Trata procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Subject to the conditions set out in the applicable law, Users in the European Union/European Economic Area, and the United Kingdom (as well as in other jurisdictions where similar rights apply) have the following rights regards our processing of their personal information: Right of access: If you ask us, we will confirm whether we are processing your personal information and, if necessary, provide you with a copy of that personal information (along with certain other details). Right to correction (rectification): If the personal information we hold about you is inaccurate or incomplete, you are entitled to request to have it corrected. If you are entitled to have information corrected and if we have shared your personal information with others, we will let them know about the rectification where possible. Right to erasure: You can ask us to delete your personal information in some circumstances, such as where we no longer need it or if you withdraw your consent (where applicable). If you request that we delete your personal information, we may do so by deleting your account(s) with us. Right to restrict (block) processing: You can ask us to restrict the processing of your personal information in certain circumstances, such as where you contest the accuracy of that personal information, or you object to our use or stated legal basis. Right to data portability: You have the right, in certain circumstances, to receive a copy of personal information we have obtained from you in a structured, commonly used, and machine-readable format, and to reuse it elsewhere or to ask us to transfer this to a third party of your choice. ” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Please note that some of these rights may be limited, such as where we have an overriding interest or legal obligation to continue to process the data. Please contact us using the information set out above, in Section 16. Contact Details, if you wish to exercise any of your rights or if you have any enquiries or complaints regarding the processing of your personal information by us.” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Right to object: Where our processing is based on our legitimate interests, we must stop such processing unless we have compelling legitimate grounds that override your interest or where we need to process it for the establishment, exercise, or defense of legal claims. Where we are relying on our legitimate interests, we believe that we have a compelling interest in such processing, but we will individually review each request and related circumstances. Right to object to marketing: You can ask us to stop processing your personal information to the extent we do so based on our legitimate interests for marketing purposes. If you do so, we will stop such processing for our marketing purposes. Right not to be subject to automated decision-making: You have the right not to be subject to a decision when it is based on automatic processing if it produces a legal effect or similarly significantly affects you unless it is necessary for entering into or performing a contract between us. Trata does not engage in automated decision-making. Right to withdraw your consent: In the event your personal information is processed based on your consent, you have the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. Right to lodge a complaint: You also have the right to lodge a complaint with a supervisory authority if you consider that our processing of your personal information infringes the law. ” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ If you opt in to text (SMS) notifications, we use the phone number you provide to send the notification alerts you enable in your account settings. Message and data rates may apply. Reply STOP to any message or update your account settings to opt out, or reply HELP for more info. No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. Information sharing to subcontractors in support services, such as customer service, is permitted. All other use case categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ If you sign in to the Services using “Sign in with Google” , Google acts as an identity provider and we use Supabase Auth to complete sign-in. This section describes how we access, use, store, and share Google user data for that purpose, as required for applications that use Google OAuth. Data accessed: Through Supabase’s Google OAuth integration, we receive the categories of information Google makes available for sign-in and account linking. This typically includes your Google account subject identifier, email address, name, profile image URL, and email verification status. We use Google solely for authentication and account creation; we do not use this sign-in flow to access your Google Calendar, Gmail, Google Drive files, contacts, or other Google product data. Data usage: We use the Google-provided information to authenticate you, create and maintain your Trata account, associate your session with your identity, secure access to the Services, recover or manage your account where applicable, and communicate with you about your account in line with this Policy. We do not use Google sign-in data for unrelated advertising profiling by third parties. Data sharing: Google processes sign-in according to Google’s terms and privacy policy. Supabase provides authentication infrastructure for us and may process OAuth tokens and profile attributes on our behalf as described in Supabase’s documentation and privacy practices. ” | Captured 2026-09-25Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.