DiligenceSquared procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Since your privacy is important to us, we want you to be fully aware of the data protection rights that may be available to you under EEA, UK, and Swiss law if applicable, including the EU General Data Protection Regulation (" GDPR "), the UK General Data Protection Regulation and the Data Protection Act 2018 (" UK GDPR ") and the Swiss Federal Act on Data Protection (" FADP ") (collectively together as " EU DPLs "). As used herein, " EEA " refers to the European Economic Area. Lawful basis for processing your personal data in EEA, UK, & Switzerland: We process personal data, as defined under the EU DPLs, on the following legal bases (for more detail about the types of personal data we collect for each legal bases, see Section 2): Contract : Where it is necessary to process your personal data for us to perform a contract you have agreed to enter into with us. If you do not provide your personal data to us, we will not be able to carry out our obligations under the terms of the contract. Legitimate Interests : We are permitted to process your personal data if it is based on our legitimate interests, such as to understand our users, promote our Services and websites, and operate and maintain our Services and websites. Examples of when we rely on our legitimate interests to use your personal data include: when we analyze what content has been viewed on our websites, to carry out marketing analyses so that we can make our marketing more relevant to your interests and preferences, for internal administrative purposes to operate our business, to respond to your inquiries and to resolve complaints, for security and fraud prevention, and to ensure that our Services and websites are safe and secure and used in line with our contracts with you. ” | Captured 2026-08-14Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Rights of EEA, UK & Swiss Data Subjects: Users accessing Services from the EEA, UK & Switzerland are entitled to the following rights where the EU DPLs apply (which may be exercised against us or, if we are not the controller): The Right to be Informed — You have the right to be provided with clear, transparent, and easily understandable information about how we use your personal data and your rights. This is why we are providing you with the information in this Privacy Policy.” | Captured 2026-07-20Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ The Right to Rectification — You have the right to request that we correct any personal data you believe is inaccurate. You also have the right to request that we complete the personal data if you believe it is incomplete.” | Captured 2026-07-20Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ The Right to Access — You have the right to request access to your personal data that is within our possession.” | Captured 2026-07-20Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Auditing compliance with US data protection laws and other relevant standards; and” | Captured 2026-07-20Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Since your privacy is important to us, we want you to be fully aware of the data protection rights that may be available to you under EEA, UK, and Swiss law if applicable, including the EU General Data Protection Regulation (" GDPR "), the UK General Data Protection Regulation and the Data Protection Act 2018 (" UK GDPR ") and the Swiss Federal Act on Data Protection (" FADP ") (collectively together as " EU DPLs "). As used herein, " EEA " refers to the European Economic Area. Lawful basis for processing your personal data in EEA, UK, & Switzerland: We process personal data, as defined under the EU DPLs, on the following legal bases (for more detail about the types of personal data we collect for each legal bases, see Section 2): Contract : Where it is necessary to process your personal data for us to perform a contract you have agreed to enter into with us. If you do not provide your personal data to us, we will not be able to carry out our obligations under the terms of the contract.” | Captured 2026-07-20Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ We operate the websites and Services platform in the United States and, depending on your country of residence, the submission of personal data to our websites or Services platform may involve the collection of such personal data in the United States for our processing. Your personal data may be processed by personnel operating in the United States who work for us or one of our third party service providers or by our personnel and personnel of our third party service providers who may access your personal data remotely globally. As a result, your personal data may be subject to access by and disclosed to the U.S. government and law enforcement agencies according to U.S. laws. If we collect your personal data as a service provider on behalf of a third party, the third party may access and transfer your personal data to locations and countries as described in the third party's privacy policy. ” | Captured 2026-08-14Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ We operate the websites and Services platform in the United States and, depending on your country of residence, the submission of personal data to our websites or Services platform may involve the collection of such personal data in the United States for our processing. Your personal data may be processed by personnel operating in the United States who work for us or one of our third party service providers or by our personnel and personnel of our third party service providers who may access your personal data remotely globally. As a result, your personal data may be subject to access by and disclosed to the U.S. government and law enforcement agencies according to U.S. laws. If we collect your personal data as a service provider on behalf of a third party, the third party may access and transfer your personal data to locations and countries as described in the third party's privacy policy.” | Captured 2026-07-20Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ The Right to Erasure — This is also known as the " right to be forgotten ." You have the right to request that we erase your personal data, if there is no compelling reason for us to keep using it or if it is no longer necessary in relation to the purposes for which it was originally collected or otherwise processed. This is not a general right to erasure; there are exceptions.” | Captured 2026-07-20Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Right to Delete Your Data . You have the right to request that we delete any of your personal data that we collected from you and retained, subject to certain exceptions. You can make this request by contacting us as described in Section 13.” | Captured 2026-07-20Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Deletion — You can request that we delete your personal data that we maintain about you, subject to certain exceptions.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Our websites and Services may contain links to third-party websites or services. These third parties are bound by their own privacy policies. We are not responsible for the privacy practices of others. When you leave our websites or Services to visit a third-party website or service, please read their privacy statements. This Privacy Policy applies solely to personal data collected by us through the Services, and not to any personal data collected by the operators of third-party websites or services. The inclusion of a link on the website/Service does not imply endorsement of the linked website or service by us or by our affiliates.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Mergers or Reorganizations : If we undergo a business acquisition, merger, or sale of assets, we may transfer your personal data to the successor entity. If we go out of business or enter bankruptcy, your personal data would be an asset transferred to or acquired by a third party.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We may collect, use, and share personal data about you from you and through and with our third party service providers (for example who provide platform hosting services, data analytics, translation, expert services or other services to us) (" service provider(s) "). We may collect, use and share your personal information on behalf of and at the direction of our customers for research purposes. In the interest of transparency, we may describe in this Privacy Policy some of the most common data collection, use, and sharing on behalf of such third parties, but this Privacy Policy does not govern such third parties' collection, use, processing, or sharing. We are not responsible for the privacy or security practices of such third parties, and you should consult their privacy policies and contact them directly with any questions about that personal data . Third party services are described further below.