Code of Conduct for Suppliers

Document control

1. Purpose and scope

Procura is a platform where buyers and suppliers run RFQs, sealed bids, awards and purchase orders. This Code sets the standard of conduct that every supplier on Procura accepts. The aim is plain: every bid is an honest offer, every award is a fair decision, and every record is a true one.

The Code of Conduct for Buyers sets the standard for buyers. The two documents work together. A supplier can expect from buyers what the Buyer Code requires, and a buyer can expect from suppliers what this Code requires.

This Code adds to the Terms of Use, the Supplier Agreement, the Acceptable Use Policy and the Data Processing Addendum. It does not replace them, and it does not reduce any duty under the law. The law always applies, and where the law is stricter than this Code, the law applies. Where a signed agreement between a supplier and a buyer, including a purchase order, deals with the same point, that agreement applies between them, but it never lowers the standards in sections 4 to 8 of this Code.

Where the buyer is a government entity, or is bound by the Government Tenders and Procurement Law, that law and the buyer's own rules apply as well. Procura is not the government procurement platform (Etimad) and does not replace it.

2. Who this Code binds

• The supplier organisation, which accepts the Code through an authorised person.
• Every person who uses the supplier's Procura account or acts for the supplier in a Procura transaction: owners, managers, sales and bid staff, administrators, agents and intermediaries.
• Sub-suppliers and subcontractors that the supplier uses to deliver what was ordered through Procura. The supplier must pass the standards of this Code on to them in writing, and it remains responsible for what they do.

The supplier is responsible for its people and for those it engages. "I did not know" and "my agent did it" are not a defence where the supplier could have prevented the conduct.

3. Principles

4. Conflicts of interest and disclosure

4.1 What it is

A conflict of interest exists when a personal, family, financial or business interest of the supplier or its people could affect, or could look as if it affects, a decision in a Procura transaction. For example:

• a relative or close friend of the supplier's owner or staff works for the buyer in procurement, finance, approval or evaluation;
• a person at the buyer has a share in the supplier, or a role in it, paid or unpaid;
• the supplier's owner or a relative holds a share in a competing bidder; or
• the supplier or its people have given a job, a loan or another benefit to a person at the buyer.

4.2 The duty to disclose

The supplier must disclose a conflict in writing before it bids, or as soon as it learns of the conflict. It writes to the buyer's contact for the RFQ and sends a copy to ethics@procuraksa.com. An in-platform declaration step is planned. A disclosed conflict is not in itself a breach. A conflict that is hidden is.

4.3 Contact during a procurement

While an RFQ is open, the supplier deals with the buyer only through the RFQ's channels. It must not approach evaluators or approvers privately about the RFQ, and must not offer a job or a business opportunity to a person at the buyer who takes part in the procurement.

5. Gifts, hospitality and improper advantage

5.1 What is always prohibited

• Bribery: offering, promising, giving, asking for or accepting anything of value to influence or reward a decision, to a public official or to a private person, in the Kingdom or abroad, directly or through someone else.
• Kickbacks and secret commissions, and paying an intermediary knowing that part of the payment will reach a decision-maker.
• Facilitation payments: small unofficial payments to speed up or secure a routine action.
• Cash and anything like cash, such as vouchers, gift cards and loans.
• Favours: jobs or internships for relatives, donations to a person's chosen cause, or sponsorship, when they are given at someone's request or in connection with a procurement.

5.2 Gifts and hospitality: the decision rule

Before giving anything to a person at a buyer, the supplier asks five questions. If any answer is no, it does not give it.

1. Is every decision involving the supplier closed? No gift or hospitality while an RFQ, an award, a purchase order change, an invoice or a payment involving the supplier is open.
2. Is it modest and occasional, and ordinary courtesy such as a business meal or a small branded item?
3. Is it open? It is offered to the organisation, not privately, so that the receiver's manager can know of it.
4. Is it within the limit in the buyer's own policy? That limit is set by the buyer's own policy and recorded in the RFQ. If the RFQ records no limit, the limit is none, and the supplier gives nothing.
5. Would the supplier be comfortable if the other bidders and the auditors saw it?

