis of your consent or a contract, and by automated means, you can ask for a copy in a structured, machine-readable format. Where you gave consent, you can withdraw it at any time, without affecting what we did before. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you.

Email support@vederca.com with the subject "Privacy" to use any of these rights. We respond within one month, which the law allows us to extend by two further months for a complex request; if we need to, we will tell you why within the first month.

You can also complain to a supervisory authority: in the European Union, the data protection authority in the country where you live or work, or where you think the problem happened; in the United Kingdom, the Information Commissioner's Office at ico.org.uk. We would welcome the chance to put things right first.

If you think we have breached the Australian Privacy Principles, raise it with us first, through the support console in the platform or by email to support@vederca.com with the subject "Privacy". Tell us what happened and what outcome you are looking for. We will acknowledge it promptly and aim to give you a written response within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au. If you are in the European Union or the United Kingdom, you can also complain to a supervisory authority, as section 15 explains.

We may update this policy. The current version and its date are always at the top of this page. Where a change is material we will give notice in the platform before it takes effect. This version is 1.9, effective 18 October 2026.

For privacy questions and requests, email support@vederca.com with the subject "Privacy", whether or not you have an account. Account holders can also use the support console in the platform, under Support in the buyer or vendor portal, where requests stay attached to your organisation's record.

To report a security issue, email the same address with the subject "Security". The Contact support page in the user guide sets out the other ways to reach us. Written notices can be addressed to A.C.N. 699 804 307 Pty Ltd (ACN 699 804 307) at its registered office as recorded on the ASIC register.