Buyer Pack

Document control

What you are accepting

• One agreement with Procura for your organisation: Part A (the Agreement), Part B (platform terms), Part C (acceptable use), Part D (Code of Conduct for Buyers), Part E (privacy and data processing) and Part F (schedules).
• Core buyer access is free: one legal organisation, 5 users, one location, 20 newly published RFQs a month and 5 GB. There is no subscription, no fee for receiving invoices and no commission on awards. At a limit, work in progress continues and only new discretionary use pauses.
• Procura is a software and records provider: it is not a party to your purchases, holds no money, does not issue ZATCA e-invoices and does not yet run a live commercial-registry check.
• A Purchase Order that arises from an Award stays held until both parties have signed the Contract through the Platform.
• Sealed Quotations stay sealed until the opening time, and you keep suppliers' information confidential and follow the Code of Conduct (gifts, conflicts of interest, fair evaluation).
• Personal Data: Procura is the Controller of account, billing and security data and the Processor of your procurement data. The Platform is hosted in the European Union (Frankfurt), outside the Kingdom.
• The retention periods in this draft are proposals and are not yet approved.
• This is a draft pending counsel review. Your acceptance records your name, organisation and role, the version of the Pack and its SHA-256 fingerprint, the time, and your network address and browser. If you disagree, do not accept, and write to the legal contact.

Part A: The Agreement

A.1 Parties to the Agreement and the Pack

This Agreement, and every other Part of this Pack, is entered into electronically between:

First Party: the Procura Platform

Legal Name: xxxxxxx
Commercial Registration No.: xxxxxxx
Unified No.: xxxxxxx
VAT No.: xxxxxxx
Registered Address: xxxxxxx, Kingdom of Saudi Arabia
Official Email: xxxxxxx

referred to as "Procura".

Second Party: the Buyer

The Buyer is the organisation registered on the Platform as a buyer. Its identity (legal name, commercial registration number, VAT number, address, authorised representative and email) is taken from the registration data held in the acceptance record at the time this Pack is accepted. The Pack is accepted by a person authorised to bind the organisation, and it applies to the organisation and to its Authorized Users.

Procura and the Buyer are together the "Parties" and each is a "Party".

A.2 Preamble

Procura provides a digital technology platform for managing procurement and supply-chain operations, connecting Buyers with Suppliers, and managing purchase requests, RFQs, commercial Quotations, evaluation, Award, contracts, Purchase Orders, receiving, matching and the other functions that the Platform makes available from time to time.

The Buyer wishes to use the Platform for its commercial, administrative and procurement purposes.

Accordingly, the Parties have agreed as follows:

A.3 Interpretation and Defined Terms

The following definitions apply in every Part and Schedule of this Pack, and a defined term has the same meaning wherever it appears.

A.3.1 The documents of the Pack and their names

The documents that were previously separate are merged in this Pack. Wherever any Part refers to one of them by name, the reference is to the place shown below:

A.3.2 Rules of interpretation

• Headings are for convenience and do not affect interpretation, and "including" does not limit.
• A reference to a Part, clause or Schedule is to a Part, clause or Schedule of this Pack, and clause numbers are written with a Latin letter and Western digits (for example B.3).
• Every period is counted in calendar time by Riyadh time unless stated otherwise, and amounts are in Saudi riyals and before VAT unless stated otherwise.
• A reference to a law or regulation is to it as amended or replaced.
• A clause marked "reserved" is not yet settled: it creates no right and removes none until it is completed after counsel's review, and the open point it refers to is named.
• Where the Parts of the Pack conflict, the order in the clause on the order of precedence in Part A applies.

A.4 Scope of Services

Depending on the plan and the services activated, Procura makes available to the Buyer the use of functions that include:

• user and permission management.
• creating and managing Purchase Requests.
• creating and managing RFQs.
• inviting Suppliers.
• receiving Quotations electronically.
• managing confidential and sealed Quotations.
• comparison and evaluation.
• recommendation and Award procedures.
• managing Purchase Orders.
• managing contracts and documents.
• recording receipt.
• matching between the request, the Purchase Order, the receipt and the invoice, depending on the functions available.
• procurement reports.
• the electronic audit trail.
• dashboards and analytics.
• Supplier management.
• any additional services that are subsequently activated for the Buyer.

The provision of any function does not mean that Procura becomes a party to the commercial relationship between the Buyer and the Supplier.

A.5 Nature of Procura’s Role

The Buyer acknowledges and agrees that:

• Procura is a technology service provider and a digital operating platform.
• Procura is not a seller of the goods or services offered by Suppliers.
• Procura is not an agent of the Buyer or of the Supplier, unless there is an express written agreement to the contrary.
• Procura does not guarantee the acceptance of any Quotation or the completion of any purchase.
• Procura does not guarantee the quality, suitability, safety or availability of the products or services provided by Suppliers.
• Procura bears no responsibility for the Supplier’s performance or its compliance with delivery dates, specifications, warranties or prices.
• The commercial relationship relating to the goods, the service or the Purchase Order is between the Buyer and the relevant Supplier.
• The use of the Platform shall not be construed as creating a partnership, agency or joint venture between Procura and the Buyer.

A.6 Account Creation and Electronic Acceptance

The Buyer is entitled to create the Account through its authorized representative or employees.

The Buyer acknowledges that the person who registers or clicks the button:

“I agree to the Terms and Conditions”

or the like, or who uses an electronic verification method, a verification code or an electronic signature, is legally authorized to bind the Buyer to this Agreement.

The Buyer agrees that Procura may keep an electronic record including, as available:

• the user’s name;
• the email address;
• the telephone number;
• the date and time of acceptance;
• the Internet Protocol (IP) address;
• the device or browser;
• the version of the terms accepted;
• the record of amendments;
• the login record;
• the record of actions and approvals;
• any other electronic verification methods.

This record shall form part of the evidence of dealings between the Parties, unless the contrary is proved in accordance with the law.

A.7 User Permissions

The Buyer bears full responsibility for:

• identifying its users.
• determining their permissions.
• safeguarding login credentials.
• revoking the permissions of any user when that user’s relationship with the Buyer ends.
• not sharing login credentials.
• verifying the validity of any action taken from its Account.

Actions taken from an Authorized User’s account shall be deemed to be made by the Buyer, unless the Buyer notifies Procura immediately of a breach or unauthorized use.

A.8 Procurement and Quotation Procedures

The Buyer acknowledges that the Platform is a tool for managing procurement procedures and is not a substitute for the Buyer’s internal policies.

The Buyer remains responsible for:

• internal approvals;
• limits of authority;
• the budget;
• specifications;
• technical and commercial evaluation;
• Award decisions;
• negotiation;
• issuing Purchase Orders;
• receiving products and services;
• accepting invoices;
• compliance with the relevant laws.

A.9 Confidentiality of Quotations

Procura handles Quotations and data in accordance with the Platform’s security design and the permissions specified.

The Buyer acknowledges that any Quotation submitted by a Supplier is confidential as between the Buyer and the Supplier unless:

• the Supplier agrees otherwise;
• disclosure is required by law;
• disclosure is necessary for the operation of the service;
• the Quotation has become publicly available information without any breach.

The Buyer shall not use or disclose Suppliers’ Quotations outside the purpose for which they were submitted, except as permitted by the laws or by the contract between the Buyer and the Supplier.

A.10 Buyer Obligations

The Buyer shall:

• provide accurate and complete information.
• safeguard users’ permissions.
• use the Platform for lawful commercial purposes.
• not misuse the Platform.
• not attempt to breach or disable the Platform.
• not introduce malicious software.
• not use the Platform to infringe the rights of others.
• not upload data that it has no right to use.
• not use the Platform for any activity that violates Saudi laws.
• comply with the laws and regulations applicable to its activity.
• comply with the laws relating to combating bribery, corruption, money laundering and fraud, as applicable.
• not manipulate competition procedures or Quotations.
• not create fake accounts or use the identity of others.
• not exploit the Platform to deceive Suppliers or to circumvent contracts.

A.11 Buyer Data and Ownership

Buyer Data remains the property of the Buyer or of the party that lawfully owns it.

The Buyer grants Procura a limited, non-exclusive licence, for the term of the Agreement, to process and use the data to the extent necessary:

• to provide the service;
• to operate the Platform;
• for technical support;
• for cybersecurity;
• for backup;
• to improve performance;
• to prepare aggregated, non-identifying statistics;
• to comply with the laws;
• to perform contractual obligations.

Procura may not sell the Buyer’s Personal Data for independent commercial purposes unless the law permits it or the Data Subject or the Buyer, as the case may be, consents.

A.12 Personal Data Protection

The Parties shall comply with the Personal Data Protection Law (PDPL) and the related regulations, where applicable.

The Buyer acknowledges that it is responsible for the lawfulness of the Personal Data it uploads to the Platform and for having the legal basis required to process it.

Procura shall process Personal Data to the extent necessary to provide the services and in accordance with its Privacy Policy.

Where Procura acts as a Processor of data on behalf of the Buyer, the Buyer remains the Controller within the limits set by the law and the nature of the processing.

Where Personal Data is transferred or made available outside the Kingdom, Procura and the Buyer, each according to its role, shall comply with the legal requirements and safeguards under the relevant laws and regulations.

A.13 Cybersecurity

Procura applies appropriate administrative, technical and organizational controls to protect the Platform and the data.

Procura does not guarantee that a breach or security incident cannot occur, but it undertakes to take reasonable measures proportionate to the nature of the service.