Whatever the answers, entertainment and leisure trips, travel and lodging paid for a buyer's person, and cash or cash equivalents are not allowed. For visits to sites, factories or exhibitions, each side pays its own travel and lodging, unless the buyer's policy says otherwise and the buyer records it in the RFQ.

5.3 If something improper is offered or asked

The supplier refuses, writes down what happened, and reports it under section 13. A request for a payment by a person at a buyer is never a normal cost of business. A payment made only to protect a person from immediate danger to life or safety is not a breach if it is reported at once.

6. Fair competition

6.1 What is prohibited

The supplier must not agree with, or signal to, a competitor on:

• prices, discounts or other terms of a bid;
• whether or not to bid, or who is to win, including bid rotation;
• cover or complementary bids, which are bids not meant to win, put in to make the competition look real;
• sharing customers, regions or markets, or withdrawing a bid so that another wins; or
• future prices, announced publicly or privately in order to influence others, including through clarification questions or any message on the platform (price signalling).

Companies that are connected by ownership, management or staff and that bid separately on the same RFQ must disclose the link in each bid.

6.2 Sealed-bid integrity

A bid is the supplier's own independent offer, prepared without knowing the prices of others. The supplier must not try to learn another bidder's price or identity before the buyer opens the bids, whether by asking the buyer's staff or by trying to get round the platform. If it receives another bidder's information by mistake, it stops reading, does not use it, and reports it to the buyer and to ethics@procuraksa.com. After the deadline it does not change a bid, unless the RFQ allows it for every bidder, for example in a best-and-final round.

6.3 Joint bids and subcontracting between competitors

These are lawful when they are declared in the bid. When they are not declared, they are prohibited.

6.4 If a competitor makes an approach

The supplier refuses, writes down what was said, and reports it under section 13. These rules follow the Competition Law, and breaking that law can lead to penalties from the authorities in addition to what Procura does.

7. Accurate information

7.1 What must be true

Everything a supplier gives to Procura or to a buyer must be true, complete and up to date. That covers the company name, commercial registration number, VAT number, address and authorised signatory, bank details, licences and certificates with their real issue and expiry dates, specifications, origin, capacity, references, prices, quantities, delivery dates, warranty and payment terms, and every declaration an RFQ asks for, such as local content, Nitaqat band, small-business status or quality certifications.

7.2 What is prohibited

The supplier must not forge, alter or borrow a document, use another company's registration, certificates or references, claim an approval or certification it does not hold, open more than one account for the same organisation, open an account under a false name, or submit a bid for a company that has not authorised it. Bank details must be for an account in the supplier's own name.

7.3 Keeping records current

The supplier updates its details when they change, and renews its registration and certificates before they expire. The platform checks these dates today. A supplier whose commercial registration or certificate has expired cannot be invited, cannot bid and cannot be awarded. A change of commercial registration or VAT number needs a new verification, and a change of bank details is held until Procura verifies it. Bank changes are made on the platform, never by e-mail alone.

7.4 Prices

A price is one the supplier can honour at the stated quantity, specification, delivery and payment terms. No bid may be made at an unrealistically low price in order to win and then renegotiate, and no charge may be left out of the price and added later. VAT is shown as the law requires.

7.5 Mistakes

A genuine error is reported to the buyer in writing as soon as it is found. A supplier that reports its own error promptly is treated more favourably than one that is found out.

8. People, labour and safety

8.1 The law

The supplier complies with the Saudi Labour Law and the related regulations for everyone who works on what it supplies, including contract, temporary and migrant workers and the workers of its subcontractors.

8.2 What is prohibited

Forced, bonded, compulsory or trafficked labour is prohibited. The supplier does not hold workers' passports, residence documents or wages, and does not charge workers recruitment fees. It does not employ anyone under the minimum legal working age, and does not put young workers into hazardous work.

