Privacy policy

1. Who We Are

Nordlys Consultancy Ltd, trading as (t/a) Supplierly, operates as a data controller registered in England and Wales (company number 16433338) with registered address at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.

Contact: dpo@supplierly.com

Website: https://supplierly.com

2. Who This Policy Applies To

This Privacy Policy governs data collection and processing for all individuals interacting with Supplierly through our website, platform, applications, email, and other channels. It applies to all users of our platform, including suppliers, customers, and their employees, as well as visitors to our website.

3. Compliance with Applicable Law

Our systems and processes adhere to:

• UK General Data Protection Regulation (UK GDPR)
• Data Protection Act 2018

We maintain registration with the Information Commissioner’s Office (ICO) as a Data Controller (registration reference: ZB946623).

4. What Data We Collect

We collect the following categories of personal data:

• Identity data: Name, job title, company name
• Contact data: Email address, phone number
• Technical data: IP address, browser type, device information, login history
• Usage data: Actions taken on the platform, pages visited, features used
• Profile data: Account preferences, role within your organisation
• Business data: Product information, pricing data, supplier/customer relationships
• Marketing data: Communication preferences and opt-in status

5. Cookies

Supplierly uses cookies - small text files placed on your device - to enhance your experience, improve functionality, and gather insights for service improvement. For full details on the cookies we use and how to manage your preferences, please see our Cookie Policy.

6. How We Use Your Personal Data

6.1 Legal Basis

We process your personal data only when we have a lawful basis to do so. The table below sets out the purposes for which we process data and the corresponding legal basis.

6.2 Marketing and Content Updates

Users receiving marketing communications must have created an account and opted in. We may provide personalised recommendations regarding relevant services or features.

6.3 Change of Purpose

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason that is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you and explain the legal basis for doing so. We may process your personal data without your knowledge or consent where this is required or permitted by law.

6.4 Website Analytics

We use a self-hosted, privacy-friendly analytics tool to understand how our website is used, such as which pages are viewed and where visitors arrive from, so we can improve it. It runs on our own infrastructure and the data is not shared with any third-parties. It is not used to track you across other websites.

These analytics are cookieless. They set no cookies, store no information on your device and do not collect personally identifiable information. If your browser sends a “Do Not Track” request, we won't collect analytics from your visit.

7. Data Sharing

We may share your data with:

• Connected organisations: Suppliers and customers you are connected with on the platform (limited to the data necessary for the platform’s functionality)
• Service providers (sub-processors): Trusted third parties that process data on our behalf, and only on our instructions, to help us operate and secure the platform. The providers we rely on are listed in the table below.
• Legal authorities: When required by law or to protect our rights

We do not sell your personal data to third parties.

8. How We Protect Your Data

We implement appropriate technical and organisational security measures to protect your personal data, including encryption at rest and in transit, access controls, and regular security assessments.

Access to your data is restricted to a limited number of employees and contractors who have a legitimate need to access it and who are bound by confidentiality obligations. Subcontractors handling data on our behalf remain under our control and are subject to equivalent security standards.

However, no method of transmission over the internet is completely secure. You transmit data at your own risk and should report any security concerns to dpo@supplierly.com.

9. Opting Out of Marketing Communications

You may opt out of marketing communications at any time by clicking the "unsubscribe" link in any marketing email, or by contacting us at dpo@supplierly.com. Opting out of marketing will not affect the processing of your personal data for non-marketing purposes.

10. Your Rights

Under UK GDPR and the Data Protection Act 2018, you have the following rights:

• Right of access: Request a copy of your personal data
• Right to rectification: Correct inaccurate personal data
• Right to erasure: Request deletion of your personal data
• Right to restriction: Limit how we use your data
• Right to data portability: Receive your data in a portable format
• Right to object: Object to processing based on legitimate interests
• Right to withdraw consent: Where processing is based on consent

No fee is normally required to access your personal data or to exercise any of your other rights. However, we may refuse clearly unfounded or excessive requests. We may request specific information from you to confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights).

To exercise these rights, please contact us at dpo@supplierly.com.

11. How Long We Retain Your Data

We retain your personal data only for as long as reasonably necessary for the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements. To determine the appropriate retention period, we consider the amount, nature, and sensitivity of the data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process it, and applicable legal requirements.

We may retain data for longer where a complaint has been raised or where we reasonably believe litigation is probable.

12. International Transfer of Data

Your data may be stored and processed in countries outside the United Kingdom. Where we transfer data internationally, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses, adequacy decisions, or other mechanisms recognised under UK data protection law, to ensure your data receives an equivalent level of protection.

13. Children’s Data

Our platform is a business-to-business service and is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe that we have inadvertently collected personal data from a child, please contact us at dpo@supplierly.com and we will take steps to delete the data promptly.

14. Complaints

If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO): https://ico.org.uk/make-a-complaint/