The Buyer shall take appropriate security measures, including the management of accounts, passwords, devices and user permissions.

A.14 Fees and Taxes

Core buyer access to the Platform is free: the Buyer pays no subscription and no invoice-receipt fee, and Procura takes no commission on the value of the Award.

Core buyer access includes, as set out in the Schedule of Free Core Buyer Access and as shown on the pricing page at the time of use: one legal entity, a stated number of named users, one location, a stated number of RFQs published per calendar month (Riyadh time), a stated amount of storage for what the Buyer uploads, and the request, budget, approval, Purchase Order, receipt, invoice-review and dispute workflows.

At a limit, work already in progress, correspondence, records and corrective documents continue unchanged, and only new discretionary use pauses, with a route to request a capacity review. No undisclosed fees are charged to the Buyer, no paid plan is activated for it automatically, and any wider scope requires an express written agreement.

A Buyer may sponsor the subscription of an existing Supplier with the Supplier’s consent. Sponsorship changes only the party to which the Supplier’s subscription invoice is addressed: it gives the sponsor no authority over the Supplier’s data, no sight of competing Quotations and no effect on ranking or evaluation, and it is disclosed in the evaluation of RFQs managed by the sponsor in which the Supplier submits Quotations.

A Buyer that, before version 1.2, entered into a yearly subscription under one of the earlier buyer plans (Essential, Institutional or Group) may remain on the price, limits and term of the prior version until the end of its term or until the Parties agree in writing to move it, with no silent change to its price, limits or invoices and no second charge for it.

Value added tax, at the rate shown at the time of the order, and any statutory taxes or charges collectible under Saudi laws, shall be added to the amounts due.

The fees do not include the value of the products or services that the Buyer purchases from Suppliers.

A.15 No Commission on Award Value

Unless the Parties agree otherwise in writing, Procura is not entitled to any percentage of the value of the contract, Purchase Order or Award between the Buyer and the Supplier.

Procura is entitled only to the fees set out in the subscription plan or the agreed additional services.

A.16 Invoicing and Payment

Procura issues invoices according to the Buyer’s registered data.

Procura does not currently provide electronic invoicing services or integration with the electronic invoicing system of the Zakat, Tax and Customs Authority (ZATCA), and invoices issued through the Platform are not ZATCA e-invoices, that is, electronic invoices approved under that system.

The Buyer shall pay within the period stated in the invoice.

In the event of late payment, Procura may, after notifying the Buyer, suspend some or all of the Account’s functions until payment is made, without prejudice to its legal and contractual rights.

A.17 Intellectual Property

All intellectual property rights relating to the Platform, including:

• software;
• code;
• databases;
• interfaces;
• designs;
• trademarks;
• algorithms;
• standard reports;
• content produced by Procura;

remain the property of Procura or its licensors.

This Agreement does not grant the Buyer any ownership of the Platform, but only a limited right of use in accordance with this Agreement.

A.18 Buyer’s Intellectual Property

The ownership of the Buyer’s data, trademarks or documents is not transferred to Procura.

The Buyer grants Procura a limited right to use them solely to provide the services and perform the Agreement.

A.19 Service Availability

Procura endeavors to keep the Platform continuously available, but the service may be temporarily interrupted because of:

• maintenance;
• updates;
• faults;
• problems with telecommunications or cloud providers;
• cyber attacks;
• Force Majeure;
• legal requirements;
• any cause beyond Procura’s reasonable control.

A temporary interruption shall not be considered a material breach if it is beyond reasonable control and is handled in a professional and reasonable manner.

A.20 Platform Changes

Procura may develop, modify, add or remove functions of the Platform.

No material change may remove the Buyer’s essential contractual rights without appropriate notice, unless the change is required for legal, security or technical reasons.

A.21 Account Suspension

Procura may suspend the Account immediately if:

• unlawful use is established or reasonably suspected.
• a security breach occurs.
• the Account is used to harm the Platform.
• the Buyer is materially late in payment.
• the Buyer breaches this Agreement.
• a competent government authority so requests.
• the continuation of the Account poses a security or legal risk.

The suspension shall be lifted when its cause has been remedied, where that is possible.

A.22 Termination of the Agreement

Either Party may terminate the Agreement in accordance with the notice period specified in the subscription request.

It may be terminated immediately in the event of:

• bankruptcy or liquidation, as permitted by the law;
• uncured material breach;
• unlawful use;
• gross infringement of intellectual property rights;
• fraudulent conduct.

A.23 Effects of Termination

Upon the end of the Agreement:

• the Buyer’s right to use the Platform ceases.
• all amounts due up to the date of termination become payable.
• the Buyer Data is handled in accordance with the Privacy Policy and legal obligations.
• the Buyer may request a copy of its available data in a reasonable format within the availability period specified by Procura.
• termination does not affect the rights and obligations that by their nature continue after termination.

A.24 Limitation of Procura’s Liability

To the extent permitted by the law, Procura shall not be liable for:

• indirect loss of profits;
• loss of business opportunities;
• loss of reputation;
• consequential losses;
• the acts of Suppliers or other Buyers;
• the quality of products;
• delayed delivery;
• non-performance of the contract between the Buyer and the Supplier.

In all cases, and to the extent permitted by law, Procura’s aggregate liability for claims arising out of the Agreement shall not exceed the total fees paid by the Buyer to Procura during the twelve months preceding the event giving rise to the claim.

No limit of liability shall apply in cases where liability may not be limited by law.

A.25 Indemnification of Procura

The Buyer shall indemnify Procura, within the limits of the law, for direct claims, losses and costs arising from:

• the Buyer’s breach of the Agreement;
• unlawful use of the Platform;
• the entry of data that the Buyer has no right to use;
• infringement of the rights of others;
• misuse of a user account;
• violation of the laws.

A.26 Force Majeure

Neither Party shall be liable for delay or non-performance resulting directly from a circumstance beyond its reasonable control, including natural disasters, wars, disturbances, epidemics, government decisions, infrastructure outages, large-scale cyber attacks and material failures at service providers.

The affected Party shall notify the other Party and take whatever measures are possible to mitigate the impact.

A.27 Confidentiality

The Parties shall keep confidential the commercial, technical, financial and other non-public information that either Party obtains from the other Party.

The obligation does not extend to information that:

• has become public without any breach.
• was lawfully known to the Party before disclosure.
• was lawfully obtained from a third party.
• must be disclosed by law or by court order.

A.28 Anti-Bribery and Corruption

The Buyer shall use the Platform in a manner consistent with the relevant Saudi laws and the principles of combating bribery, corruption and fraud.

The Platform may not be used to facilitate any unlawful payments or benefits or any undisclosed conflict of interest.

A.29 No Guarantee of Procurement Outcome

Procura does not guarantee that use of the Platform will result in:

• obtaining the lowest price;
• achieving specific savings;
• an increase in the number of Suppliers;
• the success of any tender;
• the performance of any contract;
• achieving any specific commercial result.

The Platform is a technology tool for managing the process and is not a financial or commercial adviser to the Buyer.

A.30 Relationship with Suppliers

The Buyer is responsible for evaluating Suppliers and verifying their eligibility, suitability and qualifications.

The appearance of a Supplier on the Platform does not constitute a certification by Procura of the Supplier’s quality or suitability.

A.31 Disputes with Suppliers

Any dispute relating to:

• the product;
• the service;
• the price;
• the quantity;
• the quality;
• delivery;
• the warranty;
• the invoice;
• the Purchase Order;

shall be between the Buyer and the relevant Supplier, unless the claim arises directly from Procura’s breach of its obligations under this Agreement.

A.32 Governing Law and Jurisdiction

This Agreement is governed by, and shall be construed in accordance with, the laws of the Kingdom of Saudi Arabia.

In the event of any dispute or claim between Procura and the Buyer relating to this Agreement or its performance, interpretation or termination, the Parties shall first seek to settle the dispute amicably within fifteen (15) business days from the date of written notice of the dispute.

If amicable settlement is not possible, jurisdiction, to the extent permitted by the law and without prejudice to mandatory rules of jurisdiction, shall lie with the competent Commercial Court in Jeddah, Kingdom of Saudi Arabia.

The Parties acknowledge that this clause is not intended to create jurisdiction contrary to the mandatory subject-matter or territorial jurisdiction prescribed by law.

A.33 Notices

Contractual notices shall be given by:

• the registered email address;
• a notice within the Platform;
• or any approved electronic means agreed by the Parties.

Each Party is responsible for keeping its own contact details up to date.

A.34 Assignment

The Buyer may not assign the Agreement or any of its rights and obligations to a third party without Procura’s consent, except in cases of restructuring, merger or transfer of the business in accordance with the laws and without prejudice to the rights of the other Party.

Procura may transfer the Agreement to an affiliate or legal successor, or in the event of a restructuring or acquisition, provided that the Buyer’s essential rights are not diminished.

A.35 Severability

If any provision of the Agreement becomes unenforceable or inapplicable, this shall not affect the remaining provisions, and it shall be replaced, to the extent permitted by law, by a provision that achieves the closest intended legal and commercial effect.

A.36 Entire Agreement

This Agreement, together with:

• the subscription request;
• the Service Order;
• the Terms of Use;
• the Privacy Policy;
• the Cookie Policy;
• the Acceptable Use Policy;
• the Code of Conduct for Buyers;
• the Data Processing Addendum, where applicable;
• and any written annexes accepted electronically;

constitutes the entire agreement between the Parties with respect to the service.

