SAP Joule procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Access your personal data that we have on you, or have it updated.” | Captured 2026-08-12Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Where SAP is subject to the requirements of the Digital Personal Data Protection Act, 2023 (‘DPDPA’) the following applies: ” | Captured 2026-08-12Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ In Australia, a complaint should first be made to SAP in writing as required by law. You can find more information about privacy and the protection of Personal Data on the Office of the Australian Information Commissioner website.” | Captured 2026-08-12Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ You can reach out via email at privacy[@]sap.com to exercise your data protection rights.” | Captured 2026-08-12Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ The contact details of your specific data protection supervisory authority can be found on the European Data Protection Board website . SAP’s lead data protection supervisory authority is the Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg and can be reached at Lautenschlagerstraße 20, 70173 Stuttgart/Germany. ” | Captured 2026-08-12Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Where SAP is subject to the requirements of the Protection of Personal Information Act, 2013 (“POPIA”) in South Africa, the following applies: ” | Captured 2026-08-12Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Where SAP is subject to Nigeria’s Data Protection Act (NDPA), the following applies: ” | Captured 2026-08-12Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ You can reach SAP Group’s data protection officer any time at privacy[@]sap.com. ” | Captured 2026-08-12Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Please direct any requests/queries to exercise your rights to privacy[@]sap.com. In India, after exhausting the opportunity of redressing the right of grievance, you may lodge a complaint to the Data Protection Board of India. ” | Captured 2026-08-12Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Address: Systems Applications Products Nigeria Limited, Mansard Place, 2nd Floor B Wing. Plot 927/928, Bishop Aboyade Cole Street. Victoria Island. Lagos, Nigeria ” | Captured 2026-08-12Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Lodge a complaint to the competent supervisory authority if you are not satisfied with how SAP is processing your personal data. Your competent supervisory authority can be found in the country specific section below.” | Captured 2026-08-12Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ The contact details of your local Data Protection Officers in Nigeria are as follows: ” | Captured 2026-08-12Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Data Protection Officer, Concur (Philippines) Inc., 7th Floor Alphaland Southgate Mall, Chino Roces, Makati City, email: dpo_concur.ph[@]sap.com; telephone number: +632-8705-2500” | Captured 2026-08-12Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Where SAP is subject to the Philippine Data Privacy Act and its Implementing Rules and Regulations, the following applies: ” | Captured 2026-08-12Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ SAP has appointed a Data Protection Officer for Brazil. Written inquiries, requests or complaints to our Data Protection Officer may be addressed to: ” | Captured 2026-08-12Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ If you are not satisfied with the process above, you have the right to lodge a complaint with the Information Regulator via post JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001, P.O. Box 31533, Braamfontein, Johannesburg, 2017 or via email: complaints.IR[@]justice.gov.za or for enquires: inforeg[@]justice.gov.za.” | Captured 2026-08-12Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Where SAP is subject to the requirements of the Personal Data Protection Law (PDPL) the following applies: ” | Captured 2026-08-12Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Data Protection Officer, SAP Philippines Inc., 27th Floor NAC Tower, 32nd Street Bonifacio Global City, Taguig City, 1632; email: dpo_sap.ph[@]sap.com; telephone number: +632-8705-2500” | Captured 2026-08-12Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ lodge a complaint with the Superintendence of Industry and Commerce (“SIC”) about a violation of the applicable laws.” | Captured 2026-08-12Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ The contact details of your local Data Protection Officer/s are as follows: ” | Captured 2026-08-12Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Where SAP is subject to the requirements of the Brazilian General Data Protection Law (“LGPD”), the following applies: ” | Captured 2026-08-12Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ SAP Colombia S.A. may Process your Personal Data by itself or on behalf of the SAP Group, with its main office located at Carrera 9 No 115 – 06, Edificio Tierra Firme Of. 2401 Bogotá D.C., Colombia. You can contact us either by the telephone number +57-6003000 or via email at: webmaster[@]sap.com ” | Captured 2026-08-12Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Delete your personal data we hold about you. Please note, however, that SAP can or will delete your personal data only if there is no statutory obligation or prevailing right of SAP to retain it. If you request from SAP to delete your personal data, you may not be able to continue to use any SAP service that requires SAP’s use of your personal data.” | Captured 2026-08-12Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Where SAP is subject to the requirements of the Privacy Act 1988 (Cth) (‘Privacy Act’), the following applies: ” | Captured 2026-08-12Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Obtain a copy of the personal data you provided to SAP, if SAP uses your personal data based on your consent or to perform a contract with you. In this case, please refer to the section below "How you can exercise your Data Protection Rights(s)". Please note that you will need to specify the information or processing