Central procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Depending on where you are located, you may have certain rights regarding your personal data under applicable privacy laws. Subject to applicable law, you may have the right to: Right to Know/Access: You may request that we disclose the categories and specific pieces of personal data we have collected about you, the categories of sources, the business or commercial purposes for collection, and the categories of third parties with whom we share your personal data. Where required, we will provide this in a portable format.” | Captured 2026-09-24Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ We retain your Personal Data for as long as necessary to fulfill the purposes described in this Policy. In general, we use following factors to determine the retention period:” | Captured 2026-09-24Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Right to Correct/Rectification: You can change or correct data about yourself through your Central account at any time or by emailing us at support@central.inc. You can also email us if you wish to deactivate your account. We may retain data about you for a period of time consistent with applicable law.” | Captured 2026-09-24Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Right to Delete/Erasure: You may request deletion of your personal data, subject to certain exceptions (for example, where retention is required by law or necessary to complete a transaction).” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Clients, Service Providers, Affiliates, Business Partners, Insurance Carriers, Law Enforcement or Government Entities” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Service Providers: third parties that provide services on our behalf or help us operate the Service or our business (such as hosting, information technology, customer support, and email delivery).” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Analytics Cookie: used to gather usage and performance data, such as counting unique visitors and developing statistics about Platform operations. This may include cookies from third-party providers such as Google Analytics. You can learn more about Google Analytics here and opt out here . ” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Clients, Service Providers, Financial Institutions, Affiliates, Merchants, Business Partners, Insurance Carriers, Law Enforcement or Government Entities” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We may also share or permit third party online advertising networks and other third-party services to collect information about your use of our Services over time so that they may display ads that may be relevant to your interests on our Services as well as on other websites or apps, or on other devices you may use. Under certain U.S. privacy laws, the use of these technologies may be considered “sharing” or a “sale” of personal data, even though we do not exchange your data for money.” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Business transfers: in connection with, or during negotiations of, any merger, sale of Company assets, financing, or acquisition of all or a portion of our business to another company.” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ We may disclose your personal data with the following categories of recipients: Your employer (Client), as necessary to provide the Services and as directed by the Client.” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Advertising networks and data analytics providers, to conduct analytics and place advertisements on our behalf on third-party websites and services.” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ With your consent: We may disclose your personal information for any other purpose with your consent.” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Merchants, if you open a payment dispute for a transaction with said merchant.” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ (b) To connect Company’s services with Third Party Products, you authorize Company to, as applicable: (1) store relevant account information, (2) access the relevant service, (3) use and apply any signatures or other materials you provide Company in order to provide related services, such as to complete a tax document, (4) gather and export from such Third Party Product any data or other information reasonably necessary to provide related Company’s services to you, such as Customer’s payroll information, bank account information, Customer’s employees’ bank account information, and any additional information, such as the personal information of Customer’s employees, requested by such Third Party Product that Customer has provided or made available to Company in connection with Company’s services, and (5) otherwise take any action in connection with such Third Party Product as reasonably necessary to provide related services to you, including, but not limited to, opening accounts and making changes on your behalf with such third-party institutions. You further designate Company as your agent and limited attorney-in-fact in connection with Third Party Products, if required and only as required to use the Third Party Product (e.g., tax filing systems). You agree that such third party providers are entitled to rely on the foregoing authorization, agency, and power of attorney granted by you in their provision of the Third Party Product via Company’s services.” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ (a) Company’s services are designed to work with a number of third party products (“Third Party Products”); however, Third Party Products are not Company’s services. Company does not provide any representations, warranties, indemnities, or support with respect to such Third Party Products. By using Company’s services, you agree to enable Third Party Products, and hereby consent to any use of such Third Party Products and any exchange of data, including Customer Data, between Customer or a User and any such third party provider or Third Party Product. When you enable a Third Party Product, you grant Company permission to allow the Third Party Product and its provider access to Customer Data as required for the interoperation of that Third Party Product with Company’s services. You may be required to grant Company the ability to create, access, delete and/or otherwise modify your account(s) on such Third Party Products. You acknowledge that Company is not responsible for any use, disclosure, modification or deletion of Customer Data that is transmitted to, or accessed by, a Third Party Product, and that the handling of such Customer Data within the Third Party Product will be exclusively governed by the separate terms and agreements, if any, governing such Third Party Product. Customer and Users will comply with all terms and conditions applicable to the use of Third Party Products. Customer acknowledges it has sole responsibility for, and assumes all risks arising from, Customer’s use of any Third Party Products. Company does not guarantee the continued availability, operation, or utility of Third Party Products or Company’s services features integrated with Third Party Products, and may cease providing certain Third Party Products via Company’s services without notice” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ (a) Company may make certain additional services available through its Site (e.g., payroll services). In addition, to the extent you purchase third-party services offered, referred, resold or otherwise made available by Company through the Site, you may be subject to the terms of service for that third-party service provider.” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ With regulators, law enforcement, or other government entities: where required by law or as we have a good faith belief that such action is necessary or appropriate. For example, to respond to a court order or subpoena, protect ourselves, enforce our terms and conditions, and investigate suspicious or potentially fraudulent activity.” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ This Privacy Policy (“Policy”) describes how Central Business Applications Inc., and its subsidiaries, ("Central," “we,” “us,” or “our”), a wholly owned subsidiary of Mercury Technologies Inc. (“Mercury”), collects, uses, and discloses your personal data when you interact with Central’s platform including our applications, websites, software, and support services (the “Platform”) through which we offer payroll, benefits administration, and related workforce management products and services (“Services”). As part of Mercury, Central may share personal data with Mercury and its affiliates as described in this Policy. For more information about Mercury’s privacy practices, please visit www.mercury.com/privacy . Please read this Policy carefully. By continuing to use or access the Platform or our Services, you are consenting to the practices described in this Policy.” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ With financial institutions, processors, payment card associations and other entities that are involved in the payment process as necessary to provide the Services.” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Service Providers, Affiliates, Financial Institutions, Business Partners, Insurance Carriers, Law Enforcement or Government Entities” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Clients, Service Providers, Affiliates, Business Partners, Insurance Carriers” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ With insurance carriers and benefits administrators: where applicable, we share information with insurance carriers, general agents, brokers, and third-party administrators to administer employer-sponsored benefits. We share protected health information only as authorized by you, as necessary to provide the benefits services, or as required by applicable law.” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Affiliates, including Mercury Technologies Inc. and its subsidiaries or other companies that Mercury controls or that are under common control with Mercury, may use personal data for any purpose described in this Policy.” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ For business transfers: we may use your information to evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal data held by us about our Service users is among the assets transferred.” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ With other users: when you share personal information or otherwise interact in the public areas with other users, such information may be viewed by all users and may be publicly distributed outside.” | Captured 2026-09-24Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.