Vendor Pack

Document control

What you are accepting

• One agreement with Procura for your organisation: Part A (the Agreement), Part B (platform terms), Part C (acceptable use), Part D (Code of Conduct for Suppliers), Part E (privacy and data processing) and Part F (plans and schedules).
• Exactly three annual Plans, paid in advance and shown before VAT, preceded by a free trial of 14 days from first use. There is no commission on awards and no automatic overage. The limits and prices are in Part F. An upgrade is prorated by the days remaining, and a downgrade takes effect at renewal.
• Cancellation and refunds: a reserved clause pending counsel's review (OP-12). The Pack creates no right to a refund and removes none that the law gives.
• A Buyer may sponsor your Plan with your consent. That gives the Buyer no effect on your ranking or on the evaluation of your Quotations, and it is disclosed in the evaluation of the RFQs that Buyer runs.
• Procura is a software and records provider: it is not a party to your contracts with Buyers, holds no money, does not issue ZATCA e-invoices and does not yet run a live commercial-registry check.
• A Purchase Order that arises from an Award stays held until both parties have signed the Contract through the Platform, and nobody reads your Sealed Quotations before the opening time. You follow the Code of Conduct (integrity, no collusion, accurate information).
• Personal Data: Procura is the Controller of account, billing and security data and the Processor of your procurement data. The Platform is hosted in the European Union (Frankfurt), outside the Kingdom. The retention periods in this draft are proposals and are not yet approved.
• This is a draft pending counsel review. Your acceptance records your name, organisation and role, the version of the Pack and its SHA-256 fingerprint, the time, and your network address and browser. If you disagree, do not accept, and write to the legal contact.

Part A: The Agreement

A.1 Parties to the Agreement and the Pack

This Agreement, and every other Part of this Pack, is entered into electronically between:

First Party: the Procura Platform

Legal Name: xxxxxxx
Commercial Registration No.: xxxxxxx
Unified No.: xxxxxxx
VAT No.: xxxxxxx
Registered Address: xxxxxxx, Kingdom of Saudi Arabia
Official Email: xxxxxxx

referred to as "Procura".

Second Party: the Supplier

The Supplier is the organisation registered on the Platform as a supplier. Its identity (legal name, commercial registration or licence number, VAT number, address, authorised representative and email) is taken from the registration and verification data held in the acceptance record at the time this Pack is accepted. The Pack is accepted by a person authorised to bind the organisation, and it applies to the organisation and to its Authorized Users.

Procura and the Supplier are together the "Parties" and each is a "Party".

A.2 Purpose of the Agreement

Procura makes available to the Supplier a digital platform to display its services and products, receive RFQs, submit Quotations, manage its documents and data, communicate with Buyers and manage related commercial operations.

The Supplier acknowledges that Procura is not a party to any sale, supply or service contract that may arise between the Supplier and any Buyer, unless there is a separate and express agreement to the contrary.

A.3 Interpretation and Defined Terms

The following definitions apply in every Part and Schedule of this Pack, and a defined term has the same meaning wherever it appears.

A.3.1 The documents of the Pack and their names

The documents that were previously separate are merged in this Pack. Wherever any Part refers to one of them by name, the reference is to the place shown below:

A.3.2 Rules of interpretation

• Headings are for convenience and do not affect interpretation, and "including" does not limit.
• A reference to a Part, clause or Schedule is to a Part, clause or Schedule of this Pack, and clause numbers are written with a Latin letter and Western digits (for example B.3).
• Every period is counted in calendar time by Riyadh time unless stated otherwise, and amounts are in Saudi riyals and before VAT unless stated otherwise.
• A reference to a law or regulation is to it as amended or replaced.
• A clause marked "reserved" is not yet settled: it creates no right and removes none until it is completed after counsel's review, and the open point it refers to is named.
• Where the Parts of the Pack conflict, the order in the clause on the order of precedence in Part A applies.

A.4 Supplier Authority and Accuracy of Information

The Supplier represents and warrants that:

• its entity is legally established;
• the data it has provided to Procura is accurate and up to date;
• the person accepting this Agreement is authorized to bind the Supplier;
• it holds the licenses required for its business;
• it is permitted to sell or provide the products and services it offers;
• its documents, certificates and permits are authentic and valid; and
• it shall update its data promptly upon any material change.

A.5 Electronic Acceptance

The Supplier is deemed to have agreed to this Agreement upon:

• clicking "I Agree";
• electronic signature;
• entering a verification code;
• account activation; or
• use of the Platform services after the Agreement has been presented.

The Supplier acknowledges that Procura's electronic record of acceptance, including the time of acceptance, the User's identity, the means of verification and the login record, may be used as evidence of acceptance of the Agreement to the extent permitted by law.

A.6 Supplier Subscription

The Supplier uses the Platform in accordance with the plan it has selected, and the prices and limits are detailed in the Schedule of Supplier Plans and Fees.

The fees are in accordance with the prices in force at the time of subscription or the Service Order.

Under Procura's approved commercial model, the Supplier's fee is a subscription for use of the Platform and does not constitute a commission on the value of an Award, unless otherwise agreed in writing.

Yearly Supplier plans (Essential, Growth, Enterprise):
The subscription is yearly and paid in advance at the yearly amount shown on the pricing page at the time of the order for the selected plan, before VAT. A monthly equivalent that may be shown beside it is the yearly amount divided by twelve and is not a monthly payment option.

The first yearly subscription is preceded by a free trial of 14 days, as shown on the pricing page at the time of the order, which starts at the Supplier's first RFQ invitation, first quote request or first Quotation submitted, and has the capacity of the Essential plan. Nothing is charged to the Supplier automatically at the end of the trial and nothing renews because of it: the Supplier chooses a plan and expressly accepts an invoice summary showing the amount before VAT, the VAT and the total; payment is currently made by bank transfer against an invoice issued by Procura; Procura records the payment when receipt is confirmed and amounts are not collected through a payment gateway; the paid yearly subscription does not begin until receipt of payment is confirmed, whereupon the twelve-month term begins and the allowances start once.

After the paid term Procura issues a yearly renewal invoice, unless the Supplier stops renewal before the term ends or the subscription has ended under the termination provisions. The Supplier may upgrade its plan during the term by paying the difference between the yearly price it actually paid and the yearly price of the new plan, in proportion to the days of the term remaining; the yearly allowances rise in the same proportion and the renewal date does not change. A downgrade takes effect at renewal only, once the Supplier's use is within the limits of the smaller plan, and no record is deleted. Invoice top-up packs are sold on express request at the displayed price, expire at the end of the subscription year, and no automatic overage charge is imposed.

Within the plan's limits (users, catalogue listings, new responses to RFQs, issued invoices and storage), new discretionary use pauses at the limit; invoices on orders already committed, corrective documents and replies in disputes are never stopped or charged, and are recorded for review. Features planned for the future are shown on the pricing page as not yet available.

A Buyer may pay a Supplier's plan with the Supplier's consent; the only effect is on the person to whom the subscription invoice is addressed, and it gives no ranking and no verification badge and has no effect on the Supplier's qualification or the evaluation of its Quotations, and it is disclosed in the evaluation record of the RFQs run by the sponsoring Buyer in which the Supplier submits Quotations.

A Supplier that entered into a subscription before version 1.2 under one of the earlier plans (Starter, Growth or Partner) may remain on the earlier version of the price, limits and term until its term ends or until the Parties agree in writing to move it, with no silent change to its price, limits or invoices and no second charge for it.

VAT is added at the rate shown at the time of the order.

**Cancellation and refund: a reserved clause pending review by legal counsel (open point OP-12).** This version does not contain a final rule on cancellation of a paid yearly subscription before the end of its term or on refund of any amount of it. Until this rule is completed, this Agreement neither creates a right to a refund nor excludes a right provided by law, and any request for cancellation or refund shall be dealt with in writing in accordance with applicable laws and what is stated in the Service Order.

A.7 No Award Guarantees

The Supplier expressly acknowledges that:

• the subscription does not guarantee that it will obtain any purchase order;
• it does not guarantee the number of invitations;
• it does not guarantee the number of tenders;
• it does not guarantee the value of sales;
• it does not guarantee winning any RFQ; and
• its membership does not constitute a commercial endorsement by Procura.

A.8 Supplier Information

The Supplier remains the owner of its business information, data and documents, while granting Procura the right to use them to the extent necessary:

• to create the commercial profile;
• to make the Supplier available to Buyers;
• to send RFQs;
• to process Quotations;
• to verify information;
• to prevent fraud;
• to operate the Platform;
• to provide support; and
• to comply with laws.

A.9 Accuracy of Products and Services

The Supplier is fully responsible for:

• the product description;
• the specifications;
• the quality;
• the price;
• the quantities;
• the availability;
• conformity certificates;
• licenses;
• warranties;
• delivery dates;
• the taxes and fees that apply to it; and
• any legal obligations relating to its business.

Procura bears no responsibility for the accuracy or quality of any product or service provided by the Supplier.

A.10 Quotations

The Supplier must submit Quotations that are:

• accurate;
• clear;
• capable of performance;
• not misleading; and
• compliant with the laws.

The Supplier may not submit a price or Quotation that it knows it is unable to perform with the intent of affecting competition.