A.37 Order of Precedence

In the event of a conflict between the documents, the order of priority shall be as follows:

• mandatory legal requirements;
• the Service Order or special agreement signed between the Parties;
• the Data Processing Addendum, as regards the protection of Personal Data;
• the Buyer Agreement or the Supplier Agreement, as the case may be, with its annexes;
• the Terms of Use;
• the Acceptable Use Policy;
• the Code of Conduct (for Buyers or for Suppliers, as the case may be);
• the Privacy Policy;
• the Cookie Policy;
• any marketing content.

A.38 Language

This Agreement has been drawn up in Arabic and English.

In the event of any conflict or difference in interpretation, the Arabic version shall be the authoritative reference in the Kingdom of Saudi Arabia, unless a later written agreement provides otherwise and without prejudice to the law.

A.39 Electronic Acceptance

The Buyer acknowledges that clicking the “I Agree” or “Accept Agreement” button, completing the registration process, or using the Platform after this Agreement is presented, or signing it electronically, constitutes express and final acceptance of this Agreement.

The Buyer acknowledges that it has the capacity and authority necessary to enter into it.

The electronic copy retained by Procura, including the electronic acceptance record, shall be regarded as an original copy for evidentiary purposes, to the extent permitted by law.

A.40 Electronic Acceptance and Audit Schedule

A.40.1 Purpose

This Schedule explains how the Pack is accepted electronically and what record of that acceptance Procura keeps, so that the following can be shown: who accepted, for which organisation, which version, in what form, when, and that the text accepted is the text that is preserved.

Saudi electronic-transactions law recognises the validity and enforceability of electronic contracts, records and signatures where the statutory requirements are met. This Schedule does not guarantee that any court will admit a record as evidence, which is for the competent court (open point OP-04).

A.40.2 How acceptance works

• At registration, the person ticks a box to accept the Terms of Use and the Privacy Policy, and the version is recorded. A registration without the current version creates nothing.
• At the first sign-in, whether or not the organisation has been approved yet, the person signs in, authenticates and is shown the Pack for their role: the Buyer Pack for a Buyer, the Vendor Pack for a Supplier. The Platform stops at that step and allows nothing else until the Pack is accepted, except signing out.
• The person reads the Pack, ticks the single box that accepts it and presses the accept button. The Pack is accepted as one document, not clause by clause.
• A person who does not accept cannot use the account for transactions. A person who has a question or does not agree should not accept and should write to the legal contact.

A.40.3 What is recorded

An acceptance is recorded in the audit trail and in a queryable acceptance register. It states: the user and the organisation, the role, the identifier and version of the Pack, the SHA-256 value of the Pack and the identifier, version and SHA-256 value of each component document it is made of, the method of acceptance, the language in which the text was shown, the date and time in UTC, and the network address and browser of the person. The audit trail holds the address and browser only as keyed commitments, and the acceptance register holds them in clear until the retention schedule blanks them.

A.40.4 Integrity of the accepted text

The SHA-256 value is calculated from the text of the Pack in both languages as built from its component documents. If the text changes, its value changes. The Platform treats an acceptance as valid only for the version and the value that were shown, so that a person is never taken to have agreed to different words.

A.40.5 Audit trail and no retroactive alteration

Each entry of the audit trail carries a hash that covers the entry before it, so that editing or deleting an entry is detectable. A completed acceptance record is not altered afterwards. A correction is a separate entry linked to the original event.

A.40.6 Retention and access

Procura keeps acceptance and audit records for as long as is reasonably needed to prove the contract and to comply with the law, subject to the retention schedule. A person can see their own acceptances through the Platform, an organisation's administrator can see those of the organisation without network addresses and browsers, and the platform operator can see all of them.

A.40.7 Changes to the Pack

When the Pack changes, the new version has a new number and a new SHA-256 value, the previous version is kept, and every User is asked to accept the new version at the next sign-in. A User who accepted an earlier version is not taken to have accepted the new one.

Part B: Platform Terms

B.1 Scope of the Terms and Acceptance

These Terms of Use (the "Terms") govern the use of the Procura platform, its website, applications, electronic services, Supplier network, procurement services and any other related services (the "Platform"), which is operated by xxxxxxx, a company incorporated and registered under the laws in force in the Kingdom of Saudi Arabia ("Procura", "we" or "us").

By using the Platform, creating an account, accessing the Platform or clicking the button to accept these Terms, you acknowledge that you agree to, and shall be bound by, these Terms.

If you use the Platform on behalf of a company, organization or other entity, you represent that you have the legal authority to represent that entity and bind it to these Terms, in which case the term "you" includes both you and the entity you represent.

If you do not agree to these Terms, you shall not use the Platform.

B.2 Account Creation

The User shall provide accurate, complete and up-to-date information.

The User is responsible for:

• protecting login credentials;
• maintaining the confidentiality of the password and authentication methods;
• preventing unauthorized use;
• verifying the authorizations of the Users affiliated with their entity; and
• notifying Procura without delay of any unauthorized use.

The use of inaccurate information, or the impersonation of another person or entity, is prohibited.

B.3 Authority to Represent the Entity

When registering on behalf of an entity, the User represents that they:

• are legally authorized to represent the entity;
• are authorized to use the Platform on its behalf;
• have the authority to enter its data; and
• have the authority necessary to participate in the relevant purchasing or supply operations.

B.4 Buyer Responsibilities

The Buyer is responsible for:

• determining its purchasing needs;
• specifications;
• the budget;
• approval procedures;
• evaluation criteria;
• selecting the Supplier;
• the Award decision;
• Purchase Orders;
• contracts;
• receiving goods and services;
• inspecting them;
• approving invoices;
• payment; and
• complying with applicable laws and internal policies.

Procura does not make the purchasing decision on behalf of the Buyer.

B.5 Supplier Responsibilities

The Supplier is fully responsible for the accuracy of:

• its entity's data;
• its commercial registration;
• its tax data;
• its bank account;
• its products and services;
• prices;
• Quotations;
• delivery dates;
• warranties;
• licenses;
• certificates; and
• invoices.

The Supplier is prohibited from providing misleading, fraudulent or materially inaccurate information.

B.6 RFQs and Quotations

Procura may enable Buyers to issue RFQs and Suppliers to submit their Quotations.

The Supplier shall review the requirements of the RFQ before submitting its Quotation.

Where a sealed or protected Quotation system is in place, prices and commercial information shall be handled in accordance with the technical and procedural controls applicable to the RFQ.

Procura does not guarantee that the Platform will operate without interruption or be free of errors at all times.

B.7 Integrity and Competition

The User is prohibited from:

• colluding with competitors;
• unlawfully coordinating Quotations;
• submitting sham Quotations;
• manipulating the outcome of a competition;
• obtaining, without authorization, confidential information about other Suppliers' Quotations; and
• using the Platform for purposes that violate applicable laws.

Procura is entitled to take the technical or operational measures necessary to protect the Platform and its Users.

B.8 Contracts and Purchase Orders

Procura does not become a party to the contract or Purchase Order concluded between the Buyer and the Supplier merely because the Platform is used.

Both parties are responsible for reviewing:

• prices;
• specifications;
• taxes;
• delivery terms;
• payment terms;
• warranties;
• authorizations;
• signature; and
• legal compliance.

B.9 Invoices and Taxes

Each party bears its own tax and accounting responsibilities.

Procura does not currently provide e-invoicing services or integration with the e-invoicing system of the Zakat, Tax and Customs Authority (ZATCA), and invoices issued through the Platform are not ZATCA e-invoices.

Where e-invoicing services are made available through Procura in the future and are used, the obligated entity remains responsible for the accuracy of the invoice data and for its compliance with the relevant legal requirements.

Procura does not replace the taxpayer in its tax or accounting obligations.

B.10 Amendment of the Terms

Procura may amend these Terms from time to time.

An effective date shall be specified for the amended version, and Users shall be notified of material changes through appropriate means where required. When a new version of the documents is issued, the User is required to accept it upon first login after its publication, and the User shall not be deemed to have accepted a version that has not been presented to them.

B.11 What the Platform does and does not do

Procura provides software for managing procurement: requisitions, RFQs, Sealed Quotations, evaluation, Awards, Contracts, Purchase Orders, receiving, invoice review, payment records and reports. It records what Users do and keeps an audit trail. It connects Buyers and Suppliers, but it is not a party to the Procurement Transactions between them and it does not take any procurement decision for a Buyer.

In this release the Platform does not:

• hold, receive, transfer or guarantee money, and it provides no payment service;
• issue, transmit or clear invoices through the electronic-invoicing system of ZATCA, and the invoices produced through the Platform are not ZATCA e-invoices;
• perform a live Registry Check: the check is planned and is not live (clause B.16);
• issue qualified electronic signatures or digital certificates (clause B.13);
• verify, rate or guarantee any Buyer, Supplier, product or service, or give legal, tax, accounting or financial advice; or
• promise that it will be available without interruption or free of error.

A feature that the Schedules or the pricing page mark as planned is not available and is not promised. Nothing in this Pack states that the Platform has been certified or assessed against any law, regulation or standard.

B.12 Sealed Quotations

Where an RFQ is sealed, a Quotation is encrypted when the Supplier submits it, and its price and commercial terms are shown to no one, the Buyer included, until the opening time stated in the RFQ. The Platform is built so that no Procura operator account has permission to read a Sealed Quotation, and Procura's people shall not look for another way to read one. A Supplier may revise or withdraw its Quotation before the deadline as the RFQ allows, and each submission, revision, withdrawal and opening is recorded in the audit trail. In a two-envelope tender the technical documents open before the commercial prices, and in an auction the prices are open by design while the identities of bidders are not shown.

