Lorka Ai procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | low | “The third parties mentioned above may have their headquarters outside the European Economic Area (EEA), therefore, your personal data will be the object of international transfers. In any event, if a personal data international transfer is deemed appropriate, We inform you that We will only transfer personal data to recipients located in countries that ensure an adequate level of data protection or, failing that, offer the appropriate safeguards required by the current applicable law and regulations on the protection of personal data, to ensure that your personal data is properly protected and that your individual rights and freedoms are guaranteed. In this regard, please be informed that the third parties mentioned above are committed to standard contractual clauses approved by the EU Commission certification in case of transfers to the USA.” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “We will keep your personal data only for as long as you are subscripted to the Services and, beyond that, your personal data will be retained, securely blocked, for the necessary retention period to fulfil our legal obligations and/or for our legitimate reasons (i.e to address claims in connection with the services offered through the Website; to finish the investigation of detected fraudulent or illicit activity.) Once the necessary retention period has ended, your personal data will be securely deleted from our information systems.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ (v) service providers to support the organization and management of promotions (e.g, providers of tools for selection of winners, IT and hosting providers) acting under our instructions.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ (ii) service providers to perform functions and provide Services to us, such as hosting and backend infrastructure, database storage and management, email management, store marketing, credit card processing, customer service and others.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ (vi) administrative, police or judicial authorities as long as the data is required in accordance with the applicable law and regulations;” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “We will not share your personal information with third parties without your consent. Nonetheless, in order to provide the Services and comply with our legal obligations, protect our legal rights, or respond to a valid legal request, we may communicate your personal data to the following third parties, including but not limited to: (i) other providers such as Amplitude, Google Inc, Stripe, and Firebase, among others; (ii) service providers to perform functions and provide Services to us, such as hosting and backend infrastructure, database storage and management, email management, store marketing, credit card processing, customer service and others. (iii) service providers to provide authentication and identity verification services, acting as data processors on our behalf, for the purpose of enabling secure user access to the Website/App. (iv) service providers to process subscription payments, acting as data processors, in order to securely manage payment transactions and billing for the Website/App. (v) service providers to support the organization and management of promotions (e.g, providers of tools for selection of winners, IT and hosting providers) acting under our instructions. (vi) administrative, police or judicial authorities as long as the data is required in accordance with the applicable law and regulations; (vii) law firms to respond to claims regarding our Website or services offered through it;” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ (i) other providers such as Amplitude, Google Inc, Stripe, and Firebase, among others;” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We will not share your personal information with third parties without your consent. Nonetheless, in order to provide the Services and comply with our legal obligations, protect our legal rights, or respond to a valid legal request, we may communicate your personal data to the following third parties, including but not limited to:” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ (vii) law firms to respond to claims regarding our Website or services offered through it;” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ (iv) service providers to process subscription payments, acting as data processors, in order to securely manage payment transactions and billing for the Website/App.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ (iii) service providers to provide authentication and identity verification services, acting as data processors on our behalf, for the purpose of enabling secure user access to the Website/App.” | Captured 2026-06-07Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.