Wan (Alibaba) procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | low | “ • EU-U.S. Data Privacy Framework with UK Extension and Swiss-U.S. Data Privacy Framework ” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ This section of the Privacy Policy applies only if you are located in the EEA or the UK or Europe (but outside the EEA) and supplements the information in this Privacy Policy. Alibaba Cloud is the controller of personal data only when it collects personal data and determines the purposes and means of processing that personal data. For example, when customers of our Cloud Services register an account with us or provide contact information in order to receive customer support, we are the controller of that data. When customers host their own services on our Cloud Services, we act as a data processor with respect to that data. Our business may require us to transfer your personal data to countries outside of the EEA or the UK, including to countries that may not provide the same level of data protection as your home country, such as the United States, Singapore and China. We strive to take appropriate steps to ensure that an adequate level of protection is provided for your personal data. Per GDPRArt.46, we implement measures such as entering into written agreements including standard contractual clauses and other data protection agreements with recipients. A copy of those clauses can be obtained by contacting us at intlcompliance@service.aliyun.com . You may lodge a complaint with a supervisory authority if you consider that our processing of your personal data infringes applicable law.” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | medium | “ A s part of providing you with the Cloud Services, we may need to transfer your personal data from your jurisdiction to an overseas jurisdiction. Recipients of the data in these jurisdictions may be subject to data privacy laws less protective or not equivalent to those in your own jurisdiction. Such overseas transfer or processing of your personal data may be necessary to process and administer your customer account and to provide the Cloud Services (including providing customer services to you, contacting you regarding promotions, products and services, performing risk control, fraud prevention and legal compliance procedures, and conducting payment processing services). If you are located in the EEA or the UK, please refer to the EEA and UK Addendum at the end of this Policy for our commitment with regard to transferring your data to another jurisdiction.” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ • European Economic Area (EEA) ” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ c/o Herengracht 448, 1017 CA Amsterdam, the Netherlands E-mail address: DPO_Intl@alibabacloud.com For individuals in the EEA, Alibaba (Netherlands) B.V. is the relevant "data controller"for the purposes of EEA data protection law..” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ Alibaba Cloud US LLC and Alibaba Cloud LLC remain responsible and liable under the EU-U.S. DPF Principles, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF Principles for transferring personal data received under DPF Principles to a third party who processes the personal data on our behalf in a manner inconsistent with the Framework’s applicable Principles, unless Alibaba Cloud US LLC or Alibaba Cloud LLC prove not responsible for the event giving rise to the damage. Alibaba Cloud US LLC and Alibaba Cloud LLC comply with the DPF Principles for all onward transfers of personal data from the EU, the United Kingdom and Switzerland, including the onward transfer liability provisions. With respect to personal data received or transferred pursuant to the DPF Frameworks, Alibaba Cloud US LLC and Alibaba Cloud LLC are subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission (FTC). In certain situations, we may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements. In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, Alibaba Cloud US LLC and Alibaba Cloud LLC commit to resolve DPF Principles-related complaints about our collection and use of your personal information. EU, UK, and Swiss individuals with inquiries or complaints regarding our handling of personal data received in reliance on the EU-U.S. ” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ This is an addendum to the Alibaba Cloud International Website Privacy Policy (the “Privacy Policy”) in relation to South Korean data subjects (this “Korea Addendum”) and should be read in conjunction with the Privacy Policy.” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF should first contact Alibaba Cloud US LLC and Alibaba Cloud LLC at: intlcompliance@service.aliyun.com . Alibaba Cloud US LLC and Alibaba Cloud LLC commit to refer unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF to TRUSTe, an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit https://feedback-form.truste.com/watchdog/request for more information or to file a complaint. These dispute resolution services are provided at no cost to you. For complaints regarding DPF compliance not resolved by any of the other DPF mechanisms, you have the possibility, under certain conditions, to invoke binding arbitration. Further information can be found on the official DPF website: https://www.dataprivacyframework.gov/framework-article/ANNEX-I-introduction . ” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ • United Kingdom and Europe (outside the EEA) ” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | medium | “ Your personal data will be stored in Singapore. Your personal data may however be transferred to or accessed by our officers, employees, support staff, agents, Third Party Service Providers (and their sub-processors, if any), and affiliate companies in the Alibaba Group (and their designated Service Providers and the latter’s sub-processors, if any), which may be located in several other jurisdictions.” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ For individuals in the EEA, and/or in relation to processing conducted by or on behalf of Alibaba (Netherlands) B.V., please contact:” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ Address: 7-16th floor, Donghoon Tower, 317 Teheran-ro, Gangnam-gu, Seoul, South Korea” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | medium | “ We store the collected Personal Data in Singapore, for the purposes described in this Privacy Policy and until such purpose is achieved. The data is transmitted through information network, as needed. We may also transfer Personal Data overseas to affiliates of Alibaba Cloud when necessary and through information network including API transfer. We may also share Personal Data with the following third-party service provider(s) outside of South Korea as described below:” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ D. TRANSFER OF PERSONAL DATA ” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ Alibaba Cloud US LLC and Alibaba Cloud LLC comply with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. Alibaba Cloud US LLC and Alibaba Cloud LLC have certified to the U.S. Department of Commerce that we adhere to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) under the UK Extension to the EU-U.S. DPF. Alibaba Cloud US LLC and Alibaba Cloud LLC have certified to the U.S. Department of Commerce that we adhere to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. We are committed to subjecting all personal data received from European Union (EU) member countries, the United Kingdom and Switzerland, respectively, in reliance on each Data Privacy Framework, to the Framework’s applicable Principles. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/ . ” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ c/o Alibaba.com (Europe) Limited, 8th floor, Millbank Tower, 21-24 Millbank, London SW1P 4QP, United Kingdom E-mail address: DPO_Intl@alibabacloud.com For individuals in the UK or Europe (but outside the EEA), Alibaba.com (Europe) Limited is the relevant "data controller".” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | medium | “ You have the right to refuse the overseas transfer of personal information as set forth above. If you wish to refuse the overseas transfer of your personal information, please contact [intlcompliance@service.aliyun.com] to communicate your request. However, if you refuse, you may not be able to use our cloud services.” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ F. PERIOD OF RETENTION AND PROCESSING OF PERSONAL DATA ” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ G. PROCESS AND METHOD OF DESTRUCTION OF PERSONAL DATA ” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ We retain your personal data for the purposes described in this Privacy Policy where we have an ongoing legitimate business need to do so (for example, to provide you with a service you have requested or to comply with applicable legal, tax or accounting requirements). In certain circumstances, we will need to keep your personal data for legal reasons after our relationship has ended. The specific retention periods depend on the nature of the personal data and why it is collected and processed, and the nature of the legal requirement. When we have no ongoing legitimate business need or legal reason to process your personal data, we will either delete or anonymize it or, if this is not possible, then we will securely store your personal data and isolate it from any further processing until deletion is possible.” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ Alibaba Cloud will delete your personal data as described in Section F of this Privacy Policy. When deleting personal data, we will take standard commercially reasonable measures to make the personal data practically irrecoverable or irreproducible. The specific manner of deletion will depend on the data being deleted, how the data was collected and stored, and your interactions with us. Electronic documents or files containing personal data will be deleted using a technical method that makes recovery or retrieval of such information practically impossible or renders the data no longer personally identifiable. Non-electronic documents or files containing personal data will be shredded, incinerated, or both. ” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ 2. The International Marketplace enables you to purchase or subscribe to products and services (“ Marketplace Products ”) from companies other than Alibaba Cloud (“ Third Party Vendors ”), and should you purchase or subscribe to Marketplace Products offered by a Third Party Vendor, we may provide such Third Party Vendor with your personal data for the purposes of processing your purchase and/or subscriptions on the International Marketplace. Other than such personal data disclosed by Alibaba Cloud to the Third Party Vendor, in some cases you may be required to submit personal data to Third Party Vendors to use such Marketplace Products. This Privacy Policy does not apply to such collection, use or disclosure of personal data by Third Party Vendors. The privacy policies of Third Party Vendors may differ from ours, and we have no control over the information that you submit to those Third Party Vendors. You should read the relevant privacy policies for those Third Party Vendors before providing your information to such Third Party Vendors.