Procura does not promise that sealing cannot be defeated by a fault, an attack or conduct outside the Platform. A Buyer or a Supplier that believes a Sealed Quotation was read early shall report it as clause D.13 of the Code of Conduct provides.

B.13 Contracts signed before a Purchase Order is released

Where a Purchase Order arises from an Award (an RFQ, a tender or an auction), the Platform prepares the Contract with the order, on the awarded terms. The order is held, and neither Party to it can act on it, until the Buyer and the Supplier have both signed the current version of the Contract through the Platform. A call-off under a framework Contract is released only while that framework Contract is signed by both. A Buyer's chief financial officer or chief executive may release a held order before both signatures, giving a written reason that the Platform records in the audit trail, and a Buyer's organisation policy may switch the rule off, which is also recorded. A Purchase Order for a catalogue requisition that falls under no Contract is released through the Buyer's own approval chain.

A "signature" through the Platform is the act of an authenticated User, with the authority recorded for the Buyer's or the Supplier's account, approving the current text of the Contract. It is recorded with the time, the identity, the hash of the text and an audit entry. It is an electronic signature to the extent that the Electronic Transactions Law recognises it. It is not a qualified signature and involves no digital certificate. Whether it is sufficient for a particular Contract, and whether the parties should use another form of signature, are for the parties and their advisers (open point OP-05). Procura does not review the content or the legality of a Contract.

B.14 Payment records

For each invoice the Platform records the payment instruction that the Buyer's authorised Users prepare and approve, the version of the Supplier's bank details that was verified, the bank reference and the evidence of settlement that a User reports, and the reconciliation of the payment against the invoice. The payment itself is made by the Buyer to the Supplier outside the Platform, from and to their own bank accounts. Procura does not hold, receive, move, release or guarantee any money, does not execute or confirm a transfer, and records only what Users state and what the attached evidence shows.

A change to a Supplier's bank details takes effect only after Procura verifies it, and payment is held until then. A record on the Platform is evidence of what was entered. It is not, by itself, proof that money reached the Supplier.

B.15 Invoices and Tax Categories

Every Purchase Order line and invoice line carries a Tax Category in the vocabulary of the Saudi VAT law and of the ZATCA e-invoicing standard: S (standard rate), Z (zero-rated), E (exempt) and O (outside the scope of the tax), with the reason where the category requires one. The Platform records the category that the issuer selects and totals the tax by category, calculating VAT line by line at the rate then in force (15% for category S). It transmits nothing to ZATCA and is not an e-invoicing solution, and the same is true of the subscription invoices that Procura issues. The party that issues an invoice is responsible for choosing the correct category and for its own obligations under the tax laws, and Procura does not check them.

B.16 Registry Checks

The Platform is designed to compare an organisation's commercial registration number with the data of the commercial-registry data service. In this release the check is not live: it is simulated, nothing is sent to any registry, and the Platform does not show a "registry checked" label on the strength of a simulated check.

Procura plans to switch on a live check only when it has the written permission of the registry data provider and has settled the provider's terms on use, storage and reuse of the data. The design is that the check never runs on the public registration form, that each result is kept for one organisation only and is not reused for another, and that the provider's raw answer is not stored by default, only normalised facts and the SHA-256 value of the answer. A Registry Check shows what the registry returned at that moment. It does not certify the organisation, its authority or its solvency, and any use of the provider's data stays subject to the provider's own terms (open point OP-11). Procura's review of the documents that a Supplier submits is a separate step.

B.17 Evidence and the audit trail

The Platform keeps an audit trail of material actions (who, what, when and for which organisation). Each entry carries a hash that covers the entry before it, so that an edit or a deletion is detectable. A User with the right permission may export an Evidence Bundle for one RFQ or one Purchase Order. It contains the records, the attached files with their SHA-256 values, the related audit entries, the result of the Platform's own verification of the chain at the moment of export and a signed checkpoint of the chain's head, all listed in a manifest that can be checked offline.

A bundle certifies nothing about admissibility in court, about the truth of what a party stated, or about anything that happened outside the Platform. Sealed commercial data stays sealed in it, and the platform operator is held to the same rules as everyone else. How far these records count as evidence is for the competent court to decide.

B.18 Files and uploaded Content

A file that a User uploads is checked for type and size and is scanned before it can be downloaded. A file that fails the scan, or is still waiting for it, is not offered for download. The built-in check refuses programs, scripts, archives, macros and active documents and is a content-policy check, not an antivirus engine, so a file that passes it is not guaranteed to be free of malware. The User who uploads a file is responsible for having the right to upload it, and the Acceptable Use Policy governs what may be uploaded and how a report is handled.

B.19 Operating facts for this release

• Hosting: the Platform is hosted on managed cloud infrastructure in the European Union (Frankfurt, Germany). It is not hosted inside the Kingdom, and hosting inside the Kingdom is planned.
• Sign-in: by a one-time code sent to the registered email address, or by a Google account. A second sign-in step with an authenticator app is available. It is always required of the platform operator's staff, and it is required of an organisation's administrators where the organisation's policy requires it.
• Billing: Procura issues subscription invoices and records payments received by bank transfer. It does not take payment through a payment gateway in this release.
• Planned features: a feature shown as planned is not available, and the Platform does not display it as working.

Part C: Acceptable Use

C.1 Purpose

This Policy sets out the permitted and prohibited uses of the Procura Platform, and forms part of the Terms of Use, the Buyer Agreement and the Supplier Agreement.

C.2 Permitted Use

The Platform may be used only:

• for lawful commercial purposes;
• to manage procurement and supply;
• to send and receive RFQs;
• to manage Suppliers;
• to perform contracts and Purchase Orders; and
• for other purposes permitted under the subscription.

C.3 Prohibited Uses

The Platform shall not be used for:

• fraud or deception.
• impersonating others.
• hacking the Platform.
• attempting to circumvent access controls.
• introducing malware.
• disrupting the service.
• automated extraction of data without authorization.
• prohibited reverse engineering.
• infringing intellectual property rights.
• publishing unlawful content.
• discrimination, threats or harassment.
• money laundering or financing unlawful activities.
• bribery or corruption.
• manipulating tenders.
• submitting sham bids.
• collusion between Suppliers.
• creating multiple accounts to circumvent the rules.
• using the data of others without justification.
• publishing confidential information that the User obtained unlawfully.
• using the Platform for any purpose that violates Saudi laws.

C.4 Procurement Manipulation

The User is prohibited from attempting to:

• artificially raise or lower prices;
• submit a sham Quotation;
• engage in unlawful coordination with a competitor;
• unlawfully influence the outcome of an RFQ;
• misuse Quotation information; and
• disrupt legitimate competition.

C.5 Security

The following are prohibited:

• sharing login credentials;
• using another person's account;
• attempting to discover passwords;
• testing for vulnerabilities without permission; and
• uploading malicious files.

C.6 Procura's Actions

Where a violation is suspected, Procura may:

• request additional information;
• suspend the account;
• restrict certain functions;
• remove violating content;
• freeze a transaction where there is a security risk;
• terminate the account;
• preserve the necessary records; and
• notify the competent authority where there is a legal obligation.

C.7 Review Does Not Mean Approval

Procura's review of, or permission to publish, any content does not mean that Procura endorses its content or guarantees its accuracy.

C.8 Responsibility

The User remains responsible for their own actions and for the Users affiliated with their account.

C.9 Reports and Content Removal

Reports of misuse may be sent to:

abuse@procuraksa.com

Upon receipt of a report, Procura shall consider it and decide whether it falls within its role, and is not obliged to monitor content in advance. Where a violation is established, or for urgent protection, it may remove the violating content or restrict access to it, preserve evidence, and notify the content owner where this is possible without prejudicing an investigation or the rights of others, and enable the owner to object in writing at the same address. Procura does not adjudicate contract disputes between the Buyer and the Supplier. The removal and objection procedures are an item for review by legal counsel (open point OP-17).

Part D: Code of Conduct

D.1 Purpose and scope

Procura is a platform where buyers and suppliers run RFQs, sealed bids, awards and purchase orders. This Code sets the standard of conduct that every buying organisation on Procura accepts. The aim is plain: every RFQ is a real request, every award is a fair decision, and every record is a true one.

The Code of Conduct for Suppliers sets the standard for suppliers. The two documents work together. A buyer can expect from suppliers what the Supplier Code requires, and a supplier can expect from buyers what this Code requires.

This Code adds to the Terms of Use, the Buyer Agreement, the Acceptable Use Policy and the Data Processing Addendum. It does not replace them, and it does not reduce any duty under the law. The law always applies, and where the law is stricter than this Code, the law applies. Where a signed agreement between a buyer and a supplier, including a purchase order, deals with the same point, that agreement applies between them, but it never lowers the standards in sections D.4 to D.8 of this Code.

Where the buyer is a government entity, or is bound by the Government Tenders and Procurement Law, that law and the buyer's own rules apply as well. Procura is not the government procurement platform (Etimad) and does not replace it.

D.2 Who this Code binds

• The buying organisation, which accepts the Code through an authorised person.
• Every person who uses the organisation's Procura account or takes part in its procurement on Procura: requesters, procurement staff, approvers, evaluators, finance and accounts-payable staff, executives and administrators.
• Consultants, agents and others who act for the organisation in a Procura transaction.