8.3 Fair terms

Wages are paid on time and in full, as the contract and the law require, including the wage-protection rules. Working hours, rest and leave follow the law.

8.4 Safe workplaces and respect

The supplier keeps workplaces safe and healthy, gives safety information for its products, and reports serious accidents to those who must know. It does not allow harassment, abuse or discrimination, and respects the dignity of every person. The participation of women, young people and people with disabilities in its workforce is encouraged.

8.5 Saudization and Nitaqat

The supplier meets the Saudization commitments that apply to its establishment under the Nitaqat programme. Where an RFQ asks for a declaration, it states the true position. It does not use fictitious employment or any concealment arrangement, which the law prohibits.

8.6 Guidance

This section follows the national labour framework, Vision 2030 objectives for national employment and empowerment, and the guidance of ISO 26000 on social responsibility. Procura does not require an ISO 26000 certificate. A buyer may ask a supplier to describe how it meets these standards, and the supplier must answer truthfully.

9. Environment and community

The supplier complies with environmental, product-safety, waste and hazardous-materials law. It sources responsibly: it knows where its materials come from, avoids sources linked to serious human-rights abuse or unlawful environmental damage, and reduces waste and packaging where it can. Where an RFQ includes sustainability criteria, the supplier answers them honestly.

Procura encourages, and does not require, local content: local sourcing, local employment, training and partnerships with small and medium businesses, in line with Vision 2030. A buyer may ask for local-content information in its RFQ. The supplier must then give accurate information it can support with documents, and must not inflate it or rely on a front arrangement.

10. Confidentiality and data protection

10.1 Confidential information

RFQ documents, specifications, drawings, quantities, budgets, a buyer's data, and anything else a supplier learns about a buyer or another party through Procura are confidential. The supplier uses them only to prepare a bid for that RFQ and to perform the resulting purchase order. It does not disclose them to anyone who does not need them, other than its own advisers and subcontractors who are bound to confidentiality for that purpose, and it does not use them for another purpose or to compete with the buyer. This duty continues after the RFQ ends. It does not apply to what the law requires the supplier to disclose.

10.2 Personal data

The names, telephone numbers and e-mail addresses of a buyer's staff that the supplier learns through Procura are used only for the transaction, and in line with the Personal Data Protection Law. They are not used for marketing messages or put on lists. Personal data that the supplier receives in performing a purchase order is processed as the law and any data processing agreement require. A breach affecting personal data is reported without delay to Procura (security@procuraksa.com) and to the buyer.

10.3 No scraping and no circumvention of controls

The supplier does not scrape or bulk-collect data from Procura, extract it by automated means, get round access controls or rate limits, or reverse-engineer the platform, as the Acceptable Use Policy provides.

10.4 Credentials

Each person uses their own account, tied to a named individual. Sign-in codes, sessions and Google sign-in are never shared or passed on. The supplier's administrator removes users who leave or change role. Suspected compromise of an account is reported at once to security@procuraksa.com.

10.5 What the platform does to protect bids

Bids are encrypted when they are submitted. In the product, no Procura operator account has the permission to read bids, so in a sealed RFQ they stay closed until the opening time. Procura's own people may not look for another way round this. A supplier that believes it has happened reports it under section 13.

11. Conduct on the platform

11.1 Accounts

One account belongs to one person. Logins are not shared. Users have only the access their role needs.

11.2 No circumvention

Where a transaction began on Procura, whether as an RFQ, an invitation, a clarification, a bid, a quotation request or an award, the supplier carries it through on Procura, so that the bid, award, purchase order, delivery and invoice are recorded there. It must not move the transaction away from the platform in order to avoid the audit trail, the approval controls, the sealed-bid process or the other bidders. This rule does not restrict dealings that did not begin on Procura. In this version Procura earns subscriptions and takes no commission on awards, so the rule exists to protect the record and fair competition, not a fee.

