Privacy Policy

1. Accountability and current services

North American GPO (NAGPO), including its ProcureVerified program, is responsible for personal information under its control. Write to the Privacy Contact at buyers@nagpo.org or 138 Anderson Ave, Markham, ON L6E 1A5, Canada. An authorized individual will handle requests; an operational privacy owner and internal procedures must be assigned before adoption.

The current public demo form collects contact details and notes. Private spend intake, supplier assessment uploads, accounts, signatures, AI analysis and payment functions require separate operational setup. Descriptions below apply when the relevant function is offered; they do not mean all functions are already live.

2. What we collect and why

For inquiries we collect name, company, email, selected topic, notes, submission timestamp and the acknowledgment provided. The form uses a session cookie and short-lived session/security information. Abuse controls use hashed IP-derived rate-limit records and security signals; hashed identifiers may still be personal information. Hosting and email systems may maintain technical logs. Avoid confidential documents, government identifiers, bank details or passwords in the inquiry form.

When enabled, membership and qualification services collect business identity, representative authority/contact, plan/order information, appropriate credentials and evidence, assessment decisions and approved public profile material. Procurement services may collect supplier lists, spend data, contracts, requirements, proposals and approvals. Documents can identify employees, sole proprietors or other individuals; a business label does not remove privacy duties. Collect only what is relevant, proportionate and lawfully submitted. Do not demand a W-9, personal tax identifier or bank account merely to purchase membership.

Use is limited to responding to inquiries, performing accepted services, administering authorized billing, assessing credentials, protecting systems, resolving disputes and legal compliance. Service communications are separate from optional marketing. Retain evidence of the purpose and permissions for sensitive submissions.

3. Sharing, providers and processing locations

The public website and inquiry mail are hosted/handled through HostGator services. When enabled, Cloudflare Turnstile processes security signals under its applicable terms to check automated submissions. NAGPO does not use the demo form to subscribe a visitor to marketing or automatically send messages to an unverified visitor address.

Additional payment, storage, authentication, signature and AI providers must be reviewed, identified with their roles and processing countries, and covered by appropriate agreements before their functions collect data. Stripe is the intended payment processor but must not be represented as active until configured. NAGPO’s application must not collect/store full payment-card details or security codes. There is no promise that all processing remains in Canada; overseas providers and lawful foreign government access may apply. Provide relevant additional notices and permissions before material new uses or transfers.

Approved supplier profiles and the defined scope/status/dates of actual verification may be public. Underlying tax, banking, identity and financial evidence is not public. A buyer approves each bidder and document release set separately from signing an MNDA. Supplier proposals are restricted to authorized evaluators; competitors do not receive each other’s proposals by default. Aggregate demand sharing needs appropriate authorization and must avoid exposing another buyer’s commercially sensitive information. Recipients may have independent privacy duties rather than being NAGPO’s processors.

NAGPO may disclose information where legally required or for proportionate fraud/security/legal-claim handling. Do not sell entrusted personal information or use sensitive source documents for unrelated advertising or general AI training. Any future materially different use needs prior assessment, notice and a lawful basis.

4. AI-assisted services and human review

Before offering AI document processing, disclose the providers, data uses, locations and relevant retention settings. Use a provider arrangement suitable for confidential business data; do not assume API data has zero retention or is excluded from every provider use without checking actual terms/settings. Submit only authorized data and minimize personal information.

AI may propose column mappings, categories, extracted terms or drafts. Outputs may be incomplete or wrong. Keep source references, perform deterministic financial calculations, and require human confirmation of material facts, releases, assessment decisions and awards. An AI result does not authorize disclosure, payment or supplier selection. Private files must be access-controlled before retrieval; a shared model workflow is not permission to search all buyers’ data.

5. Safeguards, retention and requests

The live inquiry function uses HTTPS, server validation, CSRF/session checks, restricted private limiter files and optional server-verified Turnstile. Inquiry content is sent to the designated mailbox and is subject to mailbox access/retention controls. Never imply that this form is a private client-document vault. Private service functions require tested access roles, private storage, encryption, backups, incident response and vendor controls before launch. No system guarantees perfect security.

Keep information only as necessary for the stated purpose, active service, reasonable dispute defence and applicable legal/tax obligations; delete or de-identify when no longer needed, subject to legal holds and defined backup cycles. Inquiry/security/provider-specific retention periods must be documented internally and disclosed further where required; this draft does not invent a deletion capability that has not been implemented.

Contact the Privacy Contact for access, correction, applicable deletion/withdrawal, provider information or a complaint. Identity checks will be proportionate. Respond within applicable legal periods, explain lawful exceptions and escalation options, and cooperate with relevant privacy authorities. Withdrawal may affect a requested service; required records may still be retained. Investigate incidents and make legally required notices to affected people/regulators; contractual DPA deadlines do not replace statutory duties.

6. Cookies, marketing and updates

The demo form uses a necessary session cookie; Turnstile may use mechanisms described by Cloudflare. Identify any analytics/non-essential cookies and implement required choices before activating them. Do not assume this draft authorizes undisclosed tracking.

Optional marketing requires a separately recorded lawful basis and, when consent is used, an unchecked optional opt-in. Identify the sender and provide a working unsubscribe method. Canadian CASL unsubscribe requests generally must be implemented within ten business days; statutory identification, validity and consent rules also apply. Business-to-business exemptions or implied consent are fact-specific, not universal permission to email business addresses.

Publish a new version for material changes and obtain new consent where required. People may contact the Office of the Privacy Commissioner of Canada or another applicable authority. Jurisdiction-specific rights must be assessed before actively expanding into additional markets.