activities to which your request relates, the format in which you would like to receive the personal data and whether it should be sent to you or another recipient. SAP will carefully consider your request and communicate with you how it can best be fulfilled.” | Captured 2026-08-12Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Lodge a complaint to the Personal Data Protection Commission (PDPC) if you are not satisfied with how SAP is processing your Personal Data.” | Captured 2026-08-12Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Systems Applications Products (Africa Region) Proprietary Limited, Systems Applications Products (South Africa) Proprietary Limited with registered address at 1 Woodmead Drive, Woodmead (SAP South Africa) is subject to South Africa's Protection of Personal Information Act, 2013 (Act 4 of 2013) and responsible party under the POPIA. ” | Captured 2026-08-12Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ SAP honors your statutory rights when it comes to the processing of your personal data. To the extent provided by applicable data protection laws, you have the right to: ” | Captured 2026-08-12Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Right to lodge a complaint with the Nigeria Data Protection Commission (NDPC).” | Captured 2026-08-12Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ “Personal Data” as used in this privacy statement means Personal Information as such term is defined under POPIA. “You” and “Your” as used in this Privacy Statement means a natural person or a juristic person as such term is used under POPIA. ” | Captured 2026-08-12Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Where SAP is subject to the requirements of the Singapore’s Personal Data Protection Act (PDPA), the following applies ” | Captured 2026-08-12Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Request from SAP the right to have readily available means of grievance redressal provided by SAP in respect of any act or omission of SAP regarding the performance of SAP’s obligations in relation to your Personal Data or your exercise of rights in relation thereto.” | Captured 2026-08-12Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Where SAP is subject to the requirements of the Colombian Statutory Law 1581 of 2012 and Decree 1377 of 2013, the following applies: ” | Captured 2026-08-12Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ You have the right to request from SAP access to, correction of, and/or the return or the deletion of your personal data. You may request from SAP to restrict the access to your personal data or to exclude it from further processing. You may revoke a once given consent or object to processing activities which SAP may intend to pursue in a given case. When you believe that SAP was processing your personal data not in accordance with this privacy statement or under breach of applicable data protection laws, you have the right to lodge a complaint with a relevant supervisory authority. The sap.com Privacy Statement describes each of these rights in detail, including how you can reach us to exercise any of these rights against SAP and how to identify, if necessary, the relevant data protection authority. ” | Captured 2026-08-12Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ If you are not satisfied with how we process your complaint you can file a complaint at the competent authority: ” | Captured 2026-08-12Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Within Nigeria as a data subject, you have following rights: ” | Captured 2026-08-12Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ SAP has appointed a Data Protection Officer for Singapore. Written inquiries, requests or complaints to our Data Protection Officer can be sent via post to Mapletree Business City, 30 Pasir Panjang Rd, #03-32, Singapore 117440 or email to privacy[@]sap.com with the subject “Data Protection Officer” or can be reached via phone +65 6664 6868 ” | Captured 2026-08-12Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ If SAP does not comply with the PDPL you can file a complaint to the contact provided in the first section of this privacy statement. ” | Captured 2026-08-12Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ revoke your consent and/or request the deletion of your Personal Data, provided that there is no supervenient legal or contractual obligation that allows SAP to keep your Personal Data in SAP’s databases.” | Captured 2026-08-12Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ until you revoke a consent you previously granted to SAP to process your personal data. ” | Captured 2026-08-12Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ SAP may store your Personal Data in paper-based files or as an electronic record in the Cloud or on physical devices e.g. computer systems. Your Personal Data will likely be held and stored by the SAP Group located in another country for our general business purposes including outsourcing and data processing. We will only do this where it is necessary or appropriate to achieve the purposes set out in this Privacy Statement. We take reasonable steps to protect your personal information from misuse, interference and loss and from unauthorized access, modification or disclosure. ” | Captured 2026-08-12Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ to fulfill SAP’s legitimate business purposes as further described in this privacy statement, unless you object to SAP’s use of your personal data for these purposes;” | Captured 2026-08-12Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Revoke consent, wherever SAP is processing your Personal Data based on your consent, you may at any time withdraw your consent by unsubscribing or giving us respective notice of withdrawal. In case of withdrawal, SAP will not process Personal Data subject to this consent any longer unless legally required or permitted to do so (e.g. if your Personal Data is needed by SAP to assert or defend against legal claims). In case SAP is required or permitted to retain your Personal Data for other legal reasons your Personal Data will be restricted from further