Supplier Privacy Notice

Isara Systems Ltd

1. About this notice

This notice explains how Isara Systems Ltd (“Isara”, “we”, “us”) handles personal data about our suppliers, vendors, contractors, consultants, partners and prospective suppliers — and about the individuals who work for them.

It applies to you if you are:

• a sole trader, freelancer or individual contractor supplying goods or services to Isara; or
• an individual who works for a supplier organisation — for example a named contact, account manager, delivery lead, signatory or engineer whose details we hold in order to manage the relationship.

Isara Systems Ltd is the controller of this personal data.

Controller	Isara Systems Ltd
Registered address	5–23 Old Street, London EC1V 9HL, United Kingdom
ICO registration number	ZC219161
Data Protection Officer	dpo@isara.ai — Attn: Data Protection Office, 5–23 Old Street, London EC1V 9HL
General contact	support@isara.ai

This notice sits alongside our main Privacy Policy. Where the two differ on supplier data, this notice applies.

We process supplier personal data under the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025. Where you are located in the EU or EEA, we also process your personal data under Regulation (EU) 2016/679 (EU GDPR), and the rights and complaint routes in sections 8 and 9 apply accordingly.

2. Where your information comes from

We obtain supplier personal data:

• directly from you — from your quotations, proposals, correspondence, invoices, contract documents, onboarding forms and security questionnaire responses;
• from the supplier organisation you work for — where it gives us your name, role and contact details so that we can work with you. This is the most common source where you are a contact person rather than the contracting party;
• from publicly available sources — such as the supplier’s website, Companies House or an equivalent public register, and public professional profiles, where we are carrying out due diligence on a prospective supplier.

Where we obtain your details from your employer or from a public source rather than from you, this notice is the information we are required to give you under Article 14 UK/EU GDPR.

3. What personal data we process

Category	Examples
Identity and contact data	Name, job title, role, business email address, business telephone number, business address
Relationship data	Correspondence, meeting notes, records of calls, service and support history
Contract data	Your name and signature where you sign or are named in a contract, statement of work, order or non-disclosure agreement; the terms agreed
Commercial data	Quotations, proposals, rates, purchase orders, invoices, timesheets, expenses
Payment data	Bank account details, payment references, payment history — where you are a sole trader, or where you are named on a supplier’s payment details
Tax and status data	VAT registration number, tax identification number, and where you are a sole trader or personal service company, information needed to determine your employment status for tax purposes
Due diligence data	Information you or your organisation provide in response to our security, privacy and compliance questionnaires; certifications; insurance evidence
Access data	Where you are given access to an Isara system or facility: account identifiers, access logs, and records of what you accessed

Special category data. We do not seek special category data (Article 9 UK/EU GDPR) from suppliers or their personnel, and we ask you not to send it to us. If you disclose it — for example an accessibility requirement for a site visit — we will process it only so far as necessary for that purpose and delete it once that purpose is met.

4. Why we process your data, and our legal basis

Purpose	Legal basis
Assessing a prospective supplier, evaluating proposals, negotiating terms	Legitimate interests — Art. 6(1)(f) UK/EU GDPR. Our interest is in selecting suppliers capable of meeting our requirements. Where you are a sole trader and the negotiation is with you directly, Art. 6(1)(b) (steps prior to entering a contract) applies.
Entering into and performing the contract, receiving the goods or services, managing delivery and escalations	Performance of a contract — Art. 6(1)(b), where you are the contracting party. Where you are a contact person employed by a supplier organisation, legitimate interests — Art. 6(1)(f); our interest is in administering a contract with your employer, and processing your business contact details is the minimum necessary to do so.
Paying invoices, managing purchase orders, financial administration and reconciliation	Performance of a contract — Art. 6(1)(b) where you are the supplier; otherwise legitimate interests — Art. 6(1)(f).
Keeping accounting and tax records, and complying with tax and company law	Legal obligation — Art. 6(1)(c). Companies Act 2006 ss.386 and 388; Finance Act 1998, Schedule 18, paragraph 21; Value Added Tax Regulations 1995, regulation 31, made under Schedule 11, paragraph 6 of the Value Added Tax Act 1994.
Supplier due diligence and third-party risk management — assessing the security, privacy and resilience of suppliers who handle our data or our customers’ data	Legitimate interests — Art. 6(1)(f). Our interest is in meeting our own security and contractual obligations to our customers, and in managing supply-chain risk.
Controlling and logging access where a supplier’s personnel are given access to Isara systems or data	Legitimate interests — Art. 6(1)(f). Our interest is in securing our systems and maintaining an audit trail.
Managing disputes, exercising contractual remedies, and bringing or defending legal claims	Legitimate interests — Art. 6(1)(f). Where special category data is involved, Art. 9(2)(f).
Corporate transactions — disclosure to a prospective acquirer or investor and their advisers as part of due diligence	Legitimate interests — Art. 6(1)(f). Our interest is in being able to raise investment or transact in the business.
Sending you operational updates about a service you supply to us or we supply to you	Legitimate interests — Art. 6(1)(f). This is relationship administration, not marketing.
Complying with legal and regulatory obligations and responding to lawful requests from authorities	Legal obligation — Art. 6(1)(c).