A.11 Confidentiality of RFQs

The Supplier undertakes to maintain the confidentiality of:

• RFQs;
• the Buyer's specifications;
• the Buyer's data;
• competitors' prices;
• technical information; and
• confidential documents.

The Supplier may not copy, publish or use this information outside the purpose for which it was provided.

A.12 Prohibition of Collusion and Manipulation

The Supplier is prohibited from:

• agreeing with another supplier to fix prices unlawfully;
• submitting sham Quotations;
• secretly coordinating with competitors;
• manipulating prices or data;
• attempting to unlawfully influence the Buyer's employees;
• providing misleading information;
• creating multiple accounts to circumvent competition;
• using the Platform to circumvent procurement procedures;
• offering unlawful benefits, commissions or gifts; and
• colluding with any User, employee or other party.

A.13 No Circumvention of the Platform

The Supplier may not use information it obtains from the Platform to communicate with the Buyer for the purpose of bypassing the Platform's mechanism or avoiding the fees due to it, where this is intended to circumvent the Agreement or the agreed commercial model.

This clause does not prevent independent commercial relationships that were lawfully formed outside the Platform, unless that relationship is itself based on confidential data or information obtained by the Supplier through the Platform with the intent to circumvent.

A.14 Contractual Relationship with the Buyer

Any contract, Purchase Order or supply agreement between the Supplier and the Buyer is considered an independent relationship between them.

The Supplier is responsible for performing its obligations under that contract.

Procura bears no responsibility for:

• the Buyer's non-payment;
• the Buyer's delay;
• rejection of the product;
• differences in specifications;
• commercial disputes;
• warranty claims; and
• taxes or fees specific to the transaction.

A.15 Supplier's Legal Obligations

The Supplier shall comply with all laws and regulations applicable to its business, including, depending on the nature of the business, commercial, tax, labor, environmental and sector-specific laws and consumer protection, competition, and anti-bribery and anti-corruption laws.

A.16 Intellectual Property

The Supplier remains the owner of its trademarks, content and documents.

The Supplier grants Procura a limited, non-exclusive license to use the Supplier's name, logo and commercial information to the extent necessary to provide the Platform services and to display the Supplier's profile to Buyers.

Procura has no right to sell or transfer ownership of the Supplier's trademark.

A.17 Customer and Buyer Data

The Supplier shall use the Buyer's data only to carry out the commercial transaction through which it obtained it.

The Supplier is prohibited from:

• selling the data;
• reusing it for unauthorized purposes;
• sharing it with a third party without justification;
• using it for unauthorized marketing; and
• retaining it for longer than necessary.

The requirements of the Personal Data Protection Law (PDPL) and related regulations apply to Personal Data.

A.18 Security and the Account

The Supplier is responsible for:

• protecting its account;
• passwords;
• Users;
• devices;
• permissions; and
• preventing unauthorized access.

The Supplier shall notify Procura immediately upon suspecting a breach or misuse.

A.19 Verification of the Supplier

Procura may request:

• the commercial registration;
• the VAT certificate;
• licenses;
• quality certificates;
• product certificates;
• bank account details;
• beneficial owner details, where necessary; and
• any other documents necessary for verification.

Procura may suspend or restrict the account until verification is completed.

A.20 Suspension or Removal of the Supplier

Procura may suspend or close the Supplier's account in the event of:

• providing false information;
• expiry or revocation of a license;
• fraud;
• tender manipulation;
• collusion;
• breach of this Agreement;
• infringement of third-party rights;
• threatening the security of the Platform;
• non-payment of fees; and
• violation of the law.

Procura may take urgent measures where there is a security or legal risk.

A.21 Fees and Taxes

Subscription Fees are due in accordance with the selected plan, and are yearly fees invoiced for each subscription year after the free trial ends.

VAT or any other applicable statutory taxes are added.

The Supplier is responsible for its tax compliance towards the competent authorities.

Procura does not currently provide electronic invoicing services or integration with the electronic invoicing system of the Zakat, Tax and Customs Authority (ZATCA), and invoices submitted or issued through the Platform, including a Supplier's invoices to a Buyer, are not ZATCA e-invoices, that is, electronic invoices approved under that system.

A.22 Procura's Non-Liability for the Supplier's Transactions

Procura is not a party to the sale or supply, and does not guarantee:

• Award;
• sales volume;
• the Buyer's ability to pay;
• the number of customers;
• continuity of demand;
• the quality of the Supplier;
• the quality of the product; and
• the Supplier's commercial results.

A.23 Limits of Procura's Liability

To the extent permitted by law, Procura shall not be liable for indirect or consequential losses or for loss of profits or business opportunities arising from the Supplier's relationship with the Buyer.

In all cases, and to the extent permitted by law, Procura's total liability to the Supplier shall not exceed the fees paid by the Supplier during the twelve months preceding the event giving rise to the claim.

No limitation applies to liability that may not be limited by law.

A.24 Indemnification of Procura

The Supplier shall indemnify Procura, to the extent permitted by law, against direct claims, costs and losses arising from:

• its violation of laws;
• its breach of the Agreement;
• infringement of intellectual property rights;
• offering unlawful products;
• misleading information;
• fraud;
• manipulation of Quotations; or
• unlawful use of the Platform.

A.25 Confidentiality

Non-public information that the Supplier obtains from Procura or Buyers remains confidential.

This obligation continues after the Agreement ends for as long as the information remains confidential or for as long as the law requires its continued protection.

A.26 Protection of Personal Data

The Supplier shall use Personal Data it obtains from the Platform or the Buyer in accordance with the legal basis and the specified purpose for which it was obtained.

Where the Supplier processes Personal Data on behalf of the Buyer, it shall comply with the Buyer's instructions and with the requirements of the law and related regulations.

Personal Data may not be transferred outside the Kingdom except in accordance with the legal requirements and appropriate safeguards, where the transfer is applicable.

A.27 Force Majeure

Neither Party shall be liable for delay or non-performance resulting from events beyond the reasonable control of the affected Party.

A.28 Termination

The Supplier may terminate its subscription in accordance with the terms of the plan.

Procura may terminate or suspend in cases of material breach, non-payment, fraud, legal violation or security risks.

A.29 Effects of Termination

Upon expiry of the subscription:

• access to the paid services ceases;
• accrued fees become due;
• obligations that by their nature continue shall continue after termination; and
• the independent contracts between the Supplier and Buyers remain in force in accordance with their terms.

A.30 Governing Law and Jurisdiction

This Agreement is governed by the laws of the Kingdom of Saudi Arabia.

The Parties shall seek to resolve any dispute amicably within fifteen (15) business days of notice of the dispute.

If an amicable resolution is not possible, jurisdiction, to the extent permitted by law and without contravening mandatory rules of jurisdiction, shall lie with the competent Commercial Court in Jeddah – Kingdom of Saudi Arabia.

A.31 Notices

Notices are given by the registered email, the Supplier's account, or any electronic means adopted by Procura.

A.32 Language

Arabic and English are the languages of the Agreement.

In the event of inconsistency, the Arabic version is the authoritative reference within the Kingdom of Saudi Arabia, unless the Parties agree otherwise in writing in a manner that does not contravene the law.

A.33 Entire Agreement

This Agreement, the subscription application, the Terms of Use, the Privacy Policy, the Cookie Policy, the Acceptable Use Policy, the Code of Conduct for Suppliers and the Data Processing Addendum, where applicable, and any annexes accepted electronically constitute the entire agreement between the Supplier and Procura.

A.34 Order of Precedence of Documents

In the event of a conflict between documents, the order of priority is as follows:

• mandatory legal requirements;
• the Service Order or special agreement signed between the Parties;
• the Data Processing Addendum, as regards the protection of Personal Data;
• the Buyer Agreement or the Supplier Agreement, as the case may be, with its annexes;
• the Terms of Use;
• the Acceptable Use Policy;
• the Code of Conduct (for Buyers or for Suppliers, as the case may be);
• the Privacy Policy;
• the Cookie Policy; and
• any marketing content.

A.35 Electronic Acceptance

The Supplier acknowledges that electronic acceptance of this Agreement constitutes binding contractual acceptance.

The Supplier acknowledges that the person accepting the Agreement has the legal authority to bind the supplying entity.

A.36 Electronic Acceptance and Audit Schedule

A.36.1 Purpose

This Schedule explains how the Pack is accepted electronically and what record of that acceptance Procura keeps, so that the following can be shown: who accepted, for which organisation, which version, in what form, when, and that the text accepted is the text that is preserved.

Saudi electronic-transactions law recognises the validity and enforceability of electronic contracts, records and signatures where the statutory requirements are met. This Schedule does not guarantee that any court will admit a record as evidence, which is for the competent court (open point OP-04).

A.36.2 How acceptance works

• At registration, the person ticks a box to accept the Terms of Use and the Privacy Policy, and the version is recorded. A registration without the current version creates nothing.
• At the first sign-in, whether or not the organisation has been approved yet, the person signs in, authenticates and is shown the Pack for their role: the Buyer Pack for a Buyer, the Vendor Pack for a Supplier. The Platform stops at that step and allows nothing else until the Pack is accepted, except signing out.
• The person reads the Pack, ticks the single box that accepts it and presses the accept button. The Pack is accepted as one document, not clause by clause.
• A person who does not accept cannot use the account for transactions. A person who has a question or does not agree should not accept and should write to the legal contact.