The organisation is responsible for its people and for those it engages. Seniority is no exemption: the more influence a person has over a decision, the more closely this Code applies to them.

D.3 Principles

D.4 Conflicts of interest and disclosure

D.4.1 What it is

A conflict of interest exists when a personal, family, financial or business interest of a person at the buyer could affect, or could look as if it affects, a procurement decision. For example:

• a relative or close friend owns, manages or works for a supplier that is invited or bidding;
• the person, or a relative, holds a share in a supplier, or has a role in it, paid or unpaid;
• the person has been offered or has accepted a job, a loan or another benefit from a supplier; or
• the person has a private dispute with a supplier.

D.4.2 The duty to disclose and to step aside

A person who has a conflict declares it in writing to their manager and to the organisation's compliance contact before taking part in the RFQ, and in any case as soon as they learn of it. They then stand aside from the evaluation, the award recommendation and the approval, as far as the conflict reaches. The organisation records the declaration and who took over. An in-platform declaration step is planned, and until it exists the organisation keeps its own record. A disclosed conflict is not in itself a breach. A conflict that is hidden is.

D.4.3 What the platform already separates

The platform does not let the person who creates an RFQ or a purchase request approve it, and it picks approvers other than the requester. This helps, but it does not replace the duty to declare a conflict.

D.4.4 Suppliers connected to the buyer

A person at the buyer must not create, favour or invite a supplier in which they, or a relative, have an interest, unless the interest has been declared and the organisation has decided in writing that the supplier may take part.

D.5 Gifts, hospitality and improper advantage

D.5.1 What is always prohibited

• Bribery: asking for, accepting, offering or promising anything of value to influence or reward a decision, from or to a supplier, directly or through someone else.
• Kickbacks and secret commissions, and any arrangement to receive part of what is paid to a supplier.
• Facilitation payments: small unofficial payments to speed up or secure a routine action.
• Cash and anything like cash, such as vouchers, gift cards and loans.
• Favours: jobs, internships or contracts for relatives, donations to a person's chosen cause, or sponsorship, when they are asked for or are connected with a procurement.

D.5.2 Gifts and hospitality: the decision rule

Before accepting anything from a supplier, a person at the buyer asks five questions. If any answer is no, they decline.

1. Is every decision involving that supplier closed? No gift or hospitality while an RFQ, an award, a purchase order change, an invoice or a payment involving the supplier is open.
2. Is it modest and occasional, and ordinary courtesy such as a business meal or a small branded item?
3. Is it open? It is received on behalf of the organisation, and the person's manager can know of it.
4. Is it within the limit in the buyer's own policy? That limit is set by the buyer's own policy and recorded in the RFQ.
5. Would the person be comfortable if the other bidders and the auditors saw it?

Whatever the answers, entertainment and leisure trips, travel and lodging paid by a supplier, and cash or cash equivalents are not allowed. For visits to sites, factories or exhibitions, each side pays its own travel and lodging, unless the buyer's policy says otherwise and the buyer records it in the RFQ.

D.5.3 The buyer sets the limit, in every RFQ

The buyer sets the limit for gifts and hospitality under its own policy, and states it in each RFQ: a figure, or the word "none". Procura sets no amount. The person who creates the RFQ states the limit in the RFQ description. If the RFQ records no limit, the limit is none. A dedicated field with a reminder before the RFQ is published is planned.

D.5.4 If something improper is offered or asked

The person declines, writes down what happened, and reports it under section D.13. A buyer's staff member who asks a supplier for a gift, a payment or a favour breaches this Code, and a supplier who is asked should report it.

D.6 Fair competition and sealed-bid integrity

D.6.1 What is prohibited

A person at the buyer must not:

• steer an RFQ to a chosen supplier, for example by writing a specification around one supplier or brand without a justification, or by inviting only suppliers chosen to lose;
• split a purchase into smaller ones to stay below an approval level;
• tell one bidder about another bidder's price, identity or terms, or give one bidder information that others do not have;
• let one supplier see, change or "match" its bid after seeing others, outside a final-offer round that is open to every eligible bidder;
• agree with a supplier, or with several, on prices or on who is to win; or
• ask a supplier to bid a price that the buyer has already agreed with another.

D.6.2 Sealed bids

Bids in a sealed RFQ stay closed until the stated opening time. A buyer's user does not try to see a bid early, does not ask anyone to show it, and does not pass bid contents to anyone who does not need them to evaluate. The platform shows prices only once the bids are open. If a buyer receives a bid or a price early by mistake, it stops, tells Procura, and does not use it.

D.6.3 Deadlines and extensions

A deadline is not shortened once the RFQ is published. An extension is given to every invited bidder at once, with the reason.

D.6.4 If a supplier makes an approach

The person declines, writes down what was said, and reports it under section D.13.

D.7 Accurate information

D.7.1 What must be true

Everything a buyer gives to Procura or to a supplier must be true, complete and up to date: the organisation's name, commercial registration, VAT number and address, its authorised signatories and approval limits, and the content of each RFQ, namely the quantities, specification, delivery place and date, budget where stated, payment term, evaluation criteria and weights, and the dates.

D.7.2 What is prohibited

The buyer must not use another organisation's name or documents, open an account under a false name, give a supplier a false reason for a decision, or alter the requirements, criteria or weights after bids are received without telling every bidder in the same way.

D.7.3 Keeping records current

The buyer keeps its users, roles and approval limits up to date on the platform, and removes a person's access when they leave or change role. A buyer's administrator can deactivate the organisation's users.

D.7.4 Mistakes

A genuine mistake by a supplier is handled fairly. A buyer does not take deliberate advantage of an error, and where it finds one, it helps to correct it for the benefit of both sides, treating all bidders alike.

D.8 People, labour and safety

D.8.1 The buyer's own conduct

The buyer complies with the Saudi Labour Law and the related regulations for its own workforce, and meets the Saudization commitments that apply to its establishment under the Nitaqat programme. It does not use fictitious employment or any concealment arrangement, which the law prohibits.

D.8.2 What the buyer does not ask of suppliers

The buyer does not set a price, a deadline or a condition that can only be met by breaking labour or safety law, and does not ask a supplier to use forced, bonded or child labour, or to hold its workers' documents or wages.

D.8.3 Suppliers' people on the buyer's premises

Where supplier staff work on the buyer's premises or sites, the buyer provides the safety rules, equipment and induction that the law and the site require, and treats them with respect. It does not allow harassment, abuse or discrimination.

D.8.4 Fair access

The buyer keeps barriers to entry no higher than the need requires, so that capable small and medium businesses, including those led by women and young people, can compete. It does not set conditions that are not needed to exclude suppliers.

D.8.5 Guidance

This section follows the national labour framework, Vision 2030 objectives for national employment and empowerment, and the guidance of ISO 26000 on social responsibility. Procura does not require an ISO 26000 certificate.

D.9 Environment and community

Where a buyer uses sustainability or responsible-sourcing criteria, it states them in the RFQ, with their weight, so that every bidder can answer them. It does not use them in the evaluation if they were not stated.

Procura encourages, and does not require, local content: local sourcing, local employment, training and partnerships with small and medium businesses, in line with Vision 2030. A buyer that asks for local-content information says in the RFQ what it wants and how it will be weighed, and does not use it as an unstated reason to exclude a supplier.

D.10 Confidentiality and data protection

D.10.1 Suppliers' information

A supplier's prices, priced schedules, technical proposals, documents, certificates, bank details and other data given on Procura are confidential. The buyer uses them only for the procurement they were given for, and for the resulting purchase order, contract and payment. It limits access to the people who need them. It does not give them to another supplier or to a third party, other than its own advisers who are bound to confidentiality for that purpose. This duty continues after the RFQ ends. It does not apply to what the law requires the buyer to disclose.

D.10.2 Personal data

The names, telephone numbers and e-mail addresses of a supplier's staff that the buyer learns through Procura are used only for the transaction, and in line with the Personal Data Protection Law. They are not used for marketing or put on lists. A breach affecting personal data is reported without delay to Procura (security@procuraksa.com) and to the supplier concerned.

D.10.3 No scraping and no circumvention of controls

The buyer does not scrape or bulk-collect data from Procura, extract it by automated means, get round access controls or rate limits, or reverse-engineer the platform, as the Acceptable Use Policy provides. It does not use the supplier directory to contact suppliers for purposes unrelated to its own procurement.

D.10.4 Credentials

Each person uses their own account, tied to a named individual. Sign-in codes, sessions and Google sign-in are never shared or passed on. Suspected compromise of an account is reported at once to security@procuraksa.com.

D.10.5 Bank details

A supplier's bank details are used only to pay that supplier. A buyer does not act on a request, from anyone, to change them by e-mail or telephone. A change is made on the platform by the supplier, and it is held until Procura verifies it.

D.10.6 What the platform does to protect bids

Bids are encrypted when they are submitted. In the product, no Procura operator account has the permission to read bids, so in a sealed RFQ they stay closed until the opening time. Procura's own people may not look for another way round this. A buyer that believes it has happened reports it under section D.13.

D.11 Conduct on the platform

D.11.1 Accounts

One account belongs to one person. Logins are not shared. Roles and approval limits match what each person is authorised to do.