5. No automated decision-making

We do not take significant decisions about suppliers, or about individuals working for suppliers, based solely on automated processing, within the meaning of Articles 22A–22D UK GDPR — and Article 22 EU GDPR where that applies to you. Supplier selection, approval and offboarding decisions are made by people.

6. Who we share your data with

We share supplier personal data with:

• Our own personnel, on a need-to-know basis — the budget holder, the team receiving the service, and those responsible for finance and security review.
• Our professional advisers — accountants, auditors, lawyers, insurers and consultants, where they need it to advise us or to complete an audit.
• Our banks and payment providers, in order to make payment.
• HM Revenue & Customs and other tax and regulatory authorities, where required.
• Competent public authorities, where we are legally required to disclose.
• Prospective acquirers or investors, and their advisers, in a corporate transaction, subject to confidentiality obligations.
• Service providers who process supplier data on our instructions as processors, under a written contract meeting Article 28 UK/EU GDPR. Today these are our business email and document storage providers. We may also use an accounting or bookkeeping platform, a contract or electronic signature platform, a payment or expense platform, and a supplier due diligence or security questionnaire platform. Where we adopt a new category of provider that processes supplier personal data, we will update this notice before that processing begins.

7. International transfers and retention

International transfers

Isara is established in the United Kingdom. Some of our service providers process personal data outside the UK and the EEA.

Where we transfer supplier personal data outside the UK, we rely on one of the following:

• transfer approval regulations made under Article 45A UK GDPR, where the destination is covered by regulations made following the data protection test in Article 45B;
• the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the European Commission’s Standard Contractual Clauses, as appropriate safeguards under Article 46 UK GDPR;
• the UK Extension to the EU–US Data Privacy Framework, for transfers to certified US recipients.

How long we keep your data

Data	Retention period
Contract documents, statements of work, orders and signed agreements	6 years from the end of the contract — the limitation period for claims on a simple contract under section 5, Limitation Act 1980. Where an agreement is executed as a deed, 12 years (section 8, Limitation Act 1980)
Invoices, payment records, accounting and tax records	6 years from the end of the accounting period to which they relate — Finance Act 1998, Schedule 18, paragraph 21 (corporation tax records) and HMRC’s VAT record-keeping requirements. Companies Act 2006 s.388(4) requires a private company to preserve accounting records for 3 years; we apply the longer tax period to the same records
Supplier contact and relationship records for active suppliers	For the duration of the relationship, and 6 years thereafter alongside the contract record

8. Your rights

Under the UK GDPR and, where applicable to you, the EU GDPR, you have the right to:

• Be informed about how we use your personal data — that is the purpose of this notice.
• Access your personal data and receive a copy of it (Art. 15).
• Rectification of inaccurate personal data, and completion of incomplete data (Art. 16).
• Erasure of your personal data in certain circumstances (Art. 17). This right does not apply where we are required to keep the data by law — for example accounting and tax records.
• Restrict our processing in certain circumstances (Art. 18).
• Data portability — receive data you provided to us in a structured, commonly used, machine-readable format, where the processing is based on consent or contract and carried out by automated means (Art. 20).
• Object to processing based on our legitimate interests (Art. 21). If you object, we will stop unless we can show compelling legitimate grounds that override your interests, or we need the data for legal claims. You have an absolute right to object to direct marketing.
• Withdraw consent at any time where we rely on consent. Withdrawing consent does not affect the lawfulness of processing before withdrawal (Art. 7(3)).

To exercise any of these rights, email dpo@isara.ai.

9. Complaints

You have a statutory right to complain to us if you consider that we have infringed the UK GDPR in relation to your personal data (section 164A, Data Protection Act 2018). You can complain, by emailing dpo@isara.ai, or by writing to the Data Protection Office at the address in section 1. We will acknowledge your complaint within 30 days of receiving it, look into it without undue delay, keep you informed of progress, and tell you the outcome.

Complaining to the regulator. You also have the right to complain to the Information Commissioner under section 165 of the Data Protection Act 2018, at any time. You do not have to complain to us first.

• United Kingdom — Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Helpline 0303 123 1113. www.ico.org.uk/make-a-complaint
• EU / EEA — under Article 77 EU GDPR, the supervisory authority in the country of your habitual residence, your place of work, or the place of the alleged infringement. A list is published at www.edpb.europa.eu

10. Changes to this notice

We review this notice at least annually and whenever we change how we handle supplier personal data. The current version is always available at the URL where you found it, and the version and date are shown at the top. Where a change materially affects an active supplier, we will tell them directly.