A.36.3 What is recorded

An acceptance is recorded in the audit trail and in a queryable acceptance register. It states: the user and the organisation, the role, the identifier and version of the Pack, the SHA-256 value of the Pack and the identifier, version and SHA-256 value of each component document it is made of, the method of acceptance, the language in which the text was shown, the date and time in UTC, and the network address and browser of the person. The audit trail holds the address and browser only as keyed commitments, and the acceptance register holds them in clear until the retention schedule blanks them.

A.36.4 Integrity of the accepted text

The SHA-256 value is calculated from the text of the Pack in both languages as built from its component documents. If the text changes, its value changes. The Platform treats an acceptance as valid only for the version and the value that were shown, so that a person is never taken to have agreed to different words.

A.36.5 Audit trail and no retroactive alteration

Each entry of the audit trail carries a hash that covers the entry before it, so that editing or deleting an entry is detectable. A completed acceptance record is not altered afterwards. A correction is a separate entry linked to the original event.

A.36.6 Retention and access

Procura keeps acceptance and audit records for as long as is reasonably needed to prove the contract and to comply with the law, subject to the retention schedule. A person can see their own acceptances through the Platform, an organisation's administrator can see those of the organisation without network addresses and browsers, and the platform operator can see all of them.

A.36.7 Changes to the Pack

When the Pack changes, the new version has a new number and a new SHA-256 value, the previous version is kept, and every User is asked to accept the new version at the next sign-in. A User who accepted an earlier version is not taken to have accepted the new one.

Part B: Platform Terms

B.1 Scope of the Terms and Acceptance

These Terms of Use (the "Terms") govern the use of the Procura platform, its website, applications, electronic services, Supplier network, procurement services and any other related services (the "Platform"), which is operated by xxxxxxx, a company incorporated and registered under the laws in force in the Kingdom of Saudi Arabia ("Procura", "we" or "us").

By using the Platform, creating an account, accessing the Platform or clicking the button to accept these Terms, you acknowledge that you agree to, and shall be bound by, these Terms.

If you use the Platform on behalf of a company, organization or other entity, you represent that you have the legal authority to represent that entity and bind it to these Terms, in which case the term "you" includes both you and the entity you represent.

If you do not agree to these Terms, you shall not use the Platform.

B.2 Account Creation

The User shall provide accurate, complete and up-to-date information.

The User is responsible for:

• protecting login credentials;
• maintaining the confidentiality of the password and authentication methods;
• preventing unauthorized use;
• verifying the authorizations of the Users affiliated with their entity; and
• notifying Procura without delay of any unauthorized use.

The use of inaccurate information, or the impersonation of another person or entity, is prohibited.

B.3 Authority to Represent the Entity

When registering on behalf of an entity, the User represents that they:

• are legally authorized to represent the entity;
• are authorized to use the Platform on its behalf;
• have the authority to enter its data; and
• have the authority necessary to participate in the relevant purchasing or supply operations.

B.4 Buyer Responsibilities

The Buyer is responsible for:

• determining its purchasing needs;
• specifications;
• the budget;
• approval procedures;
• evaluation criteria;
• selecting the Supplier;
• the Award decision;
• Purchase Orders;
• contracts;
• receiving goods and services;
• inspecting them;
• approving invoices;
• payment; and
• complying with applicable laws and internal policies.

Procura does not make the purchasing decision on behalf of the Buyer.

B.5 Supplier Responsibilities

The Supplier is fully responsible for the accuracy of:

• its entity's data;
• its commercial registration;
• its tax data;
• its bank account;
• its products and services;
• prices;
• Quotations;
• delivery dates;
• warranties;
• licenses;
• certificates; and
• invoices.

The Supplier is prohibited from providing misleading, fraudulent or materially inaccurate information.

B.6 RFQs and Quotations

Procura may enable Buyers to issue RFQs and Suppliers to submit their Quotations.

The Supplier shall review the requirements of the RFQ before submitting its Quotation.

Where a sealed or protected Quotation system is in place, prices and commercial information shall be handled in accordance with the technical and procedural controls applicable to the RFQ.

Procura does not guarantee that the Platform will operate without interruption or be free of errors at all times.

B.7 Integrity and Competition

The User is prohibited from:

• colluding with competitors;
• unlawfully coordinating Quotations;
• submitting sham Quotations;
• manipulating the outcome of a competition;
• obtaining, without authorization, confidential information about other Suppliers' Quotations; and
• using the Platform for purposes that violate applicable laws.

Procura is entitled to take the technical or operational measures necessary to protect the Platform and its Users.

B.8 Contracts and Purchase Orders

Procura does not become a party to the contract or Purchase Order concluded between the Buyer and the Supplier merely because the Platform is used.

Both parties are responsible for reviewing:

• prices;
• specifications;
• taxes;
• delivery terms;
• payment terms;
• warranties;
• authorizations;
• signature; and
• legal compliance.

B.9 Invoices and Taxes

Each party bears its own tax and accounting responsibilities.

Procura does not currently provide e-invoicing services or integration with the e-invoicing system of the Zakat, Tax and Customs Authority (ZATCA), and invoices issued through the Platform are not ZATCA e-invoices.

Where e-invoicing services are made available through Procura in the future and are used, the obligated entity remains responsible for the accuracy of the invoice data and for its compliance with the relevant legal requirements.

Procura does not replace the taxpayer in its tax or accounting obligations.

B.10 Amendment of the Terms

Procura may amend these Terms from time to time.

An effective date shall be specified for the amended version, and Users shall be notified of material changes through appropriate means where required. When a new version of the documents is issued, the User is required to accept it upon first login after its publication, and the User shall not be deemed to have accepted a version that has not been presented to them.

B.11 What the Platform does and does not do

Procura provides software for managing procurement: requisitions, RFQs, Sealed Quotations, evaluation, Awards, Contracts, Purchase Orders, receiving, invoice review, payment records and reports. It records what Users do and keeps an audit trail. It connects Buyers and Suppliers, but it is not a party to the Procurement Transactions between them and it does not take any procurement decision for a Buyer.

In this release the Platform does not:

• hold, receive, transfer or guarantee money, and it provides no payment service;
• issue, transmit or clear invoices through the electronic-invoicing system of ZATCA, and the invoices produced through the Platform are not ZATCA e-invoices;
• perform a live Registry Check: the check is planned and is not live (clause B.16);
• issue qualified electronic signatures or digital certificates (clause B.13);
• verify, rate or guarantee any Buyer, Supplier, product or service, or give legal, tax, accounting or financial advice; or
• promise that it will be available without interruption or free of error.

A feature that the Schedules or the pricing page mark as planned is not available and is not promised. Nothing in this Pack states that the Platform has been certified or assessed against any law, regulation or standard.

B.12 Sealed Quotations

Where an RFQ is sealed, a Quotation is encrypted when the Supplier submits it, and its price and commercial terms are shown to no one, the Buyer included, until the opening time stated in the RFQ. The Platform is built so that no Procura operator account has permission to read a Sealed Quotation, and Procura's people shall not look for another way to read one. A Supplier may revise or withdraw its Quotation before the deadline as the RFQ allows, and each submission, revision, withdrawal and opening is recorded in the audit trail. In a two-envelope tender the technical documents open before the commercial prices, and in an auction the prices are open by design while the identities of bidders are not shown.

Procura does not promise that sealing cannot be defeated by a fault, an attack or conduct outside the Platform. A Buyer or a Supplier that believes a Sealed Quotation was read early shall report it as clause D.13 of the Code of Conduct provides.

B.13 Contracts signed before a Purchase Order is released

Where a Purchase Order arises from an Award (an RFQ, a tender or an auction), the Platform prepares the Contract with the order, on the awarded terms. The order is held, and neither Party to it can act on it, until the Buyer and the Supplier have both signed the current version of the Contract through the Platform. A call-off under a framework Contract is released only while that framework Contract is signed by both. A Buyer's chief financial officer or chief executive may release a held order before both signatures, giving a written reason that the Platform records in the audit trail, and a Buyer's organisation policy may switch the rule off, which is also recorded. A Purchase Order for a catalogue requisition that falls under no Contract is released through the Buyer's own approval chain.

A "signature" through the Platform is the act of an authenticated User, with the authority recorded for the Buyer's or the Supplier's account, approving the current text of the Contract. It is recorded with the time, the identity, the hash of the text and an audit entry. It is an electronic signature to the extent that the Electronic Transactions Law recognises it. It is not a qualified signature and involves no digital certificate. Whether it is sufficient for a particular Contract, and whether the parties should use another form of signature, are for the parties and their advisers (open point OP-05). Procura does not review the content or the legality of a Contract.

B.14 Payment records

For each invoice the Platform records the payment instruction that the Buyer's authorised Users prepare and approve, the version of the Supplier's bank details that was verified, the bank reference and the evidence of settlement that a User reports, and the reconciliation of the payment against the invoice. The payment itself is made by the Buyer to the Supplier outside the Platform, from and to their own bank accounts. Procura does not hold, receive, move, release or guarantee any money, does not execute or confirm a transfer, and records only what Users state and what the attached evidence shows.

