Edexia procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | unknown | “ How can you seek to access and correct personal information we hold about you? You may seek access, correct or update personal information we hold about you by contacting us as described in the “How to contact us” section below. We will provide access to that information in accordance with applicable legal requirements. We may require that the person requesting access provide suitable identification and where permitted by law we may charge a fee for giving access to your personal information. You may have additional rights depending on applicable privacy laws, which may include: the right to request erasure of personal information we hold about you, for example if the personal information is no longer necessary to provide services to you; the right to withdraw consent. You may withdraw your consent at any time where we relied on your consent to process your personal information; the right to require us to stop using all or some of your personal information (for example, if we no longer have a legal right to keep using it) or to restrict our use of your personal information (for example, if you consider that the personal information we hold about you is inaccurate or if it is unlawfully held); the right to data portability. In some circumstances you have the right to be provided with a copy of the personal information we hold about you in a structured, machine-readable and commonly used format; and the right to require us to check with you before using or disclosing your personal information that it is accurate, up to date, complete and not misleading. To avoid doubt, these additional rights will only apply to the extent required under the applicable privacy laws. We may ask you to provide suitable identification when you seek to exercise any of these rights.” | Captured 2026-08-11Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ (a) It becomes unfeasible to continue providing the service (Edexia will provide services for the contract term and give at least 6 months' notice of termination); (b) Edexia is acquired by a third party (Edexia will provide services for the contract term and give at least 6 months' notice of termination); (c) Edexia is required to do so by law or an authority; (d) You undergo a change of control without Edexia's consent; or (e) You request early termination, subject to an early termination charge.” | Captured 2026-07-20Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ (a) The service is subject to three or more critical incidents in a calendar month caused solely by Edexia (excluding scheduled maintenance).” | Captured 2026-07-20Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ (a) Edexia may pay or receive commissions or rebates in connection with the Service Agreement. (b) You must pay all bank fees incurred in making payments to Edexia and any out-of-pocket expenses Edexia incurs in providing services, provided they exceed $500 and with your prior consent.” | Captured 2026-07-20Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ You may terminate a Service Agreement by notice if:” | Captured 2026-07-20Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ We will keep your personal information only for as long as necessary to provide you with our Services, unless a longer retention period is required by law or specified in our retention policy. When you request deletion of your data, we ensure it is deleted completely from our systems, except where retention is necessary to comply with legal obligations, resolve disputes, or maintain security as specified in our retention policy.” | Captured 2026-08-11Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ We will only use personal information about you if we have a lawful basis to do so, for example: where you have given us your consent; where processing of your personal information is necessary for the performance of a contract with you; to meet our legal obligations; and to pursue our legitimate business interests. However, we will only use or disclose your personal information: for the purposes for which we collected it (and related purposes which would be reasonably expected by you); for other purposes to which you have consented; and as otherwise authorised or required by law. We may also use or disclose your personal information for our administrative, marketing (including direct marketing), planning, product or service development, quality control, survey and research purposes and for other purposes to which you have consented, or as otherwise permitted or required by law.” | Captured 2026-08-11Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Edexia is excused from its obligations under the Service Agreement to the extent that a force majeure event prevents or hinders service delivery.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ (a) All intellectual property (IP) rights in Edexia and its services are owned by Edexia or its licensors. You must not infringe or commercialize these rights. (b) You retain ownership of your data, but Edexia owns any customizations, modifications, enhancements, and derivative works related to the services. (c) Edexia owns all trademarks associated with its services. You may not use any trademark without prior written consent from the owner. (d) You grant Edexia a license to use feedback provided by you or your end users to improve the services.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We may disclose your personal information to third parties in connection with the purposes described above. This may include disclosing your personal information to the following types of third parties: our related companies; our professional advisers (such as lawyers, accountants or auditors) and insurers; our employees, contractors and third party service providers who assist us in performing our functions and activities, specified in the Subprocessor list e.g. payment systems operators and financial institutions, cloud service providers, data storage providers, shipping companies, telecommunications providers and IT support services providers; third parties to whom you have authorised us to disclose your information (e.g. referees) as well as third parties who we engage to assist in providing the services; and any other person as required or permitted by law. We may also share anonymous or de-identified usage data with our service providers for the purpose of helping us in such analysis and improvements. Additionally, we may share such anonymous or de-identified usage data on an aggregate basis in the normal course of operating our business; for example, we may share information publicly to show trends about the general use of our Services. Anyone using our online communities, forums, blogs, or communication features on our Website may read any personal information or other information you choose to submit and post. ” | Captured 2026-08-11Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ We use cloud-based data storage solutions for managing files uploaded by users to our services. These documents are stored on Amazon Web Services and Supabase, which help us organise data in a structured manner using parent folders. File names are solely used for storage purposes and are not processed or utilised in any other way. Access to these documents is restricted to ensure that users can only access their own uploaded data. Users have the capability to delete their data safely and completely. Data fetching is conducted by the parent folder rather than by file name, which enhances data retrieval processes and security. The AI systems involved in managing these documents do not have knowledge of the file names; they only process the contents within the files.” | Captured 2026-08-11Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ (a) Upon expiry of the current contract term with at least 90 days' written notice;” | Captured 2026-08-11Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.