Privacy Notice

1. Who we are

ChemCapital is operated by Fahad Zia, sole trader established in Austria, with a business address at Schörgelgasse 89/7, 8010 Graz, Austria. Austrian GISA number: 37963262.

For privacy purposes, the operator of ChemCapital identified above is the controller of personal data processed through the ChemCapital platform unless this notice states otherwise.

Contact for privacy matters: office@chemcapital.at

2. What this notice covers

This notice explains how ChemCapital collects, uses, stores, shares, and protects personal data when you use our website, create an account, contact us, use platform workflows, submit quotations, upload documents, or otherwise interact with ChemCapital.

3. Personal data we collect

We may collect and process the following categories of personal data:

a) account and identity data First name, last name, work email, phone number, password-related authentication data, user ID, avatar, company role, and membership role.

b) business and profile data Job title, company name, registered name, website, country, industry, company size, year established, registration or VAT details where provided, and other company profile details.

c) workflow and transaction-related data RFQs, quotations, purchase orders, project records, attachments, notes, uploaded documents, compliance materials, confirmations, communications, and related metadata.

d) contact and enquiry data Information submitted through contact forms, support requests, invitations, or external quotation submission.

e) billing and payment data Subscription status, plan, Stripe customer references, invoice information, billing contact information, payment status, and related transaction records. Payment card details are typically processed by Stripe rather than stored directly by us.

f) technical and usage data Login/session data, IP address where logged, user-agent data where logged, activity logs, consent records, download events, and similar platform usage records.

g) analytics and storage/access data Consent settings, analytics events, cookie data, and similar storage/access technology data as described in our Cookie Notice.

h) enrichment data Where applicable, if you enter a work email or otherwise use enrichment-enabled flows, we may use business-enrichment tools to infer or prefill company-related information connected with your professional contact details.

4. How we use personal data

We use personal data to: a) create and manage user accounts and organisations; b) provide and operate the platform; c) deliver RFQ, quotation, comparison, purchase-order, and related workflows; d) authenticate users and protect accounts; e) communicate with users about service activity; f) provide support, admin review, abuse handling, and platform safety; g) manage subscriptions, invoicing, payment flows, and related billing processes; h) enable document uploads, downloads, and platform collaboration; i) improve platform performance, security, and user experience; j) comply with legal obligations and respond to lawful requests; k) investigate suspected misuse, fraud, prohibited use, sanctions risk, export-control risk, or security incidents.

5. Legal bases

Where GDPR or UK GDPR applies, we rely on one or more of the following legal bases: a) contract, where processing is necessary to provide the platform and related services; b) legitimate interests, including operating, securing, administering, improving, and defending the platform and managing business relationships; c) consent, where required, including for non-essential analytics and similar technologies; d) legal obligation, where processing is required by law or necessary for compliance, record-keeping, or lawful response.

6. Sharing of personal data

We may share personal data with service providers and processors supporting the operation of ChemCapital, including categories such as: a) hosting and infrastructure providers; b) authentication and database providers; c) file-storage providers; d) email-delivery providers; e) billing and payment providers; f) analytics providers; g) AI-processing providers used for document extraction or comparison support; h) business-enrichment providers used in signup or onboarding flows; i) legal, compliance, and professional advisers where reasonably necessary.

Based on the current platform setup, this may include providers such as Vercel, Supabase, Stripe, Resend, Google Analytics, OpenAI, and Apollo or similar equivalent providers where used.

We may also disclose data: a) where required by law; b) to protect rights, safety, or platform integrity; c) in connection with a business transfer, restructuring, sale, or similar event.

7. International transfers

ChemCapital may use service providers and systems that process or store personal data outside your home jurisdiction. Where required, we will use appropriate safeguards for international transfers in line with applicable law.

8. Retention

We keep personal data for as long as reasonably necessary for the purposes set out in this notice, including to operate the platform, maintain records, investigate misuse, resolve disputes, comply with legal obligations, and defend legal claims.

Retention periods may vary depending on: a) account status; b) billing and tax requirements; c) security and audit needs; d) legal or contractual record-keeping obligations; e) whether deletion is technically or legally appropriate.

We may delete or anonymise data where it is no longer needed.

9. Cookies and similar technologies

ChemCapital uses cookies and similar technologies, including consent preferences and certain session-related storage/access technologies. Where non-essential analytics or similar tools are used, we aim to obtain consent where required by applicable law. Please see our Cookie Notice and privacy preferences page for more detail.

10. Your rights

Depending on the law that applies to you, you may have rights including: a) access; b) correction; c) deletion; d) restriction; e) objection; f) portability; g) withdrawal of consent where processing relies on consent; h) complaint to a supervisory authority.

You can contact us at office@chemcapital.at to exercise privacy rights. We may need to verify your identity before completing a request.

11. Security

We use technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration, or destruction. No system can guarantee absolute security, and you also remain responsible for protecting account credentials and using the platform appropriately.

12. Third-party sites and services

The platform may include links, uploads, documents, and content relating to third-party websites, suppliers, service providers, or payment tools. Their own privacy policies may apply.

13. Changes to this notice

We may update this notice from time to time. Material changes will be posted through the platform or website with an updated effective date.

14. Contact

Privacy contact: office@chemcapital.at