processing and only retained for the term required by law or fulfil the other purpose. However, any withdrawal has no effect on past processing of Personal Data by SAP up to the point in time of your withdrawal. Furthermore, if your use of an SAP offering requires your prior consent, SAP will no longer be able to provide the relevant service, offer or event to you after your revocation.” | Captured 2026-08-12Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ SAP destroys your Personal Data by using electronic means as appropriate for the purposes described above.” | Captured 2026-08-12Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ for SAP to comply with statutory obligations to retain personal data, resulting inter alia e.g., from applicable export, finance, tax or commercial laws;” | Captured 2026-08-12Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Wherever SAP is processing your Personal Data based on your consent, you may at any time withdraw your consent by unsubscribing or giving us respective notice of withdrawal. In case of withdrawal, SAP will not process Personal Data subject to this consent any longer unless legally required to do so. In case SAP is required to retain your Personal Data for legal reasons your Personal Data will be restricted from further processing and only retained for the term required by law. However, any withdrawal has no effect on past processing of Personal Data by SAP up to the point in time of your withdrawal.” | Captured 2026-08-12Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ If You wish to terminate your account, you may do so by submitting your request via email to webmaster@sap.com . Please note that in the event that you elect to terminate your account, SAP has the right and may elect to continue to post and publish on the Websites personally identifying information associated with User Content that You have posted. ” | Captured 2026-08-12Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ SAP may retain your personal data for additional periods if necessary for compliance with legal obligations to process your personal data or if the personal data is needed by SAP to assert or defend itself against legal claims. SAP will retain your personal data until the end of the relevant retention period or until the claims in question have been settled. SAP stores your personal data only for as long as it is required: ” | Captured 2026-08-12Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ to develop products or services until this is no longer necessary or SAP is informed that your relationship with the SAP customer has changed;” | Captured 2026-08-12Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ SAP no longer requires your Personal Data , but you state you require SAP to retain such data to claim or exercise legal rights or to defend against third party claims, or” | Captured 2026-08-12Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Your Personal Data may be stored and processed by the SAP Group in countries outside your jurisdiction for general business purposes. This will occur only when necessary or appropriate to achieve the purposes set out in this Privacy Statement.” | Captured 2026-08-12Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ third parties you directed to share your personal data with SAP,” | Captured 2026-08-12Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ As part of its global operations, SAP may transfer your Personal Data to its affiliates and trusted third-party service providers located outside Malaysia. In conducting our international business operations, we may transfer your Personal Data to countries outside of Malaysia for the purposes described in this Privacy Statement. We conduct the international transfers in accordance with the local privacy laws and implement appropriate safeguards to ensure your Personal Data receives an adequate level of protection consistent with Malaysia’s PDPA. .” | Captured 2026-08-12Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ As part of a global group of companies operating internationally, SAP has affiliates (the SAP Group) and third-party service providers outside of the Indian region and will transfer your Personal Data to countries outside the India region, subject to any restrictions as may be notified by the Central Government in this regard. ” | Captured 2026-08-12Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ SAP generally aims to collect personal data directly from the data subjects. If you are requested to provide personal data to SAP and you fail to provide such personal data, kindly note that SAP may not be able to provide you with the respective service and/or business relationship requested. If you or applicable law allows SAP to do so, SAP may obtain personal data also from third party sources. These third-party sources may include: ” | Captured 2026-08-12Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ SAP partners: With your consent or as otherwise indicated by your request, including to fulfill your ordered services, SAP may share your personal data with designated partner companies to provide you with the product or service you have requested.” | Captured 2026-08-12Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ AI Functionality may include technologies licensed from third parties. You agree to comply with any additional terms provided by SAP or the third-party licensors.” | Captured 2026-08-12Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Your personal data may be processed globally. If personal data is processed across provincial/territorial or international borders, SAP complies with laws of the transfer of personal data between countries to keep your personal data protected. It may, however, based on the laws of such countries be subject to access by local law enforcement. ” | Captured 2026-08-12Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ SAP Group: Members of the SAP Group may also receive or gain access to personal data either when rendering group internal services centrally and on behalf of SAP SE, when supporting others in the SAP Group or when personal data is