11.3 No fake bids or accounts

The supplier does not submit bids it does not mean to honour, does not use a second account or a related party to bid against itself, and does not take part in any arrangement to push prices up or down in a reverse auction.

11.4 Deadlines and sealed bids

The supplier bids before the deadline. It does not ask for a late or altered bid to be accepted unless the RFQ allows it for every bidder. It does not ask the buyer or Procura to open or show a bid early.

11.5 Awards and purchase orders

A bid is binding for its validity period. The supplier acknowledges or declines a purchase order promptly, on the platform. It delivers as agreed and does not decline an award only because prices in the market have moved. A change to quantity, specification, price or date goes through a change order on the platform. The supplier uses the delivery handover code only for a real delivery.

11.6 Faults in the platform

A supplier that finds an error or weakness in Procura that gives an unfair advantage or exposes data stops, does not use it, and reports it to security@procuraksa.com. It does not test the platform's security without written permission.

11.7 Honest ratings

Ratings given after an order is paid are honest and based on facts.

12. Duties specific to suppliers

12.1 Bid in good faith

The supplier bids only where it intends and is able to deliver, and only after reading the RFQ, the specification and the terms. Questions go through the RFQ's clarification channel before it closes. Every answer is published to every bidder, and the asker is not named.

12.2 Quote only what can be delivered

Capacity, stock, licences and lead times must be real. Any exception to the specification or the terms is stated clearly in the bid, not left unsaid.

12.3 Quality and warranty

Goods and services conform to the specification, to the Saudi standards and technical regulations that apply, and to the certifications the supplier has stated. The warranty is the one stated in the bid and the purchase order, and defects are put right at the supplier's cost as the purchase order provides.

12.4 Subcontracting and sub-suppliers

The supplier discloses in its bid any subcontracting of a substantial part of the work, and names the subcontractor if the RFQ asks. It does not subcontract the substance of a purchase order without the buyer's prior written consent. It tells its sub-suppliers about this Code and requires them in writing to meet the same standards, and it does not use a sub-supplier that Procura or the buyer has told it is suspended. The supplier remains responsible for its sub-suppliers.

12.5 Audit cooperation

The supplier cooperates with reasonable requests from the buyer or from Procura to check compliance with this Code. That includes documents and certificates, records of prices and deliveries, and, with notice and at reasonable times, visits to premises or sites. It answers within the period stated in the request. It keeps its transaction records for as long as the law requires, and any longer period in the purchase order, and does not destroy records once a review has begun.

12.6 Invoices

Invoices match the purchase order and the goods receipt, and are valid tax invoices with VAT shown. The supplier does not issue duplicate or inflated invoices, and does not invoice for what has not been delivered.

12.7 Disputes and returns

The supplier raises disputes and returns through the platform in good faith, keeps to the facts, and takes part fairly in mediation.

12.8 Payment

Buyers are expected to pay valid invoices on the payment term recorded in the bid and the purchase order. The supplier sends complete and correct invoices, does not pressure a buyer's staff for payment ahead of the agreed term, and tells the buyer promptly through the platform if its bank details change.

13. How to report a concern

Anyone may report a concern about conduct on Procura, or a breach of this Code or of its companion Code, to ethics@procuraksa.com. That includes a supplier, a buyer, a user, a sub-supplier, an employee and a member of the public.

13.1 What to report

• suspected bribery, or a gift or hospitality that breaks the rules;
• a conflict of interest that was not disclosed;
• bid rigging, cover bids or price signalling;
• a leaked bid, price or other confidential information;
• a false document, a false claim or a fake account;
• an attempt to take a transaction off the platform to avoid the record;
• forced or child labour, or unsafe conditions, in a supply chain;
• misuse of personal data or of another person's account;
• retaliation for a report, a question or a complaint; and
• anything else that conflicts with this Code.

