ProcWisely (“ProcWisely,” “we,” “us,” or “our”) provides a procurement and spend management platform (the “Service”). This Privacy Policy explains what personal information we collect, how we use and share it, and the choices and rights you have. By using the Service, you agree to the practices described below.
1. Scope
This Policy applies to information we collect when you visit our marketing site, create or use a ProcWisely account, communicate with us, or otherwise interact with the Service. It does not apply to data our customers submit to the Service about their employees, vendors, or business operations — that data is handled under our customer agreements, where the customer is the controller and ProcWisely acts as a processor.
2. Information We Collect
2.1 Information you provide
- Account information: name, business email, password (hashed), employer name, role, and phone number.
- Billing information: billing address and tax identifiers. Payment card data is collected and stored by our payment processor and never touches our servers.
- Communications: messages you send to support, sales, or any other ProcWisely contact, and any survey or feedback responses you provide.
- Customer-uploaded data: purchase requests, vendor records, invoices, receipts, attachments, and any other content you load into your tenant.
2.2 Information collected automatically
- Usage data: pages viewed, features used, click and scroll events, time spent, and referrer.
- Device and connection data: IP address, browser type and version, operating system, device identifiers, language preference, and time zone.
- Cookies and similar technologies: see the Cookies section below.
- Logs: server logs that record requests to the Service, including timestamps, request paths, response codes, and limited diagnostic data.
2.3 Information from third parties
- Authentication providers: if you sign in via SSO or a federated identity provider, we receive the profile attributes you authorize that provider to share.
- Integrations: when you connect ProcWisely to an accounting, ERP, or messaging system, we receive the data you authorize that integration to expose.
- Analytics and marketing partners: we may receive aggregated traffic and campaign performance data.
3. How We Use Information
We use the information described above to:
- provide, operate, secure, and improve the Service;
- authenticate you, maintain your session, and enforce role-based access;
- process transactions and bill our customers;
- respond to support requests and other inquiries;
- send service announcements, security notifications, and (where permitted) marketing communications you can unsubscribe from;
- detect, prevent, and respond to fraud, abuse, security incidents, and violations of our Terms; and
- comply with legal obligations and enforce our agreements.
Where required by law, we rely on the following legal bases for processing: performance of a contract with you or your employer, our legitimate interests (including operating and improving the Service), your consent (which you may withdraw at any time), and compliance with legal obligations.
4. How We Share Information
We share information only as described here:
- Within your organization: data you submit is visible to other authorized users in your tenant according to the roles and permissions your administrator configures.
- Service providers: we use vetted vendors to host infrastructure, deliver email, process payments, run analytics, and provide support tooling. These providers process data on our behalf under contractual confidentiality and security obligations.
- Integration partners: when you connect a third-party system, we share data with that system as you direct.
- Corporate transactions: if ProcWisely is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to standard confidentiality protections.
- Legal and safety: we may disclose information when we believe in good faith that disclosure is necessary to comply with a legal obligation, respond to a valid government request, protect our rights or property, or protect the safety of our users or the public.
- With your consent: for any other purpose disclosed to you at the time of collection.
We do not sell personal information, and we do not share it for cross-context behavioral advertising.
5. Cookies and Similar Technologies
We use cookies and similar technologies to keep you signed in, remember preferences, measure how the Service is used, and secure your session. We use a small number of categories:
- Strictly necessary: required for authentication, session security, and core functionality. These cannot be turned off.
- Functional: remember preferences such as language and display settings.
- Analytics: help us understand aggregate usage and improve the Service.
You can control cookies through your browser settings. Disabling strictly necessary cookies will prevent the Service from working correctly.
6. Data Retention
We retain personal information for as long as your account is active and as needed to provide the Service. We also retain information as required to comply with our legal, tax, accounting, and audit obligations, resolve disputes, and enforce our agreements. When information is no longer needed, we delete it or de-identify it. Customers can request export and deletion of tenant data per their customer agreement.
7. Security
We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, alteration, disclosure, and destruction. These include encryption in transit (TLS 1.2 or higher) and at rest (AES-256), least-privilege access controls, single sign-on, audit logging, regular vulnerability scanning, and periodic third-party penetration testing. No system is perfectly secure; if we ever experience a breach affecting your data, we will notify affected customers in accordance with applicable law.
8. International Data Transfers
ProcWisely is operated from the United States and processes data in the United States and other countries where our service providers operate. If you access the Service from outside the United States, your information may be transferred to, stored in, and processed in jurisdictions whose data protection laws differ from those in your country. Where required, we rely on Standard Contractual Clauses or other lawful transfer mechanisms.
9. Your Rights
9.1 General rights
- Access the personal information we hold about you.
- Request correction of information that is inaccurate or incomplete.
- Request deletion of your personal information, subject to legal retention obligations.
- Object to or restrict certain processing.
- Withdraw consent where we rely on it, without affecting the lawfulness of prior processing.
- Lodge a complaint with a data protection authority.
9.2 Residents of the EEA, UK, and Switzerland
If you are located in the EEA, the United Kingdom, or Switzerland, the GDPR (or its UK equivalent) applies. You have the rights described in 9.1. For data we process on behalf of a customer, please direct your request to that customer; we will support them in responding.
9.3 California residents
The California Consumer Privacy Act (CCPA), as amended by the CPRA, gives California residents the rights to know, delete, correct, and limit the use of sensitive personal information, plus the right to non-discrimination for exercising these rights. We do not sell personal information and we do not share it for cross-context behavioral advertising.
9.4 How to exercise your rights
Contact us at contact@procwisely.com. We will verify your identity before responding and will respond within the timelines required by applicable law.
10. Children’s Privacy
The Service is intended for business use by adults. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, contact us and we will delete it.
11. Third-Party Sites and Services
The Service may link to third-party sites and services that operate under their own privacy policies. We are not responsible for the practices of those third parties. We encourage you to review their policies before sharing information with them.
12. Changes to this Policy
We may update this Policy from time to time. If we make material changes, we will notify you by email or through the Service before the changes take effect. The “Last updated” date at the top reflects the latest revision.