A change to a Supplier's bank details takes effect only after Procura verifies it, and payment is held until then. A record on the Platform is evidence of what was entered. It is not, by itself, proof that money reached the Supplier.

B.15 Invoices and Tax Categories

Every Purchase Order line and invoice line carries a Tax Category in the vocabulary of the Saudi VAT law and of the ZATCA e-invoicing standard: S (standard rate), Z (zero-rated), E (exempt) and O (outside the scope of the tax), with the reason where the category requires one. The Platform records the category that the issuer selects and totals the tax by category, calculating VAT line by line at the rate then in force (15% for category S). It transmits nothing to ZATCA and is not an e-invoicing solution, and the same is true of the subscription invoices that Procura issues. The party that issues an invoice is responsible for choosing the correct category and for its own obligations under the tax laws, and Procura does not check them.

B.16 Registry Checks

The Platform is designed to compare an organisation's commercial registration number with the data of the commercial-registry data service. In this release the check is not live: it is simulated, nothing is sent to any registry, and the Platform does not show a "registry checked" label on the strength of a simulated check.

Procura plans to switch on a live check only when it has the written permission of the registry data provider and has settled the provider's terms on use, storage and reuse of the data. The design is that the check never runs on the public registration form, that each result is kept for one organisation only and is not reused for another, and that the provider's raw answer is not stored by default, only normalised facts and the SHA-256 value of the answer. A Registry Check shows what the registry returned at that moment. It does not certify the organisation, its authority or its solvency, and any use of the provider's data stays subject to the provider's own terms (open point OP-11). Procura's review of the documents that a Supplier submits is a separate step.

B.17 Evidence and the audit trail

The Platform keeps an audit trail of material actions (who, what, when and for which organisation). Each entry carries a hash that covers the entry before it, so that an edit or a deletion is detectable. A User with the right permission may export an Evidence Bundle for one RFQ or one Purchase Order. It contains the records, the attached files with their SHA-256 values, the related audit entries, the result of the Platform's own verification of the chain at the moment of export and a signed checkpoint of the chain's head, all listed in a manifest that can be checked offline.

A bundle certifies nothing about admissibility in court, about the truth of what a party stated, or about anything that happened outside the Platform. Sealed commercial data stays sealed in it, and the platform operator is held to the same rules as everyone else. How far these records count as evidence is for the competent court to decide.

B.18 Files and uploaded Content

A file that a User uploads is checked for type and size and is scanned before it can be downloaded. A file that fails the scan, or is still waiting for it, is not offered for download. The built-in check refuses programs, scripts, archives, macros and active documents and is a content-policy check, not an antivirus engine, so a file that passes it is not guaranteed to be free of malware. The User who uploads a file is responsible for having the right to upload it, and the Acceptable Use Policy governs what may be uploaded and how a report is handled.

B.19 Operating facts for this release

• Hosting: the Platform is hosted on managed cloud infrastructure in the European Union (Frankfurt, Germany). It is not hosted inside the Kingdom, and hosting inside the Kingdom is planned.
• Sign-in: by a one-time code sent to the registered email address, or by a Google account. A second sign-in step with an authenticator app is available. It is always required of the platform operator's staff, and it is required of an organisation's administrators where the organisation's policy requires it.
• Billing: Procura issues subscription invoices and records payments received by bank transfer. It does not take payment through a payment gateway in this release.
• Planned features: a feature shown as planned is not available, and the Platform does not display it as working.

B.20 Anti-Bribery and Anti-Corruption

The use of Procura to offer, solicit or accept any unlawful benefit with the aim of influencing a purchasing decision, an Award or a commercial relationship is prohibited.

Procura is entitled to take appropriate measures where the Platform is suspected of being used for prohibited activities.

Part C: Acceptable Use

C.1 Purpose

This Policy sets out the permitted and prohibited uses of the Procura Platform, and forms part of the Terms of Use, the Buyer Agreement and the Supplier Agreement.

C.2 Permitted Use

The Platform may be used only:

• for lawful commercial purposes;
• to manage procurement and supply;
• to send and receive RFQs;
• to manage Suppliers;
• to perform contracts and Purchase Orders; and
• for other purposes permitted under the subscription.

C.3 Prohibited Uses

The Platform shall not be used for:

• fraud or deception.
• impersonating others.
• hacking the Platform.
• attempting to circumvent access controls.
• introducing malware.
• disrupting the service.
• automated extraction of data without authorization.
• prohibited reverse engineering.
• infringing intellectual property rights.
• publishing unlawful content.
• discrimination, threats or harassment.
• money laundering or financing unlawful activities.
• bribery or corruption.
• manipulating tenders.
• submitting sham bids.
• collusion between Suppliers.
• creating multiple accounts to circumvent the rules.
• using the data of others without justification.
• publishing confidential information that the User obtained unlawfully.
• using the Platform for any purpose that violates Saudi laws.

C.4 Procurement Manipulation

The User is prohibited from attempting to:

• artificially raise or lower prices;
• submit a sham Quotation;
• engage in unlawful coordination with a competitor;
• unlawfully influence the outcome of an RFQ;
• misuse Quotation information; and
• disrupt legitimate competition.

C.5 Security

The following are prohibited:

• sharing login credentials;
• using another person's account;
• attempting to discover passwords;
• testing for vulnerabilities without permission; and
• uploading malicious files.

C.6 Procura's Actions

Where a violation is suspected, Procura may:

• request additional information;
• suspend the account;
• restrict certain functions;
• remove violating content;
• freeze a transaction where there is a security risk;
• terminate the account;
• preserve the necessary records; and
• notify the competent authority where there is a legal obligation.

C.7 Review Does Not Mean Approval

Procura's review of, or permission to publish, any content does not mean that Procura endorses its content or guarantees its accuracy.

C.8 Responsibility

The User remains responsible for their own actions and for the Users affiliated with their account.

C.9 Reports and Content Removal

Reports of misuse may be sent to:

abuse@procuraksa.com

Upon receipt of a report, Procura shall consider it and decide whether it falls within its role, and is not obliged to monitor content in advance. Where a violation is established, or for urgent protection, it may remove the violating content or restrict access to it, preserve evidence, and notify the content owner where this is possible without prejudicing an investigation or the rights of others, and enable the owner to object in writing at the same address. Procura does not adjudicate contract disputes between the Buyer and the Supplier. The removal and objection procedures are an item for review by legal counsel (open point OP-17).

Part D: Code of Conduct

D.1 Purpose and scope

Procura is a platform where buyers and suppliers run RFQs, sealed bids, awards and purchase orders. This Code sets the standard of conduct that every supplier on Procura accepts. The aim is plain: every bid is an honest offer, every award is a fair decision, and every record is a true one.

The Code of Conduct for Buyers sets the standard for buyers. The two documents work together. A supplier can expect from buyers what the Buyer Code requires, and a buyer can expect from suppliers what this Code requires.

This Code adds to the Terms of Use, the Supplier Agreement, the Acceptable Use Policy and the Data Processing Addendum. It does not replace them, and it does not reduce any duty under the law. The law always applies, and where the law is stricter than this Code, the law applies. Where a signed agreement between a supplier and a buyer, including a purchase order, deals with the same point, that agreement applies between them, but it never lowers the standards in sections D.4 to D.8 of this Code.

Where the buyer is a government entity, or is bound by the Government Tenders and Procurement Law, that law and the buyer's own rules apply as well. Procura is not the government procurement platform (Etimad) and does not replace it.

D.2 Who this Code binds

• The supplier organisation, which accepts the Code through an authorised person.
• Every person who uses the supplier's Procura account or acts for the supplier in a Procura transaction: owners, managers, sales and bid staff, administrators, agents and intermediaries.
• Sub-suppliers and subcontractors that the supplier uses to deliver what was ordered through Procura. The supplier must pass the standards of this Code on to them in writing, and it remains responsible for what they do.

The supplier is responsible for its people and for those it engages. "I did not know" and "my agent did it" are not a defence where the supplier could have prevented the conduct.

D.3 Principles

D.4 Conflicts of interest and disclosure

D.4.1 What it is

A conflict of interest exists when a personal, family, financial or business interest of the supplier or its people could affect, or could look as if it affects, a decision in a Procura transaction. For example:

• a relative or close friend of the supplier's owner or staff works for the buyer in procurement, finance, approval or evaluation;
• a person at the buyer has a share in the supplier, or a role in it, paid or unpaid;
• the supplier's owner or a relative holds a share in a competing bidder; or
• the supplier or its people have given a job, a loan or another benefit to a person at the buyer.

D.4.2 The duty to disclose

The supplier must disclose a conflict in writing before it bids, or as soon as it learns of the conflict. It writes to the buyer's contact for the RFQ and sends a copy to ethics@procuraksa.com. An in-platform declaration step is planned. A disclosed conflict is not in itself a breach. A conflict that is hidden is.

D.4.3 Contact during a procurement

While an RFQ is open, the supplier deals with the buyer only through the RFQ's channels. It must not approach evaluators or approvers privately about the RFQ, and must not offer a job or a business opportunity to a person at the buyer who takes part in the procurement.