D.11.2 No circumvention

Where a transaction began on Procura, whether as an RFQ, an invitation, a clarification, a bid, a quotation request or an award, the buyer carries it through on Procura, so that the bid, award, purchase order, delivery and invoice are recorded there. It must not move the transaction away from the platform in order to avoid the audit trail, its own approval controls, the sealed-bid process or the other bidders. This rule does not restrict dealings that did not begin on Procura.

D.11.3 No fake RFQs, bids or accounts

The buyer does not issue an RFQ it does not mean to act on, does not create or use accounts in the name of suppliers, and does not enter bids in a supplier's name or through a related party in order to move prices.

D.11.4 Awards and purchase orders

An award is followed by a purchase order as the RFQ stated. A buyer does not cancel an awarded RFQ without a recorded reason, does not change the terms after award unless the supplier agrees through a change order on the platform, and does not use the award to extract a concession that was not part of the RFQ.

D.11.5 Payment expectations

Every RFQ and every purchase order states the payment term. The buyer pays a valid invoice on that term. A valid invoice is a proper tax invoice that matches the purchase order and the goods receipt. Where part of an invoice is disputed, the buyer pays the undisputed part on time and says in writing, within the term, what is disputed and why. The buyer does not make payment depend on a discount, a rebate or a favour that was not agreed in the purchase order, does not hold payment back as leverage, and does not change the term after award. The term itself is the buyer's commercial decision. This Code sets no number of days.

D.11.6 Faults in the platform

A buyer that finds an error or weakness in Procura that gives an unfair advantage or exposes data stops, does not use it, and reports it to security@procuraksa.com. It does not test the platform's security without written permission.

D.11.7 Honest ratings

Ratings given to suppliers after an order is paid are honest and based on facts. Suppliers rate buyers on the clarity of the specification, the stability of the scope, responsiveness, conduct, payment timing and conduct in disputes, and this Code is the standard for those ratings.

D.12 Duties specific to buyers

D.12.1 Clear specifications

An RFQ states what is wanted in terms a supplier can price: quantities, specification, standards, delivery place and date, the evaluation criteria and their weights, the payment term, the gifts and hospitality limit, and the date and time of the deadline.

D.12.2 Equal information

Every invited bidder gets the same information at the same time. A question from one bidder is answered to all. The platform publishes every answer to every bidder and does not name the person who asked, and the buyer answers through that channel, not privately.

D.12.3 No reverse-engineering of suppliers' prices

The buyer does not use one supplier's price, cost structure or terms to build an alternative, to press another supplier, or to tell a third party what the first supplier offered. It does not ask bidders to disclose their cost breakdown beyond what the RFQ stated.

D.12.4 Evaluate on the stated criteria

Bids are evaluated against the criteria and weights stated in the RFQ, by evaluators who have declared any conflict. Scores are recorded. In a two-envelope RFQ the technical score is given before prices are opened and is not changed afterwards.

D.12.5 Award justification and feedback

The award records the reason for the choice, especially when it is not the lowest price. Procura issues unsuccessful bidders a debrief showing their rank, the gap band and the deciding factor, and never the winner's price or name. The buyer gives further helpful feedback to unsuccessful bidders on request, without disclosing another bidder's confidential information.

D.12.6 No bad-faith RFQs

The buyer issues an RFQ only when it intends to buy, or says clearly in the RFQ that it is a market sounding. It does not use an RFQ to collect free design or advice, to learn competitors' prices, or to pressure a supplier it already has.

D.12.7 Change, disputes and returns

The buyer changes quantities, specifications, prices or dates through a change order on the platform. It raises disputes and returns through the platform in good faith, keeps to the facts, and takes part fairly in mediation.

D.12.8 No retaliation

The buyer does not penalise a supplier for asking a clarification question, for declining to bid, for raising a dispute, or for reporting a concern.

D.12.9 Protect supplier data

The buyer protects supplier data under section D.10, and tells Procura promptly if it learns that it has been lost, disclosed or misused.

D.13 How to report a concern

Anyone may report a concern about conduct on Procura, or a breach of this Code or of its companion Code, to ethics@procuraksa.com. That includes a supplier, a buyer, a user, a sub-supplier, an employee and a member of the public.

D.13.1 What to report

• suspected bribery, or a gift or hospitality that breaks the rules;
• a conflict of interest that was not disclosed;
• bid rigging, cover bids or price signalling;
• a leaked bid, price or other confidential information;
• a false document, a false claim or a fake account;
• an attempt to take a transaction off the platform to avoid the record;
• forced or child labour, or unsafe conditions, in a supply chain;
• misuse of personal data or of another person's account;
• retaliation for a report, a question or a complaint; and
• anything else that conflicts with this Code.

D.13.2 What to include

What happened, when, the RFQ, bid, purchase order or invoice number, who was involved, and any document or message that shows it. A report may be made without giving a name. Procura then cannot ask follow-up questions, and a report with little detail may be hard to act on.

For a security vulnerability, write to security@procuraksa.com. For a request about personal data, write to privacy@procuraksa.com.

D.13.3 Confidentiality

A report is seen only by the people who need it to assess it and act on it. Procura does not tell the person reported who made the report, and protects the reporter's identity as far as the law allows. The law or an authority may in some cases require disclosure.

D.13.4 No retaliation

Procura does not allow retaliation against anyone who reports a concern in good faith or who helps a review, whether or not the concern proves right. Retaliation includes ending business, dropping a supplier from invitations, lowering a rating, threats, and any other disadvantage. Retaliation is itself a serious breach of this Code, by a buyer or by a supplier. A person who reports in good faith does not lose standing, invitations or ratings on Procura because of it. A report that is knowingly false, or made in bad faith, is also a breach.

D.13.5 Authorities

Nothing in this Code stops anyone from reporting to a competent authority, such as the Oversight and Anti-Corruption Authority (Nazaha), the General Authority for Competition or the Saudi Data and AI Authority (SDAIA).

D.13.6 What Procura does with a report

Procura reads each report, decides whether it falls within its role, and applies the same standard whatever the size of the customer concerned. It tells the reporter the outcome where it can do so without harming confidentiality. Procura sets no fixed reply period in this version; the period is an open point for counsel.

Today the channel is a monitored mailbox. A "report a concern" form inside the platform, with a case number, is planned.

D.14 How Procura responds

D.14.1 A graduated response

Procura's response is proportionate. It looks at how serious the breach is, whether it was deliberate, whether it was repeated, the harm done, and how the person or organisation cooperates. The steps below are a ladder, not a fixed order: a serious breach can start higher up, and a step can be skipped.

Procura may also ask for corrective action, such as correcting data, withdrawing a false bid or returning an improper benefit, and may record the outcome in the account's history. Suspension may be applied before a full review where that is needed to stop serious harm, for example fraud, bribery, forged documents or a security risk; the notice then follows at once.

D.14.2 Fair process

Before a decision that restricts an account, Procura tells the person or organisation in writing what is alleged and which section of this Code applies, and gives a reasonable period, stated in the notice and suited to the case, to respond and to provide documents. Procura considers the response and gives its decision in writing with reasons. The decision can be challenged by writing to ethics@procuraksa.com; the challenge is reviewed by a person who took no part in the first decision.

Procura is not a court. It does not decide contract claims between a buyer and a supplier: the purchase order is theirs, and the dispute function of the platform is available to them. A decision under this Code does not limit any right under the law or a contract, or any action by an authority.

D.14.3 What the platform can do today, and what is planned

D.15 Meaning of some terms

Part E: Privacy and Data Processing

E.1 Privacy Policy

E.1.1 Introduction

This Privacy Policy explains how xxxxxxx ("Procura" or "we") collects, processes, uses, stores, discloses and protects Personal Data when you use the Procura website, its applications, the Platform, the procurement services, the Supplier services, the support channels and related services.

This Policy has been prepared in line with the applicable Saudi laws and regulations, including the Personal Data Protection Law and its Implementing Regulations, as applicable.

E.1.2 Responsible Entity

Legal name: xxxxxxx
Commercial Registration: xxxxxxx
Address: xxxxxxx
Website: https://www.procuraksa.com
Privacy contact: privacy@procuraksa.com

This contact point receives and responds to privacy requests and enquiries relating to the protection of Personal Data.

Where the law requires the appointment of a data protection officer, Procura will appoint the appropriate officer in accordance with the legal requirements.

E.1.3 Procura's Capacity: Controller or Processor

Depending on the nature of the activity, Procura may act as follows:

E.1.3.1 Controller

Where Procura determines the purposes and means of processing Personal Data relating to its own activities, such as:

• account management;
• Platform security;
• billing;
• customer service;
• legal obligations;
• service management;
• direct marketing in the cases where it is permitted.

E.1.3.2 Processor

Where Procura processes Personal Data on behalf of the Buyer or the Supplier and in accordance with its instructions.

The capacity is determined according to the nature of the processing and the relevant agreement.

E.1.4 Data We May Collect

Depending on how you use the Platform, we may collect:

E.1.4.1 Identity data

• name;
• job title;
• organization;
• job role.

E.1.4.2 Contact data

• email address;
• phone number;
• business address;
• communication preferences.

E.1.4.3 Account data

• login credentials;
• account settings;
• language;
• preferences;
• authentication records.

E.1.4.4 Organization data

• company name;
• Commercial Registration;
• tax number;
• address;
• authorized signatories' data.

E.1.4.5 Procurement data

• purchase requests;
• requests for quotations;
• Supplier quotations;
• purchase orders;
• contracts;
• invoices;
• delivery data;
• ratings;
• correspondence.