13.2 What to include

What happened, when, the RFQ, bid, purchase order or invoice number, who was involved, and any document or message that shows it. A report may be made without giving a name. Procura then cannot ask follow-up questions, and a report with little detail may be hard to act on.

For a security vulnerability, write to security@procuraksa.com. For a request about personal data, write to privacy@procuraksa.com.

13.3 Confidentiality

A report is seen only by the people who need it to assess it and act on it. Procura does not tell the person reported who made the report, and protects the reporter's identity as far as the law allows. The law or an authority may in some cases require disclosure.

13.4 No retaliation

Procura does not allow retaliation against anyone who reports a concern in good faith or who helps a review, whether or not the concern proves right. Retaliation includes ending business, dropping a supplier from invitations, lowering a rating, threats, and any other disadvantage. Retaliation is itself a serious breach of this Code, by a buyer or by a supplier. A person who reports in good faith does not lose standing, invitations or ratings on Procura because of it. A report that is knowingly false, or made in bad faith, is also a breach.

13.5 Authorities

Nothing in this Code stops anyone from reporting to a competent authority, such as the Oversight and Anti-Corruption Authority (Nazaha), the General Authority for Competition or the Saudi Data and AI Authority (SDAIA).

13.6 What Procura does with a report

Procura reads each report, decides whether it falls within its role, and applies the same standard whatever the size of the customer concerned. It tells the reporter the outcome where it can do so without harming confidentiality. Procura sets no fixed reply period in this version; the period is an open point for counsel.

Today the channel is a monitored mailbox. A "report a concern" form inside the platform, with a case number, is planned.

14. How Procura responds

14.1 A graduated response

Procura's response is proportionate. It looks at how serious the breach is, whether it was deliberate, whether it was repeated, the harm done, and how the person or organisation cooperates. The steps below are a ladder, not a fixed order: a serious breach can start higher up, and a step can be skipped.

Procura may also ask for corrective action, such as correcting data, withdrawing a false bid or returning an improper benefit, and may record the outcome in the account's history. Suspension may be applied before a full review where that is needed to stop serious harm, for example fraud, bribery, forged documents or a security risk; the notice then follows at once.

14.2 Fair process

Before a decision that restricts an account, Procura tells the person or organisation in writing what is alleged and which section of this Code applies, and gives a reasonable period, stated in the notice and suited to the case, to respond and to provide documents. Procura considers the response and gives its decision in writing with reasons. The decision can be challenged by writing to ethics@procuraksa.com; the challenge is reviewed by a person who took no part in the first decision.

Procura is not a court. It does not decide contract claims between a buyer and a supplier: the purchase order is theirs, and the dispute function of the platform is available to them. A decision under this Code does not limit any right under the law or a contract, or any action by an authority.

14.3 What the platform can do today, and what is planned

15. Acceptance

15.1 Where and when

At the first sign-in after a registration is approved, Procura shows this Code together with the Terms of Use, the Privacy Policy and the other documents that apply to the account, and asks an authorised person to accept them before the account is used for transactions.

15.2 Who accepts

The person who accepts confirms that they are authorised to bind the supplier organisation. Users added later are bound through the organisation, and Procura may ask each of them to acknowledge the Code at their own first sign-in.

15.3 The record

Procura records the version, the time, the person and the organisation in its audit trail, and keeps the record with the account's history.

15.4 Questions and disagreement

A person who has a question about this Code, or does not agree with it, should not accept it, and should write to ethics@procuraksa.com. Procura may then be unable to open or keep the account.

16. Version and review

This is version 1.0. The version is shown in the document control table and at the head of the page. Procura reviews the Code at least once a year, and whenever the law or the platform changes in a way that affects it.

A material change gets a new version number and a short summary of what changed, is notified through the platform or by e-mail, and is put to the users for acceptance at their next sign-in. Earlier versions are kept, and are available on request. The version a person accepted is recorded.

The Arabic text is the authoritative text. The English text is provided for convenience. Questions about the Code go to ethics@procuraksa.com.

17. Meaning of some terms