D.5 Gifts, hospitality and improper advantage

D.5.1 What is always prohibited

• Bribery: offering, promising, giving, asking for or accepting anything of value to influence or reward a decision, to a public official or to a private person, in the Kingdom or abroad, directly or through someone else.
• Kickbacks and secret commissions, and paying an intermediary knowing that part of the payment will reach a decision-maker.
• Facilitation payments: small unofficial payments to speed up or secure a routine action.
• Cash and anything like cash, such as vouchers, gift cards and loans.
• Favours: jobs or internships for relatives, donations to a person's chosen cause, or sponsorship, when they are given at someone's request or in connection with a procurement.

D.5.2 Gifts and hospitality: the decision rule

Before giving anything to a person at a buyer, the supplier asks five questions. If any answer is no, it does not give it.

1. Is every decision involving the supplier closed? No gift or hospitality while an RFQ, an award, a purchase order change, an invoice or a payment involving the supplier is open.
2. Is it modest and occasional, and ordinary courtesy such as a business meal or a small branded item?
3. Is it open? It is offered to the organisation, not privately, so that the receiver's manager can know of it.
4. Is it within the limit in the buyer's own policy? That limit is set by the buyer's own policy and recorded in the RFQ. If the RFQ records no limit, the limit is none, and the supplier gives nothing.
5. Would the supplier be comfortable if the other bidders and the auditors saw it?

Whatever the answers, entertainment and leisure trips, travel and lodging paid for a buyer's person, and cash or cash equivalents are not allowed. For visits to sites, factories or exhibitions, each side pays its own travel and lodging, unless the buyer's policy says otherwise and the buyer records it in the RFQ.

D.5.3 If something improper is offered or asked

The supplier refuses, writes down what happened, and reports it under section D.13. A request for a payment by a person at a buyer is never a normal cost of business. A payment made only to protect a person from immediate danger to life or safety is not a breach if it is reported at once.

D.6 Fair competition

D.6.1 What is prohibited

The supplier must not agree with, or signal to, a competitor on:

• prices, discounts or other terms of a bid;
• whether or not to bid, or who is to win, including bid rotation;
• cover or complementary bids, which are bids not meant to win, put in to make the competition look real;
• sharing customers, regions or markets, or withdrawing a bid so that another wins; or
• future prices, announced publicly or privately in order to influence others, including through clarification questions or any message on the platform (price signalling).

Companies that are connected by ownership, management or staff and that bid separately on the same RFQ must disclose the link in each bid.

D.6.2 Sealed-bid integrity

A bid is the supplier's own independent offer, prepared without knowing the prices of others. The supplier must not try to learn another bidder's price or identity before the buyer opens the bids, whether by asking the buyer's staff or by trying to get round the platform. If it receives another bidder's information by mistake, it stops reading, does not use it, and reports it to the buyer and to ethics@procuraksa.com. After the deadline it does not change a bid, unless the RFQ allows it for every bidder, for example in a best-and-final round.

D.6.3 Joint bids and subcontracting between competitors

These are lawful when they are declared in the bid. When they are not declared, they are prohibited.

D.6.4 If a competitor makes an approach

The supplier refuses, writes down what was said, and reports it under section D.13. These rules follow the Competition Law, and breaking that law can lead to penalties from the authorities in addition to what Procura does.

D.7 Accurate information

D.7.1 What must be true

Everything a supplier gives to Procura or to a buyer must be true, complete and up to date. That covers the company name, commercial registration number, VAT number, address and authorised signatory, bank details, licences and certificates with their real issue and expiry dates, specifications, origin, capacity, references, prices, quantities, delivery dates, warranty and payment terms, and every declaration an RFQ asks for, such as local content, Nitaqat band, small-business status or quality certifications.

D.7.2 What is prohibited

The supplier must not forge, alter or borrow a document, use another company's registration, certificates or references, claim an approval or certification it does not hold, open more than one account for the same organisation, open an account under a false name, or submit a bid for a company that has not authorised it. Bank details must be for an account in the supplier's own name.

D.7.3 Keeping records current

The supplier updates its details when they change, and renews its registration and certificates before they expire. The platform checks these dates today. A supplier whose commercial registration or certificate has expired cannot be invited, cannot bid and cannot be awarded. A change of commercial registration or VAT number needs a new verification, and a change of bank details is held until Procura verifies it. Bank changes are made on the platform, never by e-mail alone.

D.7.4 Prices

A price is one the supplier can honour at the stated quantity, specification, delivery and payment terms. No bid may be made at an unrealistically low price in order to win and then renegotiate, and no charge may be left out of the price and added later. VAT is shown as the law requires.

D.7.5 Mistakes

A genuine error is reported to the buyer in writing as soon as it is found. A supplier that reports its own error promptly is treated more favourably than one that is found out.

D.8 People, labour and safety

D.8.1 The law

The supplier complies with the Saudi Labour Law and the related regulations for everyone who works on what it supplies, including contract, temporary and migrant workers and the workers of its subcontractors.

D.8.2 What is prohibited

Forced, bonded, compulsory or trafficked labour is prohibited. The supplier does not hold workers' passports, residence documents or wages, and does not charge workers recruitment fees. It does not employ anyone under the minimum legal working age, and does not put young workers into hazardous work.

D.8.3 Fair terms

Wages are paid on time and in full, as the contract and the law require, including the wage-protection rules. Working hours, rest and leave follow the law.

D.8.4 Safe workplaces and respect

The supplier keeps workplaces safe and healthy, gives safety information for its products, and reports serious accidents to those who must know. It does not allow harassment, abuse or discrimination, and respects the dignity of every person. The participation of women, young people and people with disabilities in its workforce is encouraged.

D.8.5 Saudization and Nitaqat

The supplier meets the Saudization commitments that apply to its establishment under the Nitaqat programme. Where an RFQ asks for a declaration, it states the true position. It does not use fictitious employment or any concealment arrangement, which the law prohibits.

D.8.6 Guidance

This section follows the national labour framework, Vision 2030 objectives for national employment and empowerment, and the guidance of ISO 26000 on social responsibility. Procura does not require an ISO 26000 certificate. A buyer may ask a supplier to describe how it meets these standards, and the supplier must answer truthfully.

D.9 Environment and community

The supplier complies with environmental, product-safety, waste and hazardous-materials law. It sources responsibly: it knows where its materials come from, avoids sources linked to serious human-rights abuse or unlawful environmental damage, and reduces waste and packaging where it can. Where an RFQ includes sustainability criteria, the supplier answers them honestly.

Procura encourages, and does not require, local content: local sourcing, local employment, training and partnerships with small and medium businesses, in line with Vision 2030. A buyer may ask for local-content information in its RFQ. The supplier must then give accurate information it can support with documents, and must not inflate it or rely on a front arrangement.

D.10 Confidentiality and data protection

D.10.1 Confidential information

RFQ documents, specifications, drawings, quantities, budgets, a buyer's data, and anything else a supplier learns about a buyer or another party through Procura are confidential. The supplier uses them only to prepare a bid for that RFQ and to perform the resulting purchase order. It does not disclose them to anyone who does not need them, other than its own advisers and subcontractors who are bound to confidentiality for that purpose, and it does not use them for another purpose or to compete with the buyer. This duty continues after the RFQ ends. It does not apply to what the law requires the supplier to disclose.

D.10.2 Personal data

The names, telephone numbers and e-mail addresses of a buyer's staff that the supplier learns through Procura are used only for the transaction, and in line with the Personal Data Protection Law. They are not used for marketing messages or put on lists. Personal data that the supplier receives in performing a purchase order is processed as the law and any data processing agreement require. A breach affecting personal data is reported without delay to Procura (security@procuraksa.com) and to the buyer.

D.10.3 No scraping and no circumvention of controls

The supplier does not scrape or bulk-collect data from Procura, extract it by automated means, get round access controls or rate limits, or reverse-engineer the platform, as the Acceptable Use Policy provides.

D.10.4 Credentials

Each person uses their own account, tied to a named individual. Sign-in codes, sessions and Google sign-in are never shared or passed on. The supplier's administrator removes users who leave or change role. Suspected compromise of an account is reported at once to security@procuraksa.com.

D.10.5 What the platform does to protect bids

Bids are encrypted when they are submitted. In the product, no Procura operator account has the permission to read bids, so in a sealed RFQ they stay closed until the opening time. Procura's own people may not look for another way round this. A supplier that believes it has happened reports it under section D.13.

D.11 Conduct on the platform

D.11.1 Accounts

One account belongs to one person. Logins are not shared. Users have only the access their role needs.

D.11.2 No circumvention

Where a transaction began on Procura, whether as an RFQ, an invitation, a clarification, a bid, a quotation request or an award, the supplier carries it through on Procura, so that the bid, award, purchase order, delivery and invoice are recorded there. It must not move the transaction away from the platform in order to avoid the audit trail, the approval controls, the sealed-bid process or the other bidders. This rule does not restrict dealings that did not begin on Procura. In this version Procura earns subscriptions and takes no commission on awards, so the rule exists to protect the record and fair competition, not a fee.