E.1.4.6 Financial and commercial data

Where needed:

• banking data;
• invoice data;
• subscription data;
• payment data.

E.1.4.7 Technical data

• IP address;
• device type;
• browser;
• operating system;
• system logs;
• security and authentication logs.

E.1.4.8 Organization verification data

The Commercial Registration number and the corresponding registration data (legal name, status and dates), when the live-check service with a commercial registry data provider is activated. This service is planned and is not activated in this version, and nothing is currently sent to any provider.

E.1.4.9 Proof and audit data

The fingerprint-linked audit trail (actions, approvals and consents, with the time and the user identifier), the records of acceptance of legal documents with their fingerprints, and the evidence packs exported by authorized users.

Procura adheres to the principle of data minimization and does not collect Personal Data that is not necessary for the specified purpose, in accordance with the relevant legal requirements.

E.1.5 Sensitive Data

Procura does not aim to collect Sensitive Personal Data except where there is a legitimate and lawful need to do so.

The user must not enter Sensitive Data in procurement records unless it is necessary and its processing is lawfully permitted.

E.1.6 Purposes of Processing

Personal Data may be processed for purposes that include:

• Creating and managing accounts.
• Authentication.
• Operating procurement processes.
• Connecting Buyers with Suppliers.
• Managing requests for quotations.
• Receiving quotations.
• Managing subscriptions.
• Billing.
• Customer service.
• Platform security.
• Preventing fraud and misuse.
• Records and audit.
• Verifying organization and Commercial Registration data, when this service is activated.
• Compliance with laws.
• Dispute resolution.
• Performance of agreements.
• Developing and improving the services.
• Operational notifications.
• Direct marketing in the cases where it is permitted.

The purposes of collecting data must be directly related to the purposes of the entity, and the data must not be processed in a manner that conflicts with the purpose for which it was collected, except in the cases permitted by law.

E.1.7 Legal Basis for Processing

Personal Data is processed in the cases permitted under the Personal Data Protection Law and its Implementing Regulations, which may include:

• the consent of the Data Subject;
• performance of contractual obligations;
• compliance with legal obligations;
• legitimate interests in the permitted cases;
• protection of vital interests;
• any other basis permitted by law.

Where consent is the basis, it is documented and the Data Subject is enabled to withdraw it in accordance with the legal requirements.

E.1.8 Information at the Time of Collection

When collecting Personal Data, Procura will provide, as required by law, the information relating to:

• the identity of the entity;
• the means of contact;
• the purpose;
• the legal basis;
• the mandatory and optional data;
• the retention period or the criteria for determining it;
• the rights of the Data Subject;
• the method of withdrawing consent;
• the parties to whom disclosure may be made;
• transfer or processing outside the Kingdom, where applicable.

These elements are consistent with the requirements of the right to be informed set out in the Law and the Implementing Regulations.

E.1.9 Disclosure of Data

Data may be disclosed to the following parties where necessary and to the extent permitted:

• the relevant Buyer;
• the relevant Supplier;
• authorized users within the organization;
• technical service providers;
• hosting providers;
• payment providers;
• communications providers;
• advisers and professional bodies;
• government bodies;
• judicial or competent authorities where required by law.

E.1.10 Sharing of Buyer and Supplier Data

The nature of the Platform requires the sharing of certain organization and user data between the Buyer and the Supplier in order to carry out procurement processes.

The data may include:

• organization name;
• professional contact data;
• Supplier profile;
• quotations;
• requests for quotations;
• purchase orders;
• delivery data;
• invoice data.

Sharing takes place in accordance with access permissions, the Platform settings and the applicable laws.

E.1.11 Service Providers

Procura may use other parties to provide services such as:

• hosting;
• infrastructure;
• cybersecurity;
• email;
• text messaging;
• authentication;
• payment;
• document storage;
• technical support;
• monitoring and analytics.

Procura takes appropriate contractual and technical measures in accordance with the legal requirements.

E.1.12 Transfer of Personal Data Outside the Kingdom

If the operation of a particular service requires transferring or making Personal Data available outside the Kingdom, Procura complies with the requirements and controls relating to the transfer of Personal Data outside the Kingdom.

The safeguards may include, depending on the case:

• standard contractual clauses;
• binding common rules;
• assessment of transfer risks;
• data minimization;
• security controls;
• any other safeguards permitted by law.

The Saudi regulations govern the transfer of Personal Data outside the Kingdom and specify the required safeguards and assessments in the relevant cases.

The Platform is currently hosted with a managed cloud infrastructure provider in the European Union (Frankfurt, Germany), that is, outside the Kingdom, and hosting inside the Kingdom is planned. The current Sub-processors and their locations are listed in the Sub-processors Schedule.

Procura does not claim that all data is hosted inside the Kingdom unless that is actually the case.

E.1.13 Information and Data Security

Procura applies appropriate technical and organizational measures to protect data, which may include:

• encryption;
• access control;
• multi-factor authentication;
• logging and monitoring;
• network protection;
• vulnerability management;
• backup;
• incident response procedures.

It cannot be guaranteed that any electronic system is absolutely immune from all risks.

E.1.14 Incidents and Personal Data Breaches

Procura applies procedures to detect, contain, investigate and remediate security incidents.

Where the legal notification requirements apply, Procura complies with the procedures and deadlines specified in the Personal Data Protection Law and its Implementing Regulations.

The Implementing Regulations provide for notifying the competent authority of qualifying Personal Data breaches within a period not exceeding 72 hours from the time of becoming aware of the incident, subject to the conditions specified in the Regulations.

Procura adopts a documented internal incident procedure, in which the period starts from the moment any of its personnel becomes aware of the incident and not from the moment it is confirmed, and in which every event and the decision on it is recorded even if it is not notified. Where Procura acts as a Processor, it notifies the Controller without undue delay. There is currently no automated incident detection and no automated timer for the period, and the incident register is kept manually.

E.1.15 Data Retention

Procura retains Personal Data for the period necessary to achieve the purpose for which it was collected or for the period required by laws and contractual obligations.

The retention period may vary depending on:

• account status;
• the contractual relationship;
• procurement records;
• accounting requirements;
• tax requirements;
• audit requirements;
• disputes;
• legal requirements.

When the legal or operational need for the data ends, Procura takes appropriate measures to delete, destroy or anonymize it in accordance with the legal requirements.

The Retention Schedule sets out the data categories, the periods and the proposed action for each. These periods are proposals that have not yet been approved by the owner or by legal counsel, and Procura does not carry out any deletion or anonymization of Customer data under them before they are approved.

E.1.16 Rights of Data Subjects

In accordance with the applicable laws and regulations, the rights of the Data Subject may include:

• the right to be informed;
• the right to access the data;
• the right to obtain a readable copy;
• the right to request correction;
• the right to complete or update the data;
• the right to request destruction when the data is no longer necessary;
• the right to withdraw consent where consent is the legal basis;
• the right to file a complaint;
• other rights established by law.

The Saudi personal data protection framework recognizes these rights subject to the legal controls and exceptions.

E.1.17 How to Exercise Rights

Privacy requests may be sent to:

Email: privacy@procuraksa.com

The request should include, as far as possible:

• name;
• organization;
• contact details;
• type of request;
• the information necessary to verify identity.

Procura may request reasonable verification information before carrying out the request in order to protect the data from unauthorized disclosure.

Procura responds to requests within the period set by the laws and keeps a record of each request and its decision. Where Procura processes data as a Processor on behalf of the Customer, it refers the request to the Controller and informs the requester accordingly.

E.1.18 Data Accuracy

The user is responsible for updating their Personal Data and their organization's data.

Procura takes appropriate measures to maintain the accuracy of data in accordance with the legal requirements.

E.1.19 Direct Marketing

Procura may use contact data to send:

• Platform updates;
• new services;
• events;
• educational content;
• commercial offers;

within the limits permitted by law.

Where consent is required, it will be obtained in accordance with the legal requirements, with an appropriate means provided to unsubscribe or manage preferences.

E.1.20 Cookies

Procura may use cookies and similar technologies for purposes of:

• authentication;
• security;
• Platform operation;
• preferences;
• analytics;
• performance improvement.

Procura may issue a separate cookies policy.

E.1.21 Children

The Procura Platform is intended for commercial and institutional use and is not directed at children.

Procura does not aim to collect Personal Data from children for independent use of the Platform.

E.1.22 Third-Party Links

The Platform may contain links to external websites or services.

Procura is not responsible for the privacy policies or practices of third parties.

E.1.23 Changes to the Privacy Policy

Procura may amend this Policy from time to time.

The effective date of the new version will be stated, and the user will be notified of material changes through appropriate means where this is required.

E.2 Data Processing Addendum

E.2.1 Purpose

This Addendum applies where the Procura Platform acts as a Processor of Personal Data on behalf of the Customer, who is the Buyer or the Supplier as the case may be, and who acts as the Controller.

This Addendum forms part of the Buyer Agreement or the Supplier Agreement, as the case may be, and its provisions prevail on the subject of data protection over any general provision that conflicts with it.

The Implementing Regulations require, when a Processor is selected, that the agreement include the purpose of processing, the categories of data, the duration of processing, the breach notification obligations and certain other requirements, and they also regulate Sub-processors.

E.2.2 Roles of the Parties

The Customer (the Buyer or the Supplier): the Controller.

Procura: the Processor, within the limits of the data it processes on behalf of the Customer.

This does not prevent Procura from acting as an independent Controller for account, billing, security and compliance data and other processing whose purposes and means Procura determines independently.