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ 4. We may provide aggregated or anonymized data to third parties, but when we do so, the information we share is in a de-identified format that does not personally identify you.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We delegate the processing of personal data to delegates including affiliates of Alibaba Cloud, and third parties as described below, which may process personal data according to the purpose of the delegation:” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ 7. to comply with applicable law, legal process or lawful government request, or in respect of any claims or potential claims brought against us or our parent companies, shareholders, subsidiaries and affiliates;” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ 3. We may share your personal data with affiliated companies in the Alibaba Group and/or their designated Service Providers, for the purposes specified at Section B above. We have appropriate agreements with our affiliated companies in the Alibaba Group for the sharing of your personal data and/or outsourcing of the processing of your personal data to affiliated companies. The designated Service Providers (and their sub-processors, if any) of our affiliates in the Alibaba Group will be engaged under terms compliant with applicable laws and under appropriate duties of confidentiality and will only be permitted to use your personal data in connection with the purposes specified in Section B of the Privacy Policy.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ 1. We may disclose your personal data to third party service providers engaged by us to assist with providing you with our services (including partners providing customer services to you, contacting you regarding promotions products and services, performing risk control, fraud prevention and legal compliance procedures, and conducting payment processing services) (the “Third Party Service Providers”). These Third Party Service Providers may be located in Singapore or outside of Singapore, and are engaged under terms compliant with applicable data protection laws and/or appropriate duties of confidentiality to us and are only permitted to use your personal data in connection with the purposes specified in Section B above, and not for their own purposes. These Third-Party Service Providers may further contract some components of the services they provide to us to other service providers. These other service providers may also be located in Singapore or outside of Singapore, and are under a duty of confidentiality to our Third Party Service Providers and are only permitted to use your personal data in connection with the purposes specified in Section B above, and not for their own purposes.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “Your organisation’s use of our Cloud Services may be subject to your organisation’s own rules or policies, and you shall direct all privacy enquiries relating to such rules or policies to your organisation’s administrators. We are not responsible for the privacy or security practices of your organisation. Cloud Services may be used by our customers (i.e. registered users of Alibaba Cloud) to develop or host their own services and products for the customer’s end users. Any information collected or handled by Alibaba Cloud in such circumstances is processed on behalf of our customer who controls the collection and use of such information. We do not have a direct relationship with the end users of our customers. Where this is the case, end users should direct all privacy enquiries, such as any requests to access, correct, amend or delete personal data, to the Alibaba Cloud customer providing their services or products. We are not responsible for the privacy or security practices of our customers.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We may provide personal data as described in the Privacy Policy, including to affiliates of Alibaba Cloud, and to third parties as described below:” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ 5. We have established and will establish relationships with other parties and websites to offer you the benefit of their products and services. We offer you access to these other parties and their websites either through the use of hyperlinks to these sites from our Alibaba Cloud Platform or through offering “co-branded” sites in which both we and other parties share the same uniform resource locator, domain name or pages within a domain name on the Internet. In some cases you may be required to submit personal data to register or apply for products or services provided by such third parties or co-branded partners. This Privacy Policy does not apply to these third party sites or co-branded sites. The privacy policies of those other parties may differ from ours, and we have no control over the information that you submit to those third parties. You should read the relevant privacy policy for those third party sites and co-branded sites before responding to any offers, products or services advertised by those parties.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ 4. processing your purchases and/or subscriptions on the International Marketplace;” | Captured 2026-06-08Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.