D.11.3 No fake bids or accounts

The supplier does not submit bids it does not mean to honour, does not use a second account or a related party to bid against itself, and does not take part in any arrangement to push prices up or down in a reverse auction.

D.11.4 Deadlines and sealed bids

The supplier bids before the deadline. It does not ask for a late or altered bid to be accepted unless the RFQ allows it for every bidder. It does not ask the buyer or Procura to open or show a bid early.

D.11.5 Awards and purchase orders

A bid is binding for its validity period. The supplier acknowledges or declines a purchase order promptly, on the platform. It delivers as agreed and does not decline an award only because prices in the market have moved. A change to quantity, specification, price or date goes through a change order on the platform. The supplier uses the delivery handover code only for a real delivery.

D.11.6 Faults in the platform

A supplier that finds an error or weakness in Procura that gives an unfair advantage or exposes data stops, does not use it, and reports it to security@procuraksa.com. It does not test the platform's security without written permission.

D.11.7 Honest ratings

Ratings given after an order is paid are honest and based on facts.

D.12 Duties specific to suppliers

D.12.1 Bid in good faith

The supplier bids only where it intends and is able to deliver, and only after reading the RFQ, the specification and the terms. Questions go through the RFQ's clarification channel before it closes. Every answer is published to every bidder, and the asker is not named.

D.12.2 Quote only what can be delivered

Capacity, stock, licences and lead times must be real. Any exception to the specification or the terms is stated clearly in the bid, not left unsaid.

D.12.3 Quality and warranty

Goods and services conform to the specification, to the Saudi standards and technical regulations that apply, and to the certifications the supplier has stated. The warranty is the one stated in the bid and the purchase order, and defects are put right at the supplier's cost as the purchase order provides.

D.12.4 Subcontracting and sub-suppliers

The supplier discloses in its bid any subcontracting of a substantial part of the work, and names the subcontractor if the RFQ asks. It does not subcontract the substance of a purchase order without the buyer's prior written consent. It tells its sub-suppliers about this Code and requires them in writing to meet the same standards, and it does not use a sub-supplier that Procura or the buyer has told it is suspended. The supplier remains responsible for its sub-suppliers.

D.12.5 Audit cooperation

The supplier cooperates with reasonable requests from the buyer or from Procura to check compliance with this Code. That includes documents and certificates, records of prices and deliveries, and, with notice and at reasonable times, visits to premises or sites. It answers within the period stated in the request. It keeps its transaction records for as long as the law requires, and any longer period in the purchase order, and does not destroy records once a review has begun.

D.12.6 Invoices

Invoices match the purchase order and the goods receipt, and are valid tax invoices with VAT shown. The supplier does not issue duplicate or inflated invoices, and does not invoice for what has not been delivered.

D.12.7 Disputes and returns

The supplier raises disputes and returns through the platform in good faith, keeps to the facts, and takes part fairly in mediation.

D.12.8 Payment

Buyers are expected to pay valid invoices on the payment term recorded in the bid and the purchase order. The supplier sends complete and correct invoices, does not pressure a buyer's staff for payment ahead of the agreed term, and tells the buyer promptly through the platform if its bank details change.

D.13 How to report a concern

Anyone may report a concern about conduct on Procura, or a breach of this Code or of its companion Code, to ethics@procuraksa.com. That includes a supplier, a buyer, a user, a sub-supplier, an employee and a member of the public.

D.13.1 What to report

• suspected bribery, or a gift or hospitality that breaks the rules;
• a conflict of interest that was not disclosed;
• bid rigging, cover bids or price signalling;
• a leaked bid, price or other confidential information;
• a false document, a false claim or a fake account;
• an attempt to take a transaction off the platform to avoid the record;
• forced or child labour, or unsafe conditions, in a supply chain;
• misuse of personal data or of another person's account;
• retaliation for a report, a question or a complaint; and
• anything else that conflicts with this Code.

D.13.2 What to include

What happened, when, the RFQ, bid, purchase order or invoice number, who was involved, and any document or message that shows it. A report may be made without giving a name. Procura then cannot ask follow-up questions, and a report with little detail may be hard to act on.

For a security vulnerability, write to security@procuraksa.com. For a request about personal data, write to privacy@procuraksa.com.

D.13.3 Confidentiality

A report is seen only by the people who need it to assess it and act on it. Procura does not tell the person reported who made the report, and protects the reporter's identity as far as the law allows. The law or an authority may in some cases require disclosure.

D.13.4 No retaliation

Procura does not allow retaliation against anyone who reports a concern in good faith or who helps a review, whether or not the concern proves right. Retaliation includes ending business, dropping a supplier from invitations, lowering a rating, threats, and any other disadvantage. Retaliation is itself a serious breach of this Code, by a buyer or by a supplier. A person who reports in good faith does not lose standing, invitations or ratings on Procura because of it. A report that is knowingly false, or made in bad faith, is also a breach.

D.13.5 Authorities

Nothing in this Code stops anyone from reporting to a competent authority, such as the Oversight and Anti-Corruption Authority (Nazaha), the General Authority for Competition or the Saudi Data and AI Authority (SDAIA).

D.13.6 What Procura does with a report

Procura reads each report, decides whether it falls within its role, and applies the same standard whatever the size of the customer concerned. It tells the reporter the outcome where it can do so without harming confidentiality. Procura sets no fixed reply period in this version; the period is an open point for counsel.

Today the channel is a monitored mailbox. A "report a concern" form inside the platform, with a case number, is planned.

D.14 How Procura responds

D.14.1 A graduated response

Procura's response is proportionate. It looks at how serious the breach is, whether it was deliberate, whether it was repeated, the harm done, and how the person or organisation cooperates. The steps below are a ladder, not a fixed order: a serious breach can start higher up, and a step can be skipped.

Procura may also ask for corrective action, such as correcting data, withdrawing a false bid or returning an improper benefit, and may record the outcome in the account's history. Suspension may be applied before a full review where that is needed to stop serious harm, for example fraud, bribery, forged documents or a security risk; the notice then follows at once.

D.14.2 Fair process

Before a decision that restricts an account, Procura tells the person or organisation in writing what is alleged and which section of this Code applies, and gives a reasonable period, stated in the notice and suited to the case, to respond and to provide documents. Procura considers the response and gives its decision in writing with reasons. The decision can be challenged by writing to ethics@procuraksa.com; the challenge is reviewed by a person who took no part in the first decision.

Procura is not a court. It does not decide contract claims between a buyer and a supplier: the purchase order is theirs, and the dispute function of the platform is available to them. A decision under this Code does not limit any right under the law or a contract, or any action by an authority.

D.14.3 What the platform can do today, and what is planned

D.15 Meaning of some terms

Part E: Privacy and Data Processing

E.1 Privacy Policy

E.1.1 Introduction

This Privacy Policy explains how xxxxxxx ("Procura" or "we") collects, processes, uses, stores, discloses and protects Personal Data when you use the Procura website, its applications, the Platform, the procurement services, the Supplier services, the support channels and related services.

This Policy has been prepared in line with the applicable Saudi laws and regulations, including the Personal Data Protection Law and its Implementing Regulations, as applicable.

E.1.2 Responsible Entity

Legal name: xxxxxxx
Commercial Registration: xxxxxxx
Address: xxxxxxx
Website: https://www.procuraksa.com
Privacy contact: privacy@procuraksa.com

This contact point receives and responds to privacy requests and enquiries relating to the protection of Personal Data.

Where the law requires the appointment of a data protection officer, Procura will appoint the appropriate officer in accordance with the legal requirements.

E.1.3 Procura's Capacity: Controller or Processor

Depending on the nature of the activity, Procura may act as follows:

E.1.3.1 Controller

Where Procura determines the purposes and means of processing Personal Data relating to its own activities, such as:

• account management;
• Platform security;
• billing;
• customer service;
• legal obligations;
• service management;
• direct marketing in the cases where it is permitted.

E.1.3.2 Processor

Where Procura processes Personal Data on behalf of the Buyer or the Supplier and in accordance with its instructions.

The capacity is determined according to the nature of the processing and the relevant agreement.

E.1.4 Data We May Collect

Depending on how you use the Platform, we may collect:

E.1.4.1 Identity data

• name;
• job title;
• organization;
• job role.

E.1.4.2 Contact data

• email address;
• phone number;
• business address;
• communication preferences.

E.1.4.3 Account data

• login credentials;
• account settings;
• language;
• preferences;
• authentication records.

E.1.4.4 Organization data

• company name;
• Commercial Registration;
• tax number;
• address;
• authorized signatories' data.

E.1.4.5 Procurement data

• purchase requests;
• requests for quotations;
• Supplier quotations;
• purchase orders;
• contracts;
• invoices;
• delivery data;
• ratings;
• correspondence.

E.1.4.6 Financial and commercial data

Where needed:

• banking data;
• invoice data;
• subscription data;
• payment data.

E.1.4.7 Technical data

• IP address;
• device type;
• browser;
• operating system;
• system logs;
• security and authentication logs.

E.1.4.8 Organization verification data

The Commercial Registration number and the corresponding registration data (legal name, status and dates), when the live-check service with a commercial registry data provider is activated. This service is planned and is not activated in this version, and nothing is currently sent to any provider.