E.2.3 Subject Matter of Processing

The processing includes, depending on the service:

• account management;
• user management;
• procurement;
• Suppliers;
• RFQs;
• quotations;
• contracts;
• purchase orders;
• invoices;
• receiving;
• reports;
• communications;
• support.

E.2.4 Duration of Processing

Processing begins when the service is activated and continues throughout the term of the Agreement, after which the data is deleted or returned in accordance with the Customer's instructions, unless retention is required by law or necessary to establish a right or obligation.

E.2.5 Categories of Data Subjects

These may include:

• the Customer's employees;
• Supplier representatives;
• Supplier employees;
• business customers;
• contact persons;
• users;
• transaction counterparties.

E.2.6 Categories of Data

These may include:

• name;
• job title;
• contact details;
• account data;
• login records;
• transaction data;
• billing data;
• bank account data where needed;
• professional data;
• technical location data;
• document data.

Sensitive Data may not be processed unless this is necessary, lawfully permitted, and specified in the Customer's instructions or the Agreement.

E.2.7 Controller's Instructions

Procura undertakes to process the data in accordance with:

• the Agreement;
• this Addendum;
• the Customer's lawful instructions;
• the legal requirements.

If Procura believes that the Customer's instructions violate the law, it may notify the Customer of this before carrying them out, where this is permitted by law.

E.2.8 Confidentiality

Procura's employees and the persons authorized to access the data are bound to maintain its confidentiality.

E.2.9 Security of Processing

Procura applies appropriate measures that include, depending on the nature of the processing:

• access control;
• encryption;
• backup;
• account management;
• event monitoring;
• vulnerability management;
• incident response plans.

E.2.10 Sub-processors

Procura may use Sub-processors where needed to provide the service.

Procura selects the Sub-processor according to appropriate protection criteria.

It ensures that the Sub-processor is contractually bound to an appropriate level of protection.

The list of current Sub-processors and their locations is published in the Sub-processors Schedule. Procura applies a notification and objection mechanism wherever it is required under the Agreement or the law. The Implementing Regulations set out specific requirements and safeguards when engaging a sub-processor.

E.2.11 Data Breach

Upon discovering an incident that may affect the Personal Data that Procura processes on behalf of the Customer:

• Procura secures the systems.
• It limits the impact of the incident.
• It investigates the event.
• It documents it.
• It notifies the Controller without undue delay.
• It provides the available information necessary to assess the incident.
• It cooperates with the Controller in the notification and remediation procedures.

The Controller remains responsible for the legal notifications that fall on it, unless the law provides otherwise.

E.2.12 Rights of Data Subjects

Procura assists the Customer, within reasonable limits, in responding to Data Subject requests relating to access, correction, updating, destruction or other rights established by law.

E.2.13 Transfer of Data Outside the Kingdom

If performing the service requires transferring data or making it available from outside the Kingdom, Procura complies with the legal requirements for the transfer of Personal Data outside the Kingdom and the necessary safeguards.

The safeguards may include contractual measures or other mechanisms established by law, depending on the case.

E.2.14 Return and Destruction of Data

Upon termination of the service, Procura returns the data or deletes it at the Customer's election, unless there is a legal obligation to retain it.

Destruction is carried out in a manner that prevents unlawful re-access to the data.

E.2.15 Audit and Information

Procura provides the Customer with the reasonable information necessary to demonstrate compliance with this Addendum, having regard to the protection of its trade secrets, the security of its systems and the rights of other customers.

E.3 Cookie Policy

E.3.1 Purpose

Procura uses cookies and similar technologies to operate the Platform, remember Users' preferences, enhance security, understand use of the service and improve performance.

E.3.2 Types of Cookies

A. Necessary:
Required for login, authentication, security and the operation of core functions.

B. Functional:
Remember settings and preferences.

C. Analytics:
Help in understanding site usage and performance.

D. Marketing:
May be used when marketing tools are enabled, to the extent permitted by law and subject to the User's consent.

E.3.3 Third-Party Cookies

Procura may use third-party services, such as analytics, support or communications tools.

The use of those services is subject to the policies of the parties concerned, and Procura remains bound by the legal requirements relating to Personal Data.

E.3.4 Control

The User may manage cookies through browser settings or the preference management tool provided by Procura.

Disabling necessary cookies may cause some Platform functions not to work.

E.3.5 Updating the Policy

This Policy may be updated when new technologies or services are added.

Part F: Schedules

F.1 Schedule of Free Core Buyer Access

F.1.1 Scope of Free Core Buyer Access

A Buyer uses the Platform without a subscription, without a fee for receiving invoices and without any commission on the value of an Award. Free Core Buyer Access covers the requisition, budget, approval, Purchase Order, receiving, invoice-review and dispute workflows within the limits below. The figures are generated from the same catalogue that the pricing page and the Platform use, so that they cannot differ.

A limit marked "enforced" pauses new use when it is reached. A limit marked "measured" is counted and reported, and reaching it starts a capacity review, and nothing is blocked or deleted. A limit marked "planned" is not yet counted by the Platform.

F.1.2 What happens at a limit

When a limit is reached, the rule on fees in the Agreement applies: work in progress, correspondence, records and corrective documents continue unchanged, and only new discretionary use pauses, with a route to ask for a capacity review. No paid plan is activated for a Buyer automatically, and a wider scope needs the express written agreement of both Parties. A Buyer that wants more than the published scope can ask Procura for a capacity review through the contact points in this Pack.

F.1.3 Fair use

Free Core Buyer Access is for a Buyer's own procurement. A Buyer shall not use it to resell the Platform or access to it, to collect Suppliers' prices or contact details for any purpose other than its own procurement, to split one legal organisation into several in order to obtain more than the published scope, or to publish RFQs in bulk by automated means. Procura may ask a Buyer for information about the organisation and its use so as to apply these rules, and may apply the clause on suspension in the Agreement where they are breached (open point OP-15).

F.2 Sub-processors Schedule

F.2.1 What this page is

Procura uses a small number of outside providers to run the platform. Where a provider handles personal data on Procura's behalf, it acts as a sub-processor under the Data Processing Addendum. This page lists the providers that are in use today, what each does, what data it sees and where, and says plainly which services are not used.

F.2.2 Providers in use

F.2.3 Services not used

The platform's code can be set up to use other providers for e-mail, SMS and payments. None of them is switched on. This page is updated before any is.

F.2.4 Where data goes

Personal data held on the platform is stored with Render in Frankfurt, so it is held outside the Kingdom. Hosting inside the Kingdom is planned. E-mail passes through SendGrid, and Google sees a visitor's IP address when fonts load and the sign-in request when a person uses Google sign-in. The Privacy Policy and the Data Processing Addendum say how personal data is protected, including when it is transferred abroad.

F.2.5 Changes to this list

The list changes when the platform changes. Before a new provider handles personal data, or before any service in section F.2.3 is switched on, Procura updates this page and gives notice to organisation administrators, by e-mail or in the platform. An organisation that objects can write to privacy@procuraksa.com, and the Data Processing Addendum says what follows. Earlier versions of this page are kept and are available on request. Today the notice is given by hand. An automatic notice is planned.

F.3 Retention, Requests and Incident Schedule

F.3.1 Retention schedule (proposed)

The periods below are proposals. They have not been approved by the owner of Procura or by counsel, and they do not state what any law requires. Until they are approved, Procura deletes or anonymises no customer or personal data under them, and during the pilot no customer or personal data is deleted. The only deletions that take place are the operational clean-ups marked "technical", which the Platform already performs on its own. Once the schedule is approved, the Platform will enforce it class by class, and a class may be switched off by keeping its records (open point OP-10).

The audit trail is never purged, because each entry's hash covers the one before it. Procurement, financial and account records are kept by design, and the period after the relationship ends is for counsel to confirm. A legal hold, a pending dispute or a request from a competent authority suspends any deletion. The period during which a Customer may obtain a copy of its data after termination is not yet set (open point OP-21).

F.3.2 Requests about Personal Data

A Data Subject may send a request about access, a copy, correction, completion, destruction or withdrawal of consent, or a complaint, to the privacy contact in this Pack. Procura acknowledges the request, verifies the identity of the person and, for an organisation's data, that the person is its administrator, and records the request and its outcome in a log. Where Procura is the Controller it answers the request itself; where it is the Processor for a Customer it passes the request to the Customer and tells the person. Procura answers within the period the law sets, and a request that is refused in whole or in part is first reviewed by counsel (open point OP-09).

F.3.3 Incident procedure

Procura keeps a written procedure for incidents involving Personal Data. The clock for notification starts when anyone at Procura becomes aware of the incident, not when it is confirmed. The steps are to detect and report at once, contain the incident without destroying evidence, assess it (what data, whose, how many, where, whether it was encrypted) within 24 hours of awareness, notify the competent authority within the period the law sets where notification is required, tell the affected Controllers and people without undue delay, record every incident and the decisions taken, and review its causes afterwards. Procura has no automatic detection or timer in this release, and the incident log is kept by hand.

F.4 Contact points

Procura is xxxxxxx, commercial registration no. xxxxxxx, whose registered address is xxxxxxx. Its website is https://www.procuraksa.com. The addresses below are the contact points that Procura publishes for these purposes, and no other channel is promised in this release.

Procura aims to reply to operational support enquiries within one business day. That is an aim and not a commitment, and the periods for Personal Data requests, reports and decisions are those set out in the Part that deals with each of them.