transferred to them on a respective legal basis. In these cases, these members may process the personal data for the same purposes and under the same conditions as outlined in this privacy statement. If you would like to find out which SAP Group member is responsible for the business relationship with you or your employer, please contact us at webmaster[@]sap.com.” | Captured 2026-08-12Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ As a global group of companies, SAP has group affiliates and uses third-party service providers also in countries outside the European Economic Area (the “EEA”). SAP may transfer your personal data to countries outside the EEA as part of SAP’s international business operations. If we transfer personal data from a country in the EU or the EEA to a country outside the EEA and for which the EU Commission has not issued an adequacy decision, SAP uses the EU standard contractual clauses to contractually require the data importer to ensure a level of data protection consistent with the one in the EEA to protect your personal data. You may obtain a copy (redacted to remove commercial or irrelevant information) of such standard contractual clauses by sending a request to privacy[@]sap.com. You may also obtain more information and their perspectives on international data protection issues on the European Commission’s International Dimension of Data Protection webpage. ” | Captured 2026-08-12Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Third-party service providers: SAP may engage third-party service providers to process personal data on SAP’s behalf, e.g., for consulting or other services, the provision of the website, the fulfillment and provisioning of offers from SAP or newsletter dispatch. These service providers may receive or are granted with access to personal data when rendering their services and will constitute recipients within the meaning of the relevant data protection law, including GDPR.” | Captured 2026-08-12Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Your personal data may be processed globally. When personal data is processed across country borders, SAP complies with laws on the transfer of personal data between countries to keep your personal data protected. Your personal data may be transferred to, accessed or processed by the categories of third parties as described above. ” | Captured 2026-08-12Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ You explicitly agree that such information is provided to the respective Partner for the purposes of delivery/distribution and licensing of such partner products. ” | Captured 2026-08-12Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Your Personal Data will be held and stored by SAP or the SAP Group which may be located in another country outside of Saudi Arabia for our general business purposes including outsourcing and data processing.” | Captured 2026-08-12Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Cache, store or redistribute SAP Websites, SAP Materials and/or User Content or make them available to any third party, including any data broker or AI provider.” | Captured 2026-08-12Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ You are solely responsible with regard to usage and security of Your password and any activities that occur under Your account. You shall not use the account of anyone else at any time. You understand and agree that SAP collects, uses, stores and otherwise processes Your personal information and utilization data and may share such data with third party service providers for the purposes of improving or providing the SAP Websites subject to SAP’s Privacy Statement. ” | Captured 2026-08-12Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ As part of its global operations, SAP may transfer your Personal Data to its affiliates and trusted third-party service providers located outside Thailand. In conducting our international business operations, we may transfer your Personal Data to countries outside of Thailand for the purposes described in this Privacy Statement. We conduct the international transfers in accordance with the local privacy laws and implement appropriate safeguards to ensure your Personal Data receives an adequate level of protection consistent with Thailand’s PDPA.” | Captured 2026-08-12Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ When we collect personal data from third-party sources, we establish internal controls to ensure that the third-party source was permitted to provide this information to SAP and that we may use it for this purpose. SAP will treat this personal data according to this privacy statement, plus any additional restrictions imposed by the third party that provided the personal data to SAP or by applicable national law. ” | Captured 2026-08-12Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ transfer it to recipients like other members of the SAP Group, third-party service providers, SAP partners and others.” | Captured 2026-08-12Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ If you want to learn more about the details of an international data transfer made by SAP, please visit International Data Transfers under the Brazilian Data Protection Law (“LGPD”). ” | Captured 2026-08-12Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Other third-parties: SAP may transfer your registration data based on your consent or as otherwise indicated by your request to companies listed on the registration page of an SAP seminar, webinar or event. These companies may receive your personal data as co-organizer or sponsor of the event and will use your registration data for the purposes of their participation in the event. They will provide you directly with any legally required information about their processing purposes and how you may exercise your rights.” | Captured 2026-08-12Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ Purchasing or licensing of any SAP Software offered on the SAP Store is NOT available for consumers, but solely for merchants/corporations and might require an existing SAP system. ” | Captured 2026-08-12Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.