E.1.4.9 Proof and audit data

The fingerprint-linked audit trail (actions, approvals and consents, with the time and the user identifier), the records of acceptance of legal documents with their fingerprints, and the evidence packs exported by authorized users.

Procura adheres to the principle of data minimization and does not collect Personal Data that is not necessary for the specified purpose, in accordance with the relevant legal requirements.

E.1.5 Sensitive Data

Procura does not aim to collect Sensitive Personal Data except where there is a legitimate and lawful need to do so.

The user must not enter Sensitive Data in procurement records unless it is necessary and its processing is lawfully permitted.

E.1.6 Purposes of Processing

Personal Data may be processed for purposes that include:

• Creating and managing accounts.
• Authentication.
• Operating procurement processes.
• Connecting Buyers with Suppliers.
• Managing requests for quotations.
• Receiving quotations.
• Managing subscriptions.
• Billing.
• Customer service.
• Platform security.
• Preventing fraud and misuse.
• Records and audit.
• Verifying organization and Commercial Registration data, when this service is activated.
• Compliance with laws.
• Dispute resolution.
• Performance of agreements.
• Developing and improving the services.
• Operational notifications.
• Direct marketing in the cases where it is permitted.

The purposes of collecting data must be directly related to the purposes of the entity, and the data must not be processed in a manner that conflicts with the purpose for which it was collected, except in the cases permitted by law.

E.1.7 Legal Basis for Processing

Personal Data is processed in the cases permitted under the Personal Data Protection Law and its Implementing Regulations, which may include:

• the consent of the Data Subject;
• performance of contractual obligations;
• compliance with legal obligations;
• legitimate interests in the permitted cases;
• protection of vital interests;
• any other basis permitted by law.

Where consent is the basis, it is documented and the Data Subject is enabled to withdraw it in accordance with the legal requirements.

E.1.8 Information at the Time of Collection

When collecting Personal Data, Procura will provide, as required by law, the information relating to:

• the identity of the entity;
• the means of contact;
• the purpose;
• the legal basis;
• the mandatory and optional data;
• the retention period or the criteria for determining it;
• the rights of the Data Subject;
• the method of withdrawing consent;
• the parties to whom disclosure may be made;
• transfer or processing outside the Kingdom, where applicable.

These elements are consistent with the requirements of the right to be informed set out in the Law and the Implementing Regulations.

E.1.9 Disclosure of Data

Data may be disclosed to the following parties where necessary and to the extent permitted:

• the relevant Buyer;
• the relevant Supplier;
• authorized users within the organization;
• technical service providers;
• hosting providers;
• payment providers;
• communications providers;
• advisers and professional bodies;
• government bodies;
• judicial or competent authorities where required by law.

E.1.10 Sharing of Buyer and Supplier Data

The nature of the Platform requires the sharing of certain organization and user data between the Buyer and the Supplier in order to carry out procurement processes.

The data may include:

• organization name;
• professional contact data;
• Supplier profile;
• quotations;
• requests for quotations;
• purchase orders;
• delivery data;
• invoice data.

Sharing takes place in accordance with access permissions, the Platform settings and the applicable laws.

E.1.11 Service Providers

Procura may use other parties to provide services such as:

• hosting;
• infrastructure;
• cybersecurity;
• email;
• text messaging;
• authentication;
• payment;
• document storage;
• technical support;
• monitoring and analytics.

Procura takes appropriate contractual and technical measures in accordance with the legal requirements.

E.1.12 Transfer of Personal Data Outside the Kingdom

If the operation of a particular service requires transferring or making Personal Data available outside the Kingdom, Procura complies with the requirements and controls relating to the transfer of Personal Data outside the Kingdom.

The safeguards may include, depending on the case:

• standard contractual clauses;
• binding common rules;
• assessment of transfer risks;
• data minimization;
• security controls;
• any other safeguards permitted by law.

The Saudi regulations govern the transfer of Personal Data outside the Kingdom and specify the required safeguards and assessments in the relevant cases.

The Platform is currently hosted with a managed cloud infrastructure provider in the European Union (Frankfurt, Germany), that is, outside the Kingdom, and hosting inside the Kingdom is planned. The current Sub-processors and their locations are listed in the Sub-processors Schedule.

Procura does not claim that all data is hosted inside the Kingdom unless that is actually the case.

E.1.13 Information and Data Security

Procura applies appropriate technical and organizational measures to protect data, which may include:

• encryption;
• access control;
• multi-factor authentication;
• logging and monitoring;
• network protection;
• vulnerability management;
• backup;
• incident response procedures.

It cannot be guaranteed that any electronic system is absolutely immune from all risks.

E.1.14 Incidents and Personal Data Breaches

Procura applies procedures to detect, contain, investigate and remediate security incidents.

Where the legal notification requirements apply, Procura complies with the procedures and deadlines specified in the Personal Data Protection Law and its Implementing Regulations.

The Implementing Regulations provide for notifying the competent authority of qualifying Personal Data breaches within a period not exceeding 72 hours from the time of becoming aware of the incident, subject to the conditions specified in the Regulations.

Procura adopts a documented internal incident procedure, in which the period starts from the moment any of its personnel becomes aware of the incident and not from the moment it is confirmed, and in which every event and the decision on it is recorded even if it is not notified. Where Procura acts as a Processor, it notifies the Controller without undue delay. There is currently no automated incident detection and no automated timer for the period, and the incident register is kept manually.

E.1.15 Data Retention

Procura retains Personal Data for the period necessary to achieve the purpose for which it was collected or for the period required by laws and contractual obligations.

The retention period may vary depending on:

• account status;
• the contractual relationship;
• procurement records;
• accounting requirements;
• tax requirements;
• audit requirements;
• disputes;
• legal requirements.

When the legal or operational need for the data ends, Procura takes appropriate measures to delete, destroy or anonymize it in accordance with the legal requirements.

The Retention Schedule sets out the data categories, the periods and the proposed action for each. These periods are proposals that have not yet been approved by the owner or by legal counsel, and Procura does not carry out any deletion or anonymization of Customer data under them before they are approved.

E.1.16 Rights of Data Subjects

In accordance with the applicable laws and regulations, the rights of the Data Subject may include:

• the right to be informed;
• the right to access the data;
• the right to obtain a readable copy;
• the right to request correction;
• the right to complete or update the data;
• the right to request destruction when the data is no longer necessary;
• the right to withdraw consent where consent is the legal basis;
• the right to file a complaint;
• other rights established by law.

The Saudi personal data protection framework recognizes these rights subject to the legal controls and exceptions.

E.1.17 How to Exercise Rights

Privacy requests may be sent to:

Email: privacy@procuraksa.com

The request should include, as far as possible:

• name;
• organization;
• contact details;
• type of request;
• the information necessary to verify identity.

Procura may request reasonable verification information before carrying out the request in order to protect the data from unauthorized disclosure.

Procura responds to requests within the period set by the laws and keeps a record of each request and its decision. Where Procura processes data as a Processor on behalf of the Customer, it refers the request to the Controller and informs the requester accordingly.

E.1.18 Data Accuracy

The user is responsible for updating their Personal Data and their organization's data.

Procura takes appropriate measures to maintain the accuracy of data in accordance with the legal requirements.

E.1.19 Direct Marketing

Procura may use contact data to send:

• Platform updates;
• new services;
• events;
• educational content;
• commercial offers;

within the limits permitted by law.

Where consent is required, it will be obtained in accordance with the legal requirements, with an appropriate means provided to unsubscribe or manage preferences.

E.1.20 Cookies

Procura may use cookies and similar technologies for purposes of:

• authentication;
• security;
• Platform operation;
• preferences;
• analytics;
• performance improvement.

Procura may issue a separate cookies policy.

E.1.21 Children

The Procura Platform is intended for commercial and institutional use and is not directed at children.

Procura does not aim to collect Personal Data from children for independent use of the Platform.

E.1.22 Third-Party Links

The Platform may contain links to external websites or services.

Procura is not responsible for the privacy policies or practices of third parties.

E.1.23 Changes to the Privacy Policy

Procura may amend this Policy from time to time.

The effective date of the new version will be stated, and the user will be notified of material changes through appropriate means where this is required.

E.2 Data Processing Addendum

E.2.1 Purpose

This Addendum applies where the Procura Platform acts as a Processor of Personal Data on behalf of the Customer, who is the Buyer or the Supplier as the case may be, and who acts as the Controller.

This Addendum forms part of the Buyer Agreement or the Supplier Agreement, as the case may be, and its provisions prevail on the subject of data protection over any general provision that conflicts with it.

The Implementing Regulations require, when a Processor is selected, that the agreement include the purpose of processing, the categories of data, the duration of processing, the breach notification obligations and certain other requirements, and they also regulate Sub-processors.

E.2.2 Roles of the Parties

The Customer (the Buyer or the Supplier): the Controller.

Procura: the Processor, within the limits of the data it processes on behalf of the Customer.

This does not prevent Procura from acting as an independent Controller for account, billing, security and compliance data and other processing whose purposes and means Procura determines independently.