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Purposes of Collection : We collect your personal data for the business and commercial purposes described in Section 2 above. How personal data is Collected : We collect the above categories of personal data from the sources described in Section 3 of this Privacy Policy. Who we Share personal data with : We may disclose each of the above categories of personal data for the business and commercial purposes described in this Privacy Policy to the extent permitted by applicable law to the categories of third parties as described in Section 4 above. Sale of personal data : We may "sell" all categories of personal data disclosed in Section 1 above. We may "sell" these categories of personal data to the categories of third parties described in Section 4 of this Privacy Policy. You have the right to know whether your personal information is being sold. For example, under the CCPA, your personal information is "sold" when it is provided to a third party for monetary or other valuable consideration for a purpose. Please note a "sale" does not include when we disclose your personal information that has been de-identified prior to sharing with a third party or is shared, at your direction, to a third party service provider for a specific business purpose or when otherwise permitted under law. Notice and Right to Request : You have the right to request access to your personal data that is within our possession. Shine the Light Notice : California Civil Code Section 1798.83 permits California residents to request certain information regarding our disclosure of "personal data" (as defined by this law) to third parties for their direct marketing purposes. ” | Captured 2026-08-14Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ For Safety, Security, or Legal Compliance Purposes : We might share information in response to subpoenas, court orders, or other legal process (including for national security and law enforcement purposes); to establish or exercise our legal rights or the legal rights of a third party service provider, sponsor, customer, or other research provider (for example to enforce confidentiality or intellectual property rights); to defend against legal claims; or as otherwise required by law; to comply with applicable laws; to protect rights, safety and property of us, our customers, or others; and to respond to lawful requests from public authorities. We might also share personal data to prevent, detect, or investigate suspected fraud, violations of our terms of service, harassment, or illegal conduct.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Third Party Service Providers We Hire to Work on our Behalf . For example, vendors or service providers including hosting services providers, network providers, and platform service providers, that host, manage, or maintain, analyze, translate, or provide other services for our Services, platform, infrastructure, or website or send promotional emails for us may collect and provide personal data about you including demographic, geo-location, behavioral, consumer preferences and internet activity related data.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We may make onward transfers of your personal data to third party service providers acting on our behalf as described in Section 4 and we will comply with our obligations under the EU DPLs in connection with such transfers. We remain liable for such onward transfers to such third party service providers to the same extent as we are liable for our own processing activities under the EU DPLs. If you are not satisfied with our response to your complaint or believe our processing of your personal data does not comply with the applicable EU DPLs, you can make a complaint to your data protection authority. Please note your rights in relation to your personal data are not absolute. We may, for example, deny you access to your personal data when required or authorized by law, or if granting access would have an unreasonable impact on another individual's privacy. We will retain and use your personal data as long as necessary to comply with our legal and business obligations, provide the Services, resolve disputes, and enforce our agreements.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Other Disclosures : We may also share personal data for other reasons where we obtain your consent as permitted by law.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ The right to refuse or withdraw consent — You have the right to refuse to provide and withdraw your consent to processing of your personal data at any time with effect for future processing. We may make onward transfers of your personal data to third party service providers acting on our behalf as described in Section 4 and we will comply with our obligations under the EU DPLs in connection with such transfers. We remain liable for such onward transfers to such third party service providers to the same extent as we are liable for our own processing activities under the EU DPLs. If you are not satisfied with our response to your complaint or believe our processing of your personal data does not comply with the applicable EU DPLs, you can make a complaint to your data protection authority. Please note your rights in relation to your personal data are not absolute. We may, for example, deny you access to your personal data when required or authorized by law, or if granting access would have an unreasonable impact on another individual's privacy. We will retain and use your personal data as long as necessary to comply with our legal and business obligations, provide the Services, resolve disputes, and enforce our agreements. ” | Captured 2026-08-14Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “We might also share personal data to prevent, detect, or investigate suspected fraud, violations of our terms of service, harassment, or illegal conduct. Mergers or Reorganizations : If we undergo a business acquisition, merger, or sale of assets, we may transfer your personal data to the successor entity. If we go out of business or enter bankruptcy, your personal data would be an asset transferred to or acquired by a third party. Other Disclosures : We may also share personal data for other reasons where we obtain your consent as permitted by law. Sale of Personal Data : If we collect personal data on behalf of our customer as part of research services and you are a participant or expert providing information in connection with such services, we may sell or share your personal data with such customers for their business use strictly in connection with the provision of the Services to them for research purposes. You have the right to know whether your personal information is being sold. For example, under the CCPA, your personal information is "sold" when it is provided to a third party for monetary or other valuable consideration for a purpose. Please note a "sale" does not include when we disclose your personal information that has been de-identified prior to sharing with a third party or is shared, at your direction, to a third party service provider for a specific business purpose or when otherwise permitted under law. ” | Captured 2026-08-14Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Service providers : We engage service providers to process personal data on our behalf and help us pursue our business purposes, such as analytics, user support, billing and sales activities, data analysis, customer service engagement, email delivery, cloud hosting services, platform services, and marketing assistance. Such service providers may use such data for their own business purposes to enhance, improve, and deliver their services and in such case their use is governed by their privacy policy. For a list of our third party service providers who serve as subprocessors for our platform Services, as may be updated from time to time, please see here https://trust.diligencesquared.com/subprocessors .” | Captured 2026-07-20Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.