E.2.3 Subject Matter of Processing

The processing includes, depending on the service:

• account management;
• user management;
• procurement;
• Suppliers;
• RFQs;
• quotations;
• contracts;
• purchase orders;
• invoices;
• receiving;
• reports;
• communications;
• support.

E.2.4 Duration of Processing

Processing begins when the service is activated and continues throughout the term of the Agreement, after which the data is deleted or returned in accordance with the Customer's instructions, unless retention is required by law or necessary to establish a right or obligation.

E.2.5 Categories of Data Subjects

These may include:

• the Customer's employees;
• Supplier representatives;
• Supplier employees;
• business customers;
• contact persons;
• users;
• transaction counterparties.

E.2.6 Categories of Data

These may include:

• name;
• job title;
• contact details;
• account data;
• login records;
• transaction data;
• billing data;
• bank account data where needed;
• professional data;
• technical location data;
• document data.

Sensitive Data may not be processed unless this is necessary, lawfully permitted, and specified in the Customer's instructions or the Agreement.

E.2.7 Controller's Instructions

Procura undertakes to process the data in accordance with:

• the Agreement;
• this Addendum;
• the Customer's lawful instructions;
• the legal requirements.

If Procura believes that the Customer's instructions violate the law, it may notify the Customer of this before carrying them out, where this is permitted by law.

E.2.8 Confidentiality

Procura's employees and the persons authorized to access the data are bound to maintain its confidentiality.

E.2.9 Security of Processing

Procura applies appropriate measures that include, depending on the nature of the processing:

• access control;
• encryption;
• backup;
• account management;
• event monitoring;
• vulnerability management;
• incident response plans.

E.2.10 Sub-processors

Procura may use Sub-processors where needed to provide the service.

Procura selects the Sub-processor according to appropriate protection criteria.

It ensures that the Sub-processor is contractually bound to an appropriate level of protection.

The list of current Sub-processors and their locations is published in the Sub-processors Schedule. Procura applies a notification and objection mechanism wherever it is required under the Agreement or the law. The Implementing Regulations set out specific requirements and safeguards when engaging a sub-processor.

E.2.11 Data Breach

Upon discovering an incident that may affect the Personal Data that Procura processes on behalf of the Customer:

• Procura secures the systems.
• It limits the impact of the incident.
• It investigates the event.
• It documents it.
• It notifies the Controller without undue delay.
• It provides the available information necessary to assess the incident.
• It cooperates with the Controller in the notification and remediation procedures.

The Controller remains responsible for the legal notifications that fall on it, unless the law provides otherwise.

E.2.12 Rights of Data Subjects

Procura assists the Customer, within reasonable limits, in responding to Data Subject requests relating to access, correction, updating, destruction or other rights established by law.

E.2.13 Transfer of Data Outside the Kingdom

If performing the service requires transferring data or making it available from outside the Kingdom, Procura complies with the legal requirements for the transfer of Personal Data outside the Kingdom and the necessary safeguards.

The safeguards may include contractual measures or other mechanisms established by law, depending on the case.

E.2.14 Return and Destruction of Data

Upon termination of the service, Procura returns the data or deletes it at the Customer's election, unless there is a legal obligation to retain it.

Destruction is carried out in a manner that prevents unlawful re-access to the data.

E.2.15 Audit and Information

Procura provides the Customer with the reasonable information necessary to demonstrate compliance with this Addendum, having regard to the protection of its trade secrets, the security of its systems and the rights of other customers.

E.3 Cookie Policy

E.3.1 Purpose

Procura uses cookies and similar technologies to operate the Platform, remember Users' preferences, enhance security, understand use of the service and improve performance.

E.3.2 Types of Cookies

A. Necessary:
Required for login, authentication, security and the operation of core functions.

B. Functional:
Remember settings and preferences.

C. Analytics:
Help in understanding site usage and performance.

D. Marketing:
May be used when marketing tools are enabled, to the extent permitted by law and subject to the User's consent.

E.3.3 Third-Party Cookies

Procura may use third-party services, such as analytics, support or communications tools.

The use of those services is subject to the policies of the parties concerned, and Procura remains bound by the legal requirements relating to Personal Data.

E.3.4 Control

The User may manage cookies through browser settings or the preference management tool provided by Procura.

Disabling necessary cookies may cause some Platform functions not to work.

E.3.5 Updating the Policy

This Policy may be updated when new technologies or services are added.

Part F: Schedules

F.1 Schedule of Supplier Plans and Fees

F.1.1 Plans and annual fees

A Supplier chooses one of exactly three annual Plans. The fee is the yearly price of the Plan, paid in advance and shown before VAT. VAT is added at the rate in force (15%), and the invoice states the amount before VAT, the VAT and the total. A free trial of 14 days precedes the first paid year. No percentage of the value of any Award is charged. The rules on how the trial starts, on payment, on renewal, on upgrading and downgrading and on the continuity of earlier contracts are in the clause on the Supplier's subscription in the Agreement. The figures below are generated from the catalogue that the pricing page and the Platform use, so that they cannot differ.

F.1.2 Limits and what each Plan includes

The Platform counts the limits that are marked "enforced" or "measured", and it reports use at 80%, 95% and 100% of a limit. At 100% only new discretionary use pauses (new responses to RFQs and new listings, for example); invoices on committed orders, corrective documents and replies in disputes are never stopped or charged, and they are recorded for review. A row marked "planned" is not yet available and is not promised. A row marked "included" is a term of the service and not a counter. A row marked "separate service" is not part of any Plan. No charge for use above a limit is made automatically.

F.1.3 Invoice top-up packs

A pack adds a block of 25 issued invoices to the Plan's allowance. It is sold only on the Supplier's express request, expires with the subscription year and is never charged automatically. The prices, before VAT, are:

F.2 Sub-processors Schedule

F.2.1 What this page is

Procura uses a small number of outside providers to run the platform. Where a provider handles personal data on Procura's behalf, it acts as a sub-processor under the Data Processing Addendum. This page lists the providers that are in use today, what each does, what data it sees and where, and says plainly which services are not used.

F.2.2 Providers in use

F.2.3 Services not used

The platform's code can be set up to use other providers for e-mail, SMS and payments. None of them is switched on. This page is updated before any is.

F.2.4 Where data goes

Personal data held on the platform is stored with Render in Frankfurt, so it is held outside the Kingdom. Hosting inside the Kingdom is planned. E-mail passes through SendGrid, and Google sees a visitor's IP address when fonts load and the sign-in request when a person uses Google sign-in. The Privacy Policy and the Data Processing Addendum say how personal data is protected, including when it is transferred abroad.

F.2.5 Changes to this list

The list changes when the platform changes. Before a new provider handles personal data, or before any service in section F.2.3 is switched on, Procura updates this page and gives notice to organisation administrators, by e-mail or in the platform. An organisation that objects can write to privacy@procuraksa.com, and the Data Processing Addendum says what follows. Earlier versions of this page are kept and are available on request. Today the notice is given by hand. An automatic notice is planned.

F.3 Retention, Requests and Incident Schedule

F.3.1 Retention schedule (proposed)

The periods below are proposals. They have not been approved by the owner of Procura or by counsel, and they do not state what any law requires. Until they are approved, Procura deletes or anonymises no customer or personal data under them, and during the pilot no customer or personal data is deleted. The only deletions that take place are the operational clean-ups marked "technical", which the Platform already performs on its own. Once the schedule is approved, the Platform will enforce it class by class, and a class may be switched off by keeping its records (open point OP-10).

The audit trail is never purged, because each entry's hash covers the one before it. Procurement, financial and account records are kept by design, and the period after the relationship ends is for counsel to confirm. A legal hold, a pending dispute or a request from a competent authority suspends any deletion. The period during which a Customer may obtain a copy of its data after termination is not yet set (open point OP-21).

F.3.2 Requests about Personal Data

A Data Subject may send a request about access, a copy, correction, completion, destruction or withdrawal of consent, or a complaint, to the privacy contact in this Pack. Procura acknowledges the request, verifies the identity of the person and, for an organisation's data, that the person is its administrator, and records the request and its outcome in a log. Where Procura is the Controller it answers the request itself; where it is the Processor for a Customer it passes the request to the Customer and tells the person. Procura answers within the period the law sets, and a request that is refused in whole or in part is first reviewed by counsel (open point OP-09).

F.3.3 Incident procedure

Procura keeps a written procedure for incidents involving Personal Data. The clock for notification starts when anyone at Procura becomes aware of the incident, not when it is confirmed. The steps are to detect and report at once, contain the incident without destroying evidence, assess it (what data, whose, how many, where, whether it was encrypted) within 24 hours of awareness, notify the competent authority within the period the law sets where notification is required, tell the affected Controllers and people without undue delay, record every incident and the decisions taken, and review its causes afterwards. Procura has no automatic detection or timer in this release, and the incident log is kept by hand.

F.4 Contact points

Procura is xxxxxxx, commercial registration no. xxxxxxx, whose registered address is xxxxxxx. Its website is https://www.procuraksa.com. The addresses below are the contact points that Procura publishes for these purposes, and no other channel is promised in this release.

Procura aims to reply to operational support enquiries within one business day. That is an aim and not a commitment, and the periods for Personal Data requests, reports and decisions are those set out